AI-generated code tends to look tidy. The names are sensible, the structure is familiar, and the comments read well. That polish is the risk. A reviewer who relaxes because the code looks right will miss the errors that matter most.
Good review of generated code asks different questions from review of code written by a colleague who knows the system.
Check the claims first
Start with what the change says it does. Compare the description, the tests, and the diff. If the author says "adds retry logic" and the diff does not touch the call site, something is missing. Agents sometimes report success for work they did not complete.
Check what is not there
Generated code often omits the things a human would remember: timeouts, input validation, error handling for the failure path, cleanup of resources, and logging that helps someone debug at night. Look for what should be present and is not.
Check the dependencies
An agent may add a package you did not choose, or pick a version that does not match the rest of the project. Review every change to the manifest and the lockfile. Confirm each new package is one you would have chosen, and check that its name is spelled correctly. Typosquatted packages are a real risk.
Check the data and the secrets
Search the diff for keys, tokens, and connection strings. Check what data the code reads, stores, or sends, and where it goes. Generated code is good at moving data to convenient places, which is not always the right place.
Check the edges
Ask what happens with empty input, a very large input, a slow dependency, and two requests at once. These are the cases generated code most often skips.
Keep the review small
A reviewer can check a few hundred lines carefully. Ten thousand generated lines get a skim. If an agent produced a large change, ask it to split the work into reviewable pieces, each with its own checks.
Use tools to reduce the load
Linters, type checkers, and tests catch a large share of the mechanical errors, so the human reviewer can focus on intent and design. Run them before review, and require them to pass.
Record what you reviewed
For changes that matter, keep a short note: what was checked, what was tested, and what remains unverified. That note is useful when something fails later, and it discourages approval by habit.
Summary
Review AI-generated code by checking the claims, the omissions, the dependencies, the secrets, and the edges, in that order. Keep each review small, let tools handle the mechanical checks, and write down what you verified. Speed of generation does not change the standard a change must meet.
Top comments (0)