Review AI-Generated Code — AI-Assisted Coding, Part 4
Updated: Oct 9
AI-Assisted Coding · Part 4
AI writes confident, wrong code — fluent, well-formatted, and occasionally calling a function that doesn't exist. The fluency is the danger: it's easy to skim, nod, and merge something you'd have caught instantly if a junior engineer had written it. Reviewing AI-generated code is now a core skill, and it's less forgiving than reviewing a human's. This walks through reviewing it properly: reading every line, catching invented APIs and missed edge cases, and treating the output like any other PR.
AI writes confident wrong code. Reviewing it is now a critical skill.
Step 1: Read Every Line (10 min)
Tempting: see the function "looks right"; accept.
Don't. Read every line.
AI mistakes pile up across the codebase if you don't.
5 minutes of review per AI-generated function saves debugging hours.
Step 2: Check Invented APIs (10 min)
# AI suggested
import requests
response = requests.get_with_retry(url, retries=3)
requests.get_with_retry doesn't exist. Hallucinated.
Verify: does this function actually exist? In this version?
For unfamiliar libraries: check docs.
Step 3: Check Edge Cases (15 min)
AI optimizes for the happy path. Edge cases get skipped:
Empty inputs
Null / None
Concurrent access
Boundary values
Negative numbers
Unicode
Add tests. Run them. Often AI code fails on edges.
Step 4: Verify the Logic (15 min)
def is_valid_age(age):
return age > 0 and age <= 150
Looks reasonable. But:
Should age == 0 be valid?
Is 150 the right max?
What about negative ages (legitimate test data)?
Read the logic against your actual requirements. AI guesses.
Step 5: Security Sensitivity (15 min)
AI writes SQL like:
query = f"SELECT * FROM users WHERE email = '{email}'"
db.execute(query)
That's injection waiting.
Check for:
SQL injection
XSS
Hardcoded secrets
Weak crypto
Auth bypasses
Path traversal
AI often misses these. Don't trust security-critical code.
Step 6: Style Consistency (10 min)
AI may write style different from your codebase:
Different naming conventions
Different error handling patterns
Different test structure
Different file organization
Conform to local style. Reviewer will flag otherwise.
Step 7: Performance (10 min)
AI sometimes:
Nested loops where one would do
Unnecessary copies
N+1 queries
Redundant computation
For hot paths: read with perf in mind. Profile if uncertain.
Step 8: Maintainability (10 min)
AI loves:
Many helper functions
Defensive coding
Type assertions everywhere
Generic abstractions
Sometimes overengineered. Simplify for readability.
You'll read this code in 6 months. Make it understandable.
Step 9: Test It (10 min)
Run the code.
Don't just review. Execute:
Tests pass
Manual run works
Integration with neighbors OK
I've seen too much "looks good, ship it" — code that doesn't even compile.
Step 10: Treat It Like a PR (10 min)
Mental shift: AI is a junior contributor.
Apply the same review bar you'd apply to a junior's PR:
Correctness
Tests
Style
Performance
Security
Not lower. AI gets a million chances; the bar holds.
What You Just Did
Review AI code: read every line, invented APIs, edges, logic, security, style, perf, maintainability, test, like a junior's PR. Quality control.
Common Failure Modes
Trust AI for security code. Vulnerabilities ship.
Skip edge cases. Bugs in production.
Ship invented function calls. Crashes immediately or worse, silently wrong.
Accept first suggestion. Lower quality than your real bar.
No tests for AI code. Untested code production.
If you want a checklist to review against, the AI Failure Mode Register lists sixteen ways AI-generated code fails, the evidence for each, and the control that catches it. It is also a free download.
Continue the AI-Assisted Coding path
Previous — Part 3: AI Pair Programming
Part of the AI-Assisted Coding learning path.
