A bad patch is worse than no patch

Shalom Ezekiel — Wed, 30 Sep 2026 18:08:55 +0000

AI can now find a bug and draft a fix in under a minute. That's great, until the fix is wrong and everyone thinks the problem is solved.

That's the danger. An unpatched bug gets attention. A badly patched one gets closed. as a backend developer I read fixes the way an attacker would. Before I merge an AI written patch, I ask five questions. 1. Does it fix the root cause or just hide the symptom?
Catching one bad input isn't the same as fixing the flaw that let it in.

Is there a new test for this bug?
Passing tests aren't enough. Without a test for this specific bug, it can quietly come back.
Did the fix open a new hole?
Look for skipped validation, loosened permissions, and swallowed errors. These are the usual side effects of a "quick fix."
Is the change small and readable?
If a one-line bug becomes a rewrite of half the file, I slow down.
Can I explain why it works?
If I can't, I don't merge it. Then I ask the attacker question

What could someone still do?

Most patches block the exact exploit from the bug report. Attackers don't stop there. They try the next variation. If a patch only handles the example in the report, it isn't finished.

Where this leaves us

AI makes finding and drafting fixes much faster, and I use it. But speed isn't safety. Someone still has to answer for what ships, and right now that's a human reading the diff.

How do you review AI written patches? Tell me what's on your checklist.

DEV Community: Shalom Ezekiel

A bad patch is worse than no patch