Why We Need to Review AI-Generated Code

Recently, AI has definitely helped people build many products, and some people think they can become developers overnight. At the same time, many companies assume they can use AI to replace most software engineers. But what is the reality behind this situation?

Indeed, AI can implement small requirements very quickly, especially those that don't need to be iterated on or maintained over time. I’d describe AI as a great coder, but not yet a good software engineer. AI cannot design complex systems, nor can it maintain a well-structured project. Even if it generates a well-structured project from scratch, it quickly lets the code rot as complexity grows.

I have summarized some of the mistakes I’ve recently seen in AI-generated code, and I found that AI can make all kinds of unpredictable errors. Here are a few examples that illustrate why code reviews remain indispensable.

Unauthorized Scope Expansion

When I ask AI to edit one feature, it sometimes modifies related features on its own. Sometimes this is the right thing to do, and sometimes it is completely wrong. Here are some instances:

1. 01Our system uses DynamoDB. When I was developing a new feature, I asked AI to add a new attribute and display it on the website. The old data didn't have this new attribute, but AI added the attribute to the old data before displaying it. In other words, it showed fake data.
2. 02I asked AI to add a new attribute to a table. While doing this, AI found a related table and added the same attribute to it as well, even though our business logic didn't require it.
3. 03Sometimes, if I give AI an incorrect instruction, it realizes that the instruction is wrong but doesn't stop and ask me for clarification. Instead, it modifies the logic by itself. For example, our system needs to generate files on disk. When I asked AI to read a file and gave it the wrong directory, AI realized that the directory was incorrect, but instead of asking me, it changed the logic to read the file from both the correct and incorrect directories.
4. 04When I was developing my own website, I finished the homepage but hadn't developed the blog page yet, so the website would show a dialog box saying "Coming Soon." When I asked AI to create the blog page, it removed the dialog and changed the URL to point to the unfinished blog page.

Implementing Logic in the Wrong Way

This is another common problem, and in some cases, it is one of the most serious. Let's look at some examples:

1. 01We use UUIDs as table IDs, and the common approach is to generate the UUID before saving the record. But I once found that AI generated UUIDs before the "Create" dialog was even opened.
2. 02We have a CMS, and I developed a translation feature for articles. We prepare some translation rules in advance, so there is a table for managing these rules. The translation module then selects a rule set using a key. However, AI stored the actual rule values in the translation module instead of storing the key. This created a data consistency problem. When the rules changed, the translation module would not know about the changes.
3. 03We use DynamoDB as our database. I found that AI sometimes used Scan instead of Query to search for data, even when I had already told it that a GSI existed. If I forgot to add a GSI, AI would use Scan directly, which could cause serious performance problems and also increase our DynamoDB costs.

Not Fixing the Root Cause

This is another serious mistake. AI sometimes doesn't fix a bug at its root cause. Instead, it uses a tricky workaround to cover up the problem and make the feature appear to work correctly. However, the root cause can potentially lead to a much more serious problem in the future. In fact, sometimes AI simply cannot diagnose the root cause of a bug.

Missing Logic

When I was developing a CMS for our company, we needed to support both importing articles and translating articles. When I asked AI to add a new attribute, it only handled the attribute in the import logic and forgot to handle it in the translation logic.

All of the mistakes above are difficult to find if you don't review the code because the feature may appear to work correctly. However, these mistakes can lead to bugs in the future. Every engineer knows that the cost of fixing a bug can become very high when it has been running in a production environment for a long time.

Maybe someone would say that I didn't give AI clear enough instructions or provide all the necessary details. That’s partially true. If we want AI to work well, we need to give it instructions as clearly as possible. That's how I use AI now.

In my next blog post, I'd like to summarize how I use AI to really increase efficiency while saving tokens.

But let's go back to the question I raised earlier: if people don't know how to develop a feature well, can they give AI effective and correct instructions and become well-trained software engineers?

At the 2026 ByteDance Volcengine FORCE Conference, a speaker shared an interesting experiment with us. They asked AI to implement a medium-complexity requirement. They chose three famous coding models and three mainstream agent frameworks, resulting in nine different combinations. For each combination, they asked AI to run 100 times using the same prompt.

The result was interesting: every result was runnable, and the feature was basically correct. But when they looked at other factors, such as UI consistency, reliability, maintainability, performance, and compatibility, they found many problems. The experiment produced 900 runs in total, and each run produced different problems.

What enterprises need are long-term, stable, maintainable, and extensible systems. LLMs are probabilistic generative models, so they cannot guarantee that they will consistently produce production-ready code.

Maybe in the future, AI will become better and better. But nowadays, knowing how to use AI to create high-quality code is still important.

Software engineering is an art of balance: considering the goals while controlling complexity, increasing speed while maintaining stability, and improving performance while making trade-offs.

So, using AI correctly and reviewing AI-generated code are still important today.