From AI-Written Code to Verifiable Software: Safi Shamsi's Next Engineering Problem

Software teams can now generate code faster than they can always understand what that code changes. Safi Shamsi has built his current work around that imbalance. As founder and CEO of Graphify, he is developing technology that uses knowledge graphs and verification methods to map relationships inside large software systems, identify what a change affects, and determine whether existing behavior has been preserved. The objective is to move beyond another model saying that AI-generated code looks correct and toward evidence that it behaves as expected.

"AI can generate code incredibly quickly now," Shamsi said. "The problem is knowing whether that change is actually safe to ship."

Large language models are probabilistic systems, which creates a particular challenge when one AI system is asked to evaluate code written by another. A second model may flag potential problems, but its judgment remains probabilistic as well. Shamsi's work is aimed at creating a separate verification layer that can examine what changed and provide evidence about whether expected behavior still holds.

"If AI writes the code and another AI reviews it, you still have one guess checking another guess," Shamsi said. "For critical software, I think the bar has to move from review toward verification."

The technical foundation for that work predates Graphify. Shamsi completed a master's degree at the University of Birmingham, where his thesis focused on knowledge graphs. He also published two peer-reviewed papers covering knowledge graphs and computer vision in Springer's Lecture Notes in Electrical Engineering. The research gave him a framework for representing relationships explicitly rather than leaving important information distributed across documents, repositories, and separate systems.

He later applied that same principle to software. A large codebase may contain dependencies spanning multiple repositories, including components that have not been actively modified for years. A change that appears isolated can alter behavior elsewhere because another system relies on a relationship that is difficult to see by examining a single file or repository.

Graphify is designed to map those relationships and provide AI systems with a structured view of the software environment. Shamsi's goal goes beyond identifying code that appears risky. He wants the system to determine whether behavior changed and, when something breaks, identify an input that demonstrates the failure before the change is merged.

"The useful question is not whether a change looks reasonable," Shamsi said. "You want to know what it changed, what depends on it, and whether you can demonstrate that the behavior is still correct."

Formal verification is one of the more difficult parts of that objective. Methods for establishing properties about software have existed in academic computer science for years, but applying them across large enterprise environments creates a different engineering problem. Production systems can contain undocumented assumptions, old dependencies, and behavior understood most clearly by people who have worked with the code for years.

Shamsi has been working to adapt techniques associated with academic research to that production complexity. Some regulated organizations also require software to operate entirely inside their own infrastructure, including air-gapped environments where sensitive code cannot be sent to an outside service. In those settings, engineering teams may need evidence showing how a result was reached rather than another confidence score or recommendation.

"In enterprise, 'trust me' loses to 'here's the proof' every single time," Shamsi said.

That verification layer already runs across multiple languages, including Python, Go, Java, C++, and Rust. In one internal test over a corpus of 250 real code changes, it produced sound verdicts on whether behavior was preserved, and where a change altered behavior it returned a specific input demonstrating the difference rather than a confidence score. On a separate labeled benchmark of ambiguous method calls in JavaScript and TypeScript, the system resolved 100 percent of the call relationships correctly, a measure of how precisely it can trace what a change actually touches.

The knowledge-graph work underlying that approach has already attracted substantial developer adoption. An open-source project Shamsi released has surpassed 131,000 GitHub stars and 9 million PyPI downloads. Those figures provide a measurable indication that developers are continuing to install and use the technology rather than merely expressing interest in the idea.

External recognition has added another independent marker. Shamsi was named one of the Top 25 Founders Under 26 at the London AI Summit. Graphify has also been accepted into Y Combinator's S26 batch, while engineers at companies including Shopify, Datadog, and JP Morgan have used the open-source project in production, according to Shamsi.

The verification problem becomes especially visible during modernization work. Framework upgrades, major refactors, and legacy-system migrations can require engineering teams to determine whether a replacement behaves like the system it is replacing. A faster rewrite does not eliminate the need to understand the dependencies and behavior accumulated across years of production use.

A verification layer capable of comparing behavior gives teams another form of evidence during that process. Instead of assuming that a rewritten system is equivalent because its code appears correct, engineers can examine whether observable behavior has actually been preserved.

"You can generate replacement code much faster now, but that does not remove the responsibility to understand what changed," Shamsi said. "The more consequential the system is, the more important that proof becomes."

As generated code becomes more polished, errors can also become less obvious during ordinary review. Graphify's approach separates generation from the structured knowledge and verification mechanisms used to evaluate what the generated change actually did.

Shamsi's academic work gave him a way to represent relationships inside complicated systems. The subsequent open-source adoption provided evidence that developers found the approach useful outside research. His current work at Graphify takes that foundation into enterprise software, where the question is increasingly whether teams can establish what AI-generated code changed before allowing it into production.

"The standard I want to get to is simple," Shamsi said. "If AI is going to write more of the software, enterprises should not have to take its work on faith. They should be able to establish what changed and whether it still works."