The Code Review Mindset: Trust But Verify

AI Output Is a First Draft, Not a Final Answer

One of the most dangerous habits an engineer can develop with AI tools is treating generated code as correct by default. AI models are trained to produce plausible-looking output — and plausible is not the same as correct, secure, or appropriate for your context.

Think of AI-generated code the way you would think of code submitted by a very fast, very confident junior developer who has read a lot of code but has never run your specific system in production. You would not merge that code without review. The same standard applies here.

What to check in every AI-generated code block:

1. Correctness: Does it actually do what you asked? Run it. Write a test. Don't assume.
2. Edge cases: Did the AI handle the failure modes you care about, or only the happy path? Check for missing None checks, uncaught exceptions, and off-by-one errors.
3. Security: Did the AI introduce a vulnerability? Common AI mistakes include SQL string concatenation (SQL injection risk), hardcoded credentials, and missing input validation.
4. Idiomatic fit: Does the code match your team's conventions? AI will often produce valid but inconsistent code — using dict.get() in one place and direct key access in another, for example.
5. Dependencies: Did the AI import a library you don't use, or use a feature from a newer version of a library than you have installed?

A concrete example of a subtle AI mistake:

You ask an AI to write a function that queries a database by user ID. It produces:

# DANGEROUS — do not use
def get_user(user_id):
    query = f"SELECT * FROM users WHERE id = {user_id}"
    return db.execute(query)

This is a textbook SQL injection vulnerability. The AI generated syntactically valid, functionally correct code for the happy path — but it is a serious security hole. A senior engineer catches this immediately. A junior engineer who trusts the AI output ships it.

The correct version uses parameterized queries:

# Safe
def get_user(user_id):
    query = "SELECT * FROM users WHERE id = %s"
    return db.execute(query, (user_id,))

Key Point: The value of AI tools scales with your ability to critically evaluate their output. An engineer who cannot spot a SQL injection vulnerability in AI-generated code is not more productive with AI — they are more dangerous. Invest in your security and code quality fundamentals; they become more valuable, not less, in an AI-assisted world.