Cisco's unlimited-token rewrite is a key-person risk no board should copy

Jeetu Patel, Cisco's president and chief product officer, has given Padmanabhan Krishnamurthy, aged 27, unlimited AI tokens and 24 months to refactor 98% of the company's legacy code. He gets four weeks to prove the approach works. According to Fortune's account, Krishnamurthy's pitch was that a team of two could do it. I opened the story expecting a feel-good piece about hiring young people in a bad market for graduates. I finished it thinking Cisco's board should be asking who signed off on this, and with what spending limit.

Start with the money, because nobody has published any. Fortune does not say how many tokens Krishnamurthy has burned, what they cost, or how much code has been refactored so far. Patel's own description was "you can go nuts." I have run budgets. Any finance director who saw an uncapped line item, approved by one executive, for one employee, with no public progress measure, would send it back. At a company that sells the switches and firewalls a large share of the internet runs through, the cost that worries me is the cost of what ships, more than the token bill.

I give Patel credit for spotting talent. Krishnamurthy cofounded EzDubs, a real-time translation startup built in 2023 and bought by Cisco in 2025, and Patel says he found him five levels down doing work of no strategic value. Pulling a founder out of that hole is good management. Putting him in charge of decades of networking code is a different call. Building a translation app teaches you to ship fast. Keeping router software stable for customers who cannot afford a bad firmware update teaches you something else, and I see nothing in the reporting suggesting he has done the second.

The outside evidence on AI coding should make any board nervous about letting the person doing the work also judge whether it went well. METR ran a randomised controlled trial in 2025 with 16 experienced open-source developers on 246 real tasks in their own repositories, which averaged more than a million lines of code. The developers believed AI made them 20% faster. They were 19% slower. Veracode tested more than 100 large language models on 80 coding tasks and found the generated code introduced security vulnerabilities in 45% of cases. Put those two findings together and you get a person who feels productive while producing flaws he cannot see, at a scale no reviewer can keep up with.

Cisco has a reasonable reply, and I want to take it seriously. Patel frames the rewrite as a security project, arguing that moving code into memory-safe languages cuts vulnerabilities by design. He says the wider engineering organisation will be involved, that the two or three people at the centre are a catalyst, and that Cisco's core team will own the final product. He also concedes some experiments will fail. I agree memory-safe migration is worth doing. My problem is with the arithmetic of review. If a small group generates code faster than anyone can check it, the core team ends up owning modules it never wrote and cannot fully read. A customer whose firewall regresses gets no help from the org chart. Patel calls the two-person team a catalyst, but 98% of the code estate in two years is a programme-sized target.

Follow the incentives and the picture gets less flattering. Model vendors bill by the token, so an uncapped account is their ideal customer. Patel gets a public story about an AI-native culture. Krishnamurthy gets a jump of five levels. Customers carry the regression risk. One aggregator summary on X ties the project to 4,000 Cisco job cuts in May during an AI restructuring; I have not seen that confirmed against Cisco's filings, but if it holds, some of the engineers who knew why the old code behaves oddly may already be gone.

Other boards will be tempted to copy this, because it is cheap to announce and flattering to the executive who announces it. If yours is one of them, I would set a published token ceiling, start with one low-risk product line, require a named senior engineer to sign off each merged module, and compare defect and vulnerability counts against the old code before releasing more budget. Cisco can still do all of that at the end of the four-week trial.

If you buy Cisco equipment, put a question to your account team in writing before your next renewal: which of the product lines you run contain code from this rewrite, and what regression testing did it go through before release. If they cannot give you a straight answer, delay the firmware update until they can.

Prompted by Cisco gives 27-year-old engineer unlimited AI tokens to rewrite 98% of the company's legacy code in 24 months — president plucks former startup founder, telling him to 'go nuts', tomshardware.com.