On the morning of Friday 12 June, Instagram, Facebook, WhatsApp, and Threads went down simultaneously. Over 100,000 users reported problems within the first hour. The outage ran for around five hours, was classified internally as a SEV-0, and would become one of the more consequential examples of what happens when AI code review replaces human judgment entirely.
The cause was not an external attack. It was a code change. One that had gone through AI code review, and nothing else. No human had seen it before it went live.
What happened on June 12
Meta had spent the preceding months doing two things at once: expanding AI code generation across the codebase, and cutting the teams responsible for reviewing what the AI produced.
Instagram’s Trust and Safety team lost around 50% of its headcount. Senior engineers were reassigned to AI training and data-labelling work. In the two months before June 12, AI-generated changes reviewed only by another AI, with no human input at any point, had become routine.
Gergely Orosz reported on 16 June: “AI-generated, AI-reviewed code, and security teams being gutted were together the cause of this beyond-embarrassing incident… The change that caused this outage looked like one of these.”
It gets worse. Meta did not notice the outage from internal monitoring. They noticed because users started reporting it on social media. The monitoring that would have caught this early had also been cut.
Meta’s Chief Security Officer resigned the following day.
How you end up here
This is not a story about AI being unreliable. It is about what happens when you build the wrong incentive structure around it.
Meta was measuring token spend in engineer performance reviews. When the metric that drives your rating is how much AI you use, you use more AI. You generate faster. You review less carefully. The humans who used to sit between “this code exists” and “this code is live” get reclassified as overhead.
The cost of building has never been lower. The cost of being wrong has not changed. The gap between those two things is where incidents like this live.
Speed is now cheap enough that organisations can accidentally deploy faster than their review capacity can keep up. That is not an AI problem. It is a system design problem that AI made possible at a scale nobody planned for.
The assumption baked into this structure is that AI-generated code is reliable enough to skip the human check. That assumption does not get tested in a design review. It gets tested at 10 a.m. on a Friday when 100,000 users can’t log in and the monitoring doesn’t fire.
One outage is a mistake
June 12 was not Meta’s first. On 30 May, less than two weeks earlier, Facebook and Instagram had both gone down. The cause was different, but the scale was comparable. Inside the company it had been described as the most embarrassing outage in Meta’s history.
Then June 12 happened. That label needed revising.
A SEV-0 at a company Meta’s size means every active engineering team stops what they are doing. It triggers direct escalation to senior leadership within minutes, war room briefings, formal incident records, and usually public statements. Meta had already run that entire process on May 30. It ran it again twelve days later, for a different incident with the same underlying cause.
Two SEV-0s in a fortnight is not bad luck. A single incident can be a freak event: unusual load, a configuration change that interacted badly with something else, bad timing. Two incidents in the same window, both traceable to the same underlying cause, is a system producing predictable outcomes.
The “Again.” is not rhetorical. It is the diagnosis.
The question AI cannot answer
AI code review can catch a great deal: syntax errors, pattern violations, known antipatterns, tests that fail. In many contexts it is more thorough and consistent than a rushed human review.
What it cannot do is answer: should this go out now?
That is not a technical question. It requires knowing what the system is currently carrying, who depends on it, what else has changed recently, and what the blast radius looks like if something goes wrong. That judgment does not disappear when you remove the humans who were exercising it. It just goes unexercised.
Meta’s Trust and Safety team was not just catching bugs. They were the people who knew enough to say not yet. When they were gone, the code went out anyway.
Meta has some of the best engineers in the world. They had the culture, the tooling, a track record of stable infrastructure. None of it was enough when the humans responsible for judgment were replaced by systems that only generate output.
Nobody is immune to this. The question for any organisation moving fast with AI is not whether it can deploy faster. It is whether it has kept the capacity to know when not to.
Leave a Reply