Reviewing AI-Written Code
An AI coding assistant can produce a hundred lines of syntactically correct, well-formatted code in seconds. Syntactically correct and well-formatted is not the same as correct, secure, or appropriate for your context. Code review — the practice of critically reading code before accepting it — is a standard professional practice in software teams. When you use AI as a collaborator, you become your own code reviewer. This lesson gives you the framework to do that job well.
What Code Review Actually Checks
Professional code review is not just looking for typos or obvious bugs. It systematically checks several layers: Logic correctness: does the code do what it claims to do? Walk through the logic manually with a representative input. Edge case handling: what happens with empty input, null values, extremely large values, or unexpected types? Does the code handle them gracefully? Security: does the code handle untrusted input safely? Does it expose sensitive data? Does it make security-relevant assumptions that might not hold? Style and clarity: is the code readable? Are variable names meaningful? Is there dead code, commented-out fragments, or unexplained magic numbers? Dependencies: does the code introduce new external libraries? Are those libraries actively maintained, widely trusted, and necessary — or could the task be accomplished without them? Test coverage: are there tests for this code? If not, are there obvious test cases that should exist?
Effective review means asking the code questions: Why does this loop start at 1 instead of 0? Why is this value hardcoded instead of a parameter? Why is this exception caught and silently ignored? If you cannot answer these questions by reading the code, that is a finding — the code needs clarification or change before it belongs in your project.
A specific checklist for reviewing AI-generated code: 1. Read for intent first: what is this code trying to do? Make sure your understanding matches your request. 2. Trace the happy path: manually step through the code with a typical input. Does each step make sense? 3. Introduce adversarial inputs mentally: what if the input is empty? What if it is null? What if a required field is missing? 4. Look for silent failures: does the code swallow exceptions without logging or re-raising? Does it return a value that could silently be wrong? Silent failures are especially dangerous — the program continues running with incorrect state. 5. Check constants and magic numbers: hardcoded values like timeout=5000 or maxRetries=3 should be named constants or configurable parameters, not literals buried in logic. 6. Identify external calls: any call to an external API, database, or file system is a point of failure. Is each one handled if it fails? 7. Look for security red flags: we cover these in detail in the next lesson, but scan for: string concatenation to build SQL queries, user-controlled values passed to system calls, and secrets stored in code.
When AI Code Looks More Sophisticated Than It Is
AI models are trained on large codebases and produce code that superficially resembles expert output — complex patterns, multiple helper functions, descriptive comments. This appearance of sophistication can lower your guard. Several patterns deserve particular skepticism: Over-engineered solutions: the AI produces a six-layer abstraction for a problem that needed a five-line function. Complex code is harder to verify and maintain. Plausible but incorrect algorithms: the AI uses a real algorithm (a sorting algorithm, a graph traversal) but applies it to a problem it does not fit, or implements it with a subtle bug. These are hard to catch without domain knowledge. Outdated APIs: the AI was trained on code from a certain period. It may use deprecated functions or APIs that have been replaced, producing code that works now but is scheduled for removal. Confident but wrong comments: the AI may write a comment saying 'this handles the null case' when the code does not actually handle it. Always verify that comments match code behavior.
Match each code review finding to the category it falls under.
Terms
Definitions
Drag terms onto their definitions, or click a term then click a definition to match.
After receiving AI-generated code, follow up with a prompt like: 'Review this code for security vulnerabilities, silent failures, and edge cases that are not handled. Be specific.' AI models often catch their own mistakes when asked to look for them explicitly — though they do not catch everything, and you must still verify their analysis.
A code review of an AI-generated database query function reveals that user-supplied search terms are concatenated directly into the SQL string. This is a finding in which review category?
An AI-generated function has a comment reading 'Returns -1 if the user is not found' but the actual code raises an exception instead of returning -1. What is the correct action during code review?
Structured Review of AI-Generated Code
- Step 1: Ask an AI to generate a user registration function that accepts a username, email, and password and stores them. Request a moderately complex implementation.
- Step 2: Using the seven-point checklist from this lesson, review the code systematically. For each checkpoint, write a brief note: either 'OK — [reason]' or 'Finding: [specific problem].'
- Step 3: Tally your findings. Categorize each as: Logic, Edge Case, Security, Clarity, Magic Number, Dependency, or Test Coverage.
- Step 4: Prioritize your findings. Which ones must be fixed before the code can be used? Which are improvements that would be nice but are not blocking?
- Step 5: Write a one-paragraph code review summary as if you were presenting it to a teammate — professional, specific, and actionable.