How to review AI-generated code before you ship it
The agent wrote it in a minute and it runs. That doesn't make it correct.
AI code fails in its own ways, so review for those. Read every line, and never merge code you can't explain. Test the cases your prompt didn't mention. Have a person look at anything users see.
LLM mistakes look like senior code: clean names, confident comments, tidy structure around a wrong assumption. A readability check passes it every time.
Red flags
▲Made-up APIs and packages›
Functions and config keys that sound right and don't exist. Worse, a package name the model invented for your
npm install, which a squatter may have registered.
Check: look up unfamiliar functions in the docs, and every dependency on its registry before installing.▲Hidden assumptions about your data›
Non-null fields, sorted input, one currency, UTC, arrays never empty.
Check: run it on empty, huge, null, duplicate and out-of-order input.
▲Missing security›
SQL built from strings, unescaped user input in HTML, secrets in code or logs, auth assumed upstream, open CORS.
Check: trace user input to the database, the DOM and the shell. Is it parameterized or escaped?
▲Tests that check nothing›
Only the happy path, the logic mocked away, or
toBeDefined().
Check: name the bug each test would catch. If you can't, it's decoration.▲Scope creep›
You asked for one function and got three files refactored, a library swapped or a new dependency.
Check: read the whole diff. Reject anything you didn't ask for.
▲Old or generic patterns›
Deprecated APIs, old idioms, or the training-data average in place of your repo's conventions.
Check: does it match the rest of your code?
What code review misses
Code review can't tell you whether the page is clear. For anything users see, have a couple of people pin what confuses them on the rendered page. If an agent built it, it can share the page through an MCP tool and fix what they flag. That's twocents.