I Let AI Build a Feature Without Giving It the Full Context

If you give an AI a vague prompt, it will give you a confident answer. And that confidence will cost you a weekend of debugging.

Last month I decided to test how far I could push an AI agent. I didn't want to use it to write a simple function. I wanted it to build an entire backend feature from scratch, end-to-end.

The feature was a standard requirement: A CSV export endpoint for user data.

I opened my AI tool, cracked my knuckles, and typed a prompt that took me exactly 5 seconds to write:

"Create an Express API endpoint that exports all user records from the database into a CSV file and returns it for download."

Thirty seconds later, the AI spat out a perfectly formatted controller, a well-written database query, and even a utility function to convert JSON to CSV. It looked elegant. The variable names were clean. It compiled immediately.

I felt like a 10x developer. I pushed the code, merged the PR, and deployed to production.

And then, within 10 minutes, the support tickets started rolling in.

The Illusion of Perfect AI Code

Here is the thing about AI: It doesn't know what it doesn't know.

Because I didn't give the AI any context about our system, it made three massive assumptions that completely broke production:

1. The All Users Security Nightmare

I wrote "exports all user records." The AI did exactly that. But wait I work on a multi-tenant SaaS. "All users" means every single user across every single company in our database.
An admin from Company A downloaded the CSV and suddenly had the names and emails of Company B. It was a massive data leak because I forgot to tell the AI, "Only export users belonging to the authenticated user's organization."

2. The Memory Explosion (OOM)

The AI wrote a beautiful query: const users = await db.user.findMany(); followed by mapping over the array. It worked perfectly in local testing where I had 50 users.
In production, we had 2.5 million users. The server didn't just crash; it had an Out-Of-Memory (OOM) error because the AI tried to load 2.5 million records into memory simultaneously. I forgot to tell the AI, "Use a streaming approach or pagination."

3. The CSV Injection Vulnerability

The AI did a simple join(',') to create the CSV. But users can enter their own names. If a user named themselves =SUM(1+1) or =cmd|' /C calc'!A0, Excel would actually execute that formula when the admin opened the CSV file. I forgot to tell the AI, "Sanitize the data to prevent CSV injection."

None of these bugs were the AI's fault. The AI did exactly what I asked.

The failure was 100% mine, because I gave the AI the "What" but not the "Where" and the "How."

The Context Debt is Real

This experiment taught me one massive lesson: AI is not a mind reader. It is an incredibly fast, highly obedient intern with amnesia.

When you don't give the AI the full context of your system, its architectural rules, and your security boundaries, it writes code in a vacuum. And code written in a vacuum is just technical debt waiting to explode in production.

We spend so much time arguing about which AI model is smarter GPT-4o, Claude 3.5, Llama 3. But a smarter model wouldn't have saved me here. Even a genius model can't guess that I'm using a multi-tenant database with millions of rows.

How to Fix It: Context-Driven Development

If you want AI to actually save you time (and not get you fired), you have to stop writing Twitter-style prompts and start writing Context-Rich prompts.

Here are the 3 rules I now follow:

1. Share the Database Schema

Don't just say "user data." Paste your Prisma schema, your TypeORM entities, or your SQL table definitions into the prompt. AI is amazing at spotting relations when it can actually see the tenant_id foreign key.

2. State the Constraints Explicitly

If your system has rules, write them down.
"Assume the table has 2 million rows. Use a streaming approach."
"This is a multi-tenant app. Always filter by organization ID."

3. Define the Edge Cases Before You Prompt

Tell the AI to be paranoid.
"Assume users can input malicious strings. Sanitize all CSV outputs."
"Add rate limiting to this endpoint."

The Ultimate Question: Prompts vs. Models?

We are living in a golden era of AI models. They are getting exponentially smarter every six months. But my production incident proved that a brilliant model with terrible context is still a disaster.

So, I want to ask you:

Is better prompting more important than better AI models?

Will we eventually reach a point where AI knows our codebases so well (via RAG and local indexing) that we don't need to prompt perfectly? Or is "Context Engineering" the real skill of the future?

Drop your thoughts in the comments below. I'd love to know how you handle giving AI the right context!