Posted on

Machine-produced software tutorials and unverifiable execution claims

A software tutorial makes a quiet promise: these steps work.

That promise is stronger than ordinary explanatory prose. If an article tells you to install a package, edit a configuration file, run three commands, and expect a service to start on port 8080, the reader assumes somebody has tested that sequence or at least verified it against the relevant documentation.

Generated tutorials can imitate that confidence without executing anything.

The result is a particularly dangerous form of plausible nonsense because code has syntax. A command can look exactly right while naming a package that does not exist, using an obsolete flag, referring to a file path from another operating system, or producing an output the command could never return.

The terminal is a better fact-checker than prose

Package-name hallucinations are a concrete example. Recent research on “slopsquatting” has examined cases where coding models invent realistic package names. If a user blindly follows an installation command for a nonexistent package, that mistake can become a security problem if somebody later registers the invented name with malicious code. A 2026 paper on package-name hallucinations describes this as a supply-chain risk and tests methods for checking package existence before installation. See Names Can Hurt.

The larger lesson is simpler than the security scenario: software instructions need execution evidence.

A trustworthy tutorial can say which versions were tested, what operating system was used, what dependencies were installed, and what output appeared. Better still, the example can include a repository, fixture, test, container, or script that another person can run.

That turns “this should work” into something reproducible.

Generated code is not automatically untrustworthy

Machine assistance can be genuinely useful for explaining APIs, drafting examples, converting commands between shells, or filling in repetitive setup steps. The problem is not that a model touched the article. The problem is publishing an execution claim that nobody verified.

There is a big difference between:

pip install some-package

and:

“Tested on Python 3.13 on Ubuntu 26.04; this command was run successfully on September 17, 2026.”

The second statement is evidence about an event.

A generated tutorial can be perfectly correct. But correctness should be demonstrated through execution, not inferred from how convincingly the markdown code block is formatted.

Software does us one favor that many other subjects do not: it usually lets us test the claim.

Run the commands.