AI coding assistants have changed how we work. Boilerplate that used to take an afternoon now takes minutes. Tests, migrations, small refactors — all faster. We use these tools every day, and we wouldn't want to go back.

But they've also changed where the risk sits. Writing code is no longer the slow part. Understanding and reviewing it is.

Plausible isn't the same as correct

AI-generated code tends to look right. It's well formatted, nicely named and confidently commented. That's exactly what makes its mistakes easy to miss. The patterns we watch for:

  • Off-by-one and edge cases — the happy path works; empty lists, time zones and null values don't.
  • Outdated APIs — code written for a library version you're not using.
  • Invented packages or functions that don't exist. Attackers have started registering package names that assistants commonly hallucinate, so "just install it" can be dangerous.
  • Security shortcuts — disabled certificate checks, SQL built with string concatenation, overly broad permissions — added because they make the example work.

How we keep the bar high

The person who submits it owns it. If you open a pull request, you must be able to explain every line, whoever or whatever typed it. "The AI wrote that bit" is not an answer in review.

Smaller changes. Because AI makes it easy to generate a lot of code, it's tempting to open huge pull requests. We push the other way: small, focused changes that a reviewer can genuinely understand in one sitting.

Tests first, or at least tests too. Ask the assistant for tests, but read them critically — a test that asserts the wrong behaviour is worse than no test. Make sure there's at least one test you wrote by thinking about what should happen.

Let tools do the boring checks. Linters, static analysis, type checkers and dependency audits catch a whole class of AI mistakes automatically, leaving human reviewers free to focus on logic and design.

Never paste secrets. Keep API keys, customer data and credentials out of prompts. Check your tool's data-handling settings, and make sure the team knows the rules.

Where AI shines for us

  • Explaining unfamiliar legacy code — especially old PHP or undocumented scripts.
  • Writing the first draft of tests and documentation.
  • Mechanical refactors across many files, reviewed carefully afterwards.
  • Talking through an approach before writing any code at all.

The bottom line

AI makes good engineers faster. It doesn't make review optional — it makes review the most important part of the process. Teams that treat AI output as a draft from a very fast, occasionally overconfident colleague get the benefits without the surprises.