Reading and reviewing AI code

How to review code you did not type: read every diff, run a checklist, explain it back, catch invented APIs and scope creep, and use AI review as a second pass, never the only one.

Read every diff

Also called diff, review changes, accept all

What: Looking at exactly what changed, file by file and line by line, before you accept, commit or push it.
Why: The diff is the only honest record of what the tool did. Summaries can say "fixed the bug" when the change also deleted a check.

Code

/diff              # review the working tree
git diff --stat    # which files changed
git diff           # every line

Watch out

Accepting all changes because the summary sounded right, without opening a single file.

Review checklist for AI code

What: A short, fixed list you run on every AI change, so review does not depend on how tired you are.
Why: AI mistakes repeat: invented names, unrequested changes, missing error handling, weak tests. A checklist catches the repeat offenders.

Code

[ ] Does it do what I asked, and nothing else?
[ ] Every function, flag and package exists? (docs)
[ ] Errors, empty input, nulls and limits handled?
[ ] No secrets, no disabled checks, no new eval/exec
[ ] Tests test behaviour and would fail if it broke
[ ] Tests or asserts deleted or loosened? Why?
[ ] New dependency? Real, maintained, needed?
[ ] Could I explain every line to a reviewer?

Explain it back

Also called own the code, comprehension check

What: Before you commit, explaining in your own words what the change does and why it works, without reading the tool's summary.
Why: You are responsible for code you merge. If you cannot explain a line, you cannot debug it at 2 a.m. or defend it in review.

Watch out

Asking the tool to explain its own code and taking the explanation as proof: it can explain wrong code confidently too.

Checking invented APIs

Also called hallucinated API, phantom method

What: Verifying that every function, method, option and configuration key in the change exists in the version you actually use.
Why: Invented or outdated APIs are the most common AI error. Type checkers, the language server and official docs catch them in seconds.
Example: Hover over each unfamiliar call in the editor. No definition found, or a deprecation warning, means open the docs before you accept it.

Watch out

Assuming it works because it looks like the library's style.

Unrequested changes

Also called scope creep, drive-by refactor, over-engineering

What: Edits you did not ask for: renamed variables, reformatted files, new abstractions, extra features, deleted comments or tests, and code that is never called.
Why: They make the diff harder to review, cause merge conflicts and sneak in behaviour changes. Smaller, focused diffs are safer.

Watch out

Leaving a helper the tool added "for later" that nothing uses, which a reader then has to understand.

Commit before each AI task

Also called checkpoint commit, atomic commit

What: Committing your working state before asking the tool for a change, then committing its reviewed change on its own with a clear message.
Why: A clean starting point makes every AI change easy to inspect with git diff and easy to throw away with one command.

Shell

git switch -c feat/rate-limit
git add -A && git commit -m "wip: before AI task"
# ...AI makes the change, you review it...
git add -p          # stage only what you reviewed
git commit -m "feat: rate limit login attempts"
git restore .       # or throw the rest away

AI review as a second pass

Also called AI code review, Bugbot, Copilot code review, /review

What: Asking a separate AI review, ideally in a fresh context, to look for bugs and security issues in a diff after you have reviewed it yourself.
Why: A fresh reviewer is not attached to the code it just wrote and often spots edge cases. It adds to human review; it does not replace it.

Code

/review            # review the current diff for bugs
/review 1234       # or a pull request number
/security-review   # security review of the branch

Watch out

Chasing every AI review comment: it will always find something. Fix what affects correctness and skip the rest.

Go deeper