Skip to main content

​
AI Code Review

The practice of reviewing AI-generated code — and using AI agents to assist in that review. Requires a different lens than reviewing human code: mechanical correctness is often high, but intent alignment and AI-specific failure modes require explicit attention.

​
Review pipeline

Automated layer (agent or CI):
  • Static analysis, linters, security scanners (CodeQL equivalent)
  • Automated agent review against context/standards document
  • Dependency checks (license, maintenance, existence)
  • Test execution
Human layer:
  • Intent verification: does this solve the right problem?
  • Architecture fit: does this match existing patterns?
  • AI-specific pitfall scan: see AI-Specific Code Pitfalls
  • Domain logic correctness

​
8-point human checklist

  1. Tests pass, static analysis clean
  2. Code solves the stated problem (not just compiles)
  3. Fits project architecture and conventions
  4. Readable, maintainable, clear naming
  5. Dependencies exist, are maintained, licenses compatible
  6. No AI-specific pitfalls (hallucinated APIs, deleted tests, missed edge cases)
  7. Security: data flows traced, injection/auth reviewed
  8. Complex/sensitive changes get a second human reviewer

​
Automated review with context instructions

Agent-based automated review quality is gated by Agent Context Instructions quality. With good context: agent catches style violations, missing error handling, security patterns, performance issues — freeing human review for design and correctness. Example: SHA-256 flagged as insecure for password hashing (too fast → brute-force vulnerable); agent suggests argon2 (slow, built-in salt). Human reviews and applies.

​
Static analysis thresholds

Before human review: Code Health >9.5 (SonarQube or equivalent). Demand unit test coverage ≥99% for new code; reject if tests are deleted or mocked to hide issues. Label AI-generated code explicitly in PR metadata.

​
Self-reviewing agent

Build a pre-human-review agent: runs automatically on PR open, checks against team standards (accuracy, tone, business logic), surfaces issues before human review begins. Frees human reviewers from surface-level catches.

​
Claude Code /security-review

Built-in command — runs in-project, no custom agent needed. Analyzes for SQL injection, XSS, auth/authorization flaws, insecure data handling, dependency vulnerabilities. Can implement fixes inline after finding issues. GitHub Actions integration: anthropics/claude-code-security-review automatically reviews every PR on open. Posts inline PR comments with findings and recommended fixes. Configurable filtering rules to reduce false positives and per-vulnerability-type sensitivity. Recommendation: wire /security-review into project hook template (pre-commit on significant changes). Use security-auditor subagent (Opus tier) for pre-deploy audits or when code-reviewer escalates.

​
Continuous improvement

Document successful prompts and effective context patterns. Update onboarding guides. Feed recurring review findings into the slop register (see AI-Specific Code Pitfalls).

​
The core risk

AI code can be syntactically correct, pass tests, and match style — while being wrong because it made incorrect assumptions about business logic or user intent. Human review must explicitly validate intent, not just correctness.