Are developers trusting AI-generated code too much? | Hacker News Reader

Are developers trusting AI-generated code too much?

4 pointsskypark04073 comments

I've been experimenting a lot with AI coding tools (Cursor, Claude, etc.), and one thing stood out:

Most developers don't really review AI-generated code.

In many cases, it "looks fine" at first glance, but contains issues like: - Hardcoded secrets (API keys, tokens) - Unsafe patterns (eval/exec, insecure deserialization) - Prompt injection hidden in comments or instructions

So I built something to test this idea.

It's a lightweight proxy that sits between the IDE and the LLM, and analyzes output in real-time before it reaches the developer.

The goal isn't to replace code review, but to catch risky patterns at the moment they're generated.

Curious if others are seeing the same issue with AI-assisted development.

(If anyone’s curious, I put together a VS Code extension for this)

Interesting. I don't know if people are trusting AI-generated code too much, but AI is generating way more code than humans can review, and the 'looks fine' bar is what the AI gets held to.

I strongly agree with you that the solution likely involves pushing the correction mechanism much closer to the point of code generation. You want to put the AI back on track as soon as it starts to stray, you can't let it build a lot on top of a mistake.

My own attempt at resolving this involves running a set of deterministic checks on agent-generated code at the end of every agent turn, along with a lightweight AI-powered review on every commit, and deep AI review on PRs before merge. I am pretty happy with the results so far.

Two things here:

1)Non technical people will definitely trust AI too much, specially with the overhype of agents.

2) Don't blindly accept what it generates. If it would take you 15 minutes to write some code, it will take you 2 or 3 minutes to read the same ai generated code. You can then decline, accept or accept and modify yourself.

One thing I’ve noticed is that most of these issues don’t look obviously wrong.

The code “looks fine”, compiles, even passes basic tests.

That’s what makes this tricky — the risk is subtle, not obvious.

Reply on news.ycombinator.com