reviewing-ai-generated-code

name	reviewing-ai-generated-code
description	Security-review discipline for code a language model wrote or completed: the failure patterns that show up more often in generated code and the review method that catches them. Covers hallucinated and confusable dependencies, insecure defaults and missing validation carried from training data, propagated vulnerable patterns, over-broad or fabricated permissions, and plausible-looking code that does not do what it claims. Use when reviewing an AI-authored change, an assistant's suggestion, or a large generated diff. Fluent is not correct.
license	MIT

Reviewing AI-generated code: fluent is not correct

Model-written code reads well, which is exactly the risk: it is optimized for plausibility, and a reviewer's guard drops when the code is clean and confident. The security failures cluster in predictable places, dependencies that may not exist or may be attacker-registered, defaults copied from insecure examples, validation quietly omitted, and logic that looks right but is not. Reviewing it means aiming at those clusters, not skimming for style.

When to use

• You are reviewing an AI-authored change, an assistant's suggestion, or a large generated diff.
• Generated infrastructure, config, or access-control code is entering the codebase.
• You are setting a review bar for machine-assisted contributions.

Scope check

Review code for projects you own or contribute to with authorization. If you can't name the authorization, stop.

The loop

1. Verify every dependency the code introduces. For each package the change adds, confirm it exists, is the established package (not a lookalike or a name the model may have invented), and is the one you intend. A hallucinated package name an attacker later registers turns "the model suggested it" into installed attacker code. Do not let a plausible import in unverified.