Stop reviewing AI code like a human wrote it

The way you review code was built for code written by people. AI writes code that fails differently, so your old review habits miss the bugs.

Here is the problem in one example.

def get_invoice(invoice_id, user):
    if not user.is_authenticated:
        raise PermissionError("Login required")
    return db.invoices.find(invoice_id)

This looks fine. Good name, clear check, one job. It passes review in ten seconds. It also lets any logged-in customer read every invoice in your database. The code checks that you are a user. It never checks that you are the right user. A human would have written this badly enough for you to notice. An AI writes it cleanly, which is exactly why you approve it.

Why your review habits stopped working?

You do not read every line of a pull request. You scan for signs that the author was careful: good names, matching docstrings, small functions. When you see those signs you speed up. When you see a 200-line mess you slow down and read properly.

That worked because messy code meant a rushed human. Careful code meant a thoughtful human.

AI produces careful-looking code every single time, whether the logic is right or wrong. So the signal you have been relying on for years now tells you nothing.

The four bugs you will actually hit

1. It solves a similar problem, not yours.

You ask for your renewal rule. You get the most common renewal rule on the internet. Clean, tested, and wrong for your business.

2. It invents things.

A function the library does not have. A config key nobody defined. A package name that sounds real and is not. Attackers now register those fake names, so installing one is a genuine security risk.

3. The error handling does nothing.

There is a try/catch. There is a log line. The catch hides the error and returns a default value. That wrong value then travels into a report somewhere else.

4. The tests only confirm the bug.

Ask for tests on generated code and you get tests that describe what the code already does, including the mistake. All green, high coverage, nothing checked.

What to do instead?

• Read the requirement first, then the code - If you open the diff first, the code tells you what the requirement was. That is how the wrong feature gets approved
• Try to break the tests - Change a > into a <. Delete an if. Run the tests. If they still pass, the tests are useless.
• Let CI check that things exist - Every package, import, and config key. A machine can do this. Do not spend your own attention on it.
• Read the dangerous code five times harder - Login, permissions, payments, deleting data. Skim the styling. Nothing in the diff tells you which is which, so you have to decide before you start.
• Ask specific questions - "Does this look right?" gets you nowhere. Ask "who is allowed to call this, and where is that checked?" That is the question that catches the invoice bug above.
• Run the code - Reading is weak against code that was written to read well. Execute it and watch what happens.
• Keep diffs small - Nobody can honestly review 900 lines that took twenty seconds to generate.

Reviewing this way is slower, and speed is why you started using AI in the first place. So do not try to do it all by hand. Push the mechanical checks into CI. Save your real attention for small diffs and dangerous code. Anything is better than scrolling through a clean, confident diff and typing LGTM.