7 things AI-generated code almost always gets wrong

AI-generated code most often gets permissions, secrets, input validation, database performance, error handling, code consistency and deployment wrong. It works in a demo but fails with real users and data, which is why an experienced developer should review it before production.

The list below comes from our daily work. AI assistants write most of our routine code, and these are the places where we correct their output most often.

Why these mistakes in particular

They have one thing in common: you cannot see them in a demo. The AI gets a task, writes the code and checks that the scenario from the prompt works. It does not ask what a different user will do, what happens with a hundred times the data, or how the app gets deployed a second time. Those questions come from someone who has already seen how systems break in production.

1. Permissions: who may see what

AI reliably writes a login. It is far less reliable at checking whether the logged-in user may see a specific record. A typical bug: an invoice is loaded by the number in the URL, and changing it shows you another customer's invoice. Another: the "Delete" button is hidden from regular users, but the server carries out the request for anyone.

How to check: for every endpoint, ask where the server verifies that the record belongs to this user.

2. Secrets in the wrong place

Payment gateway API keys, database passwords and email credentials end up in the code, in the repository or, worst of all, in the frontend, where anyone can read them in the browser. AI does this because it "works" in the demo.

How to check: keys belong in environment variables on the server. If they were ever in git, rotate them; deleting them is not enough.

3. Input validation and edge cases

AI writes code for the happy path. An empty field, a negative quantity, accented characters in a name, a date past midnight or a daylight saving change, a double click on "Order". You see none of it in a demo; all of it happens in production.

• Does the server validate input, or only the form in the browser?
• What happens to a missing value: is it replaced with zero or kept as "not filled in"?
• Does a double click create two orders?

4. Database and performance

The most common performance problem in AI code: it loads thousands of rows from the database and filters, sums or sorts them in the application. Or, for a list of a hundred orders, it runs a hundred more queries for the customer. With ten test records everything is fast; with real data the page times out. Add missing indexes and no constraints in the database.

How to check: filtering, joining and summing belong to the database, in the query. The application should receive exactly what it needs.

5. Errors that disappear

AI likes to wrap code in an exception handler that silently swallows the error. A payment fails, an order is not saved, nobody finds out, and the app acts as if everything is fine. Just as often there is no logging or alert when an external API, such as a carrier, stops responding.

How to check: for every caught error, ask who will find out about it and what happens to the data.

6. Inconsistent code and invented libraries

Every prompt is a little different, and so is the code. The same thing is done three ways in one app, functions are copied instead of shared, and every fix has to be made in three places. AI sometimes uses an outdated library version or invents a function or package that does not exist. The latter is also a security risk, because attackers register such package names.

How to check: look for duplication during review and verify every new dependency.

7. Deployment and operations

Code that runs on your laptop is not yet an app in production. AI usually leaves out database migrations, backups, a separate test environment, HTTPS, logs and monitoring. The first production update then deletes data or takes the site down for an afternoon.

How to check: can you deploy the app with one command, roll back to the previous version and restore the database from a backup? If not, it is not ready. We can help with hosting and DevOps.

Quick checklist

Area	Review question
Permissions	Does the server verify ownership of every record?
Secrets	Is anything secret in the code, git or frontend?
Input	What happens with an empty, invalid or duplicate value?
Database	Does the query filter and sum, or the application?
Errors	Will anyone find out about a failure?
Consistency	Is each thing done in one place?
Deployment	Are there backups, rollback and monitoring?

How we catch these mistakes

Because AI makes these mistakes regularly, we have derived a few simple rules that we follow on every change:

• Small steps. The AI gets one bounded task, not "build the whole module". A small diff can be reviewed properly.
• Project context. The AI gets the project's rules and conventions so it does not write every file its own way.
• Review of every change. A senior reads the whole diff, not just the result on screen, and goes through exactly the points on this list.
• Tests and checks on realistic data. We try queries on production-sized volumes, not on ten records.
• Deployment with a way back. Every version can be rolled back and the database restored.

Does this mean AI code is bad?

No. We code with AI assistants every day ourselves, and thanks to them we deliver an order of magnitude faster. The difference is that a senior who knows these mistakes and looks for them reviews every change. AI writes, the senior is accountable. We describe how we work under Software development with AI.

If you already have an AI-built app, see also Vibe coding: you built an app with AI, what next? and our AI code to production service.

Want a senior to look at your code before you let customers in? Write to us and we will arrange an audit; you can also start with a one-hour consultation.