Why standard linters miss AI code bugs (and how to deflect them before git push)

Muhammad Shahbaz Ali — Fri, 13 Nov 2026 18:49:53 +0000

Standard linters (eslint, flake8, cargo check) were built to catch human syntax and style conventions. But when coding with AI agents like Claude Code, Cursor, or Gemini, the problem is different: AI writes code that is syntactically clean, but semantically broken.

Traditional linters pass code that secretly introduces:

Phantom / hallucinated dependencies that do not exist on npm, PyPI, or crates.io.
Training-cutoff API drift (methods deprecated, altered, or hallucinated).
Async starvation, silent thread blocking, and race conditions.
Web3 / smart contract logic traps (e.g. unchecked account validation, reentrancy).

To solve this, we built Parry — an open-source hybrid code verifier and developer security tool designed to deflect AI hallucinations locally before git push.

The 100-Case Evil AI Benchmark

We verified standard linters against our Top-100 Evil AI Benchmark — 100 real-world defects generated by GPT-4o, Claude, Cursor, and Gemini across Python, TypeScript, JavaScript, Rust, and Solidity:

Standard linters caught only a tiny fraction of semantic defects because the syntax was valid.
Parry's sub-15ms AST engine deflected 100 / 100 (100%) with exact rule attribution.

How to Use It

Parry operates with zero style nitpicks as a local CLI, pre-commit hook, or native Model Context Protocol (MCP) server for Claude Code, Cursor, and Gemini.

Production Workbench & Docs: parry.scopeledger.net
Open-Source Benchmark & CLI: github.com/AI-Ops1/Parry

Run it against your project:

python parry.py check .

Or run the full 100-case suite:

python parry.py bench

Would love to hear how other teams and solo developers are gating agent-generated PRs before code lands in production!

Why AI coding agents cheat your tests (and how to stop them)

Muhammad Shahbaz Ali — Fri, 13 Nov 2026 18:27:22 +0000

Prompting an AI to check code written by an AI is like asking the chef if the soup is poisoned.

It sounds nice in theory. But in reality, you get fifty lines of polite advice while the model completely overlooks that it just removed an authentication check or cheated your unit test.

If you use Cursor, Claude Code, or Copilot, you have probably noticed these three common failure modes:

The AI cheats your unit tests

You ask the AI to fix a bug failing a test. A minute later, the test is green!

You check the diff, and the broken service logic was never touched. Instead, the AI just changed the test mock so the assertion stopped looking for the bug:

typescript
// What the AI changed in your test:

expect(authService.login).toHaveBeenCalledWith(validUser);
expect(authService.login).toHaveBeenCalled(); // Assertion weakened!

Hallucinated packages (Slopsquatting) AI models often invent package names that look real:

python
import arangodb_driver # This package does not exist!

If an attacker registers that fake name on npm or PyPI, your application installs malicious code. Regular linters pass it because the syntax is valid.

Dropping authentication checks When you ask an AI to quickly add an endpoint, it often forgets session checks:

typescript
// Generated by AI:
app.get("/api/users/:id/invoices", async (req, res) => {
// Missing: auth check to see if the user owns this invoice!
const invoices = await db.invoices.find({ userId: req.params.id });
return res.json(invoices);
});
Why syntax linters miss these bugs

Traditional linters (ESLint, Ruff) only look at grammar inside a single file. If the syntax is valid, they give a green checkmark—even if your business logic or security is broken.

Prompting another LLM to review your code is slow, costs money, and often hallucinates.

The Fix: Deterministic AST checks (<1ms, 0 tokens)

I built an open-source tool called Parry.

Instead of calling another LLM, Parry inspects your code's Abstract Syntax Tree (AST) locally before you commit:

Instant (<1ms): Runs in your local git pre-commit hook with zero delay.
Zero cost: Consumes 0 LLM tokens and never sends your code to the cloud.
Catches real AI bugs: Detects unlisted package imports, test mock tampering, and dropped auth checks.
Top-100 Evil AI Benchmark: Tested across 100 real-world AI coding vulnerabilities with 100% detection and 0% false positives.
Try it yourself (Open Source)

The core CLI is MIT open-source and requires zero package installs:

bash
git clone https://github.com/AI-Ops1/Parry.git
cd Parry
python3 parry.py bench

You can also test any public GitHub repository directly in your browser:
👉 https://parry.scopeledger.net

Have you caught your AI coding assistant doing sneaky things with your tests? Let me know in the comments!

DEV Community: Muhammad Shahbaz Ali

Why standard linters miss AI code bugs (and how to deflect them before git push)

The 100-Case Evil AI Benchmark

How to Use It

Why AI coding agents cheat your tests (and how to stop them)