AI-generated code can look polished while still hiding weak assumptions. The reviewer’s job is to check the behavior, not the syntax level of confidence the code seems to project.
Start with the contract
Before reading the implementation, ask what the code promises to do and what it must never do.
- What inputs are trusted, and which are hostile?
- What failure mode is acceptable?
- What state does the code assume already exists?
Look for the typical AI mistakes
- Missing null checks around values the model assumed would always exist.
- Overconfident helpers that silently swallow errors.
- Duplicated logic that was copied instead of factored.
- Security paths that look complete but never enforce authorization.
Review the edges, not the happy path
AI tends to get the obvious case right and the messy case wrong. Focus on bad inputs, concurrent updates, partial failures, and backwards compatibility. Those are the places where a confident-looking snippet can still create a production bug.
A better habit
Treat AI code as a draft from a fast junior teammate: useful, often directional, but never exempt from the same checks you would apply to any other change.