AI-generated code is often good. Frequently very good. The problem is that its failure modes are systematic — the same types of errors appear across models, across prompts, across codebases. Once you know the pattern, you can review for it. Before you know the pattern, you will miss it.
Failure mode 1: the happy path is complete, the error path is not
AI writes the success case beautifully. When the API call succeeds, when the user input is valid, when the database returns a result — all of that is handled. What happens when the third-party service returns a 503? When the database connection pool is exhausted? When the file upload exceeds the size limit? Often: an unhandled exception, a generic 500 error, or silent failure.
Failure mode 2: security assumptions that look correct
AI tends to implement auth patterns that are structurally correct but miss context-specific edge cases. A route that correctly validates a JWT token but fails to check whether the user in the token is authorised to access the specific resource being requested. An upload endpoint that checks file type by extension rather than MIME type. A query that is parameterised but logs the full query string to an accessible log file.
Failure mode 3: performance assumptions that do not hold at scale
Code that works for a single user frequently does not work for a thousand. AI generates N+1 queries — fetching a list and then querying for each item individually. It generates unindexed queries on columns that will be filtered frequently. It generates in-memory operations on datasets that will eventually not fit in memory.
What good review looks like
Human review of AI code is not line-by-line reading. It is structured examination of the categories most likely to fail. We run a checklist: error handling completeness, authentication and authorisation correctness, query performance, input validation, secret handling, and log hygiene. This takes less time than writing the code from scratch and catches the systematic failures reliably.
The goal is not to distrust AI code. The goal is to know exactly which questions to ask about it.