My frustration is that no one is validating AI output, at least on my team. We've mostly been working on CVEs recently. I won't deny that AI has accelerated the process, in that instead of spending large amounts of time researching problems and applying the fixes manually, I can just copy and paste the answer it provides ... But generally the answer is text like "updated the vulnerable package," even though we haven't (because usually the updated package isn't available, to continue this example).

Many on my team are experienced and competent and even those people are just relying on the CI pipeline to validate for them, but so far as I can tell it just checks to see whether the vulnerability is mentioned in the configuration files.

Some of the team members are new. I'm 100% certain they're just copying and pasting.

I am experienced. I was trying to do the job right by validating before I made entries, but I was repeatedly chastised for being slower than the people who are just copying AI output. My company hasn't outright said but has heavily implied "if the customer [who provides the validation pipeline] doesn't care, why should we?"