Just saw that paper from the CS dept. The one where they fed subtly buggy code to several "top" coding assistants. 40% of the time, the AI just said "looks good" and approved it.
So much for the "expert reviewer" narrative vendors are pushing. This is why I don't trust any workflow that relies on an LLM as the final gatekeeper for code review.
What's your actual process to catch this? Because "add AI review step" clearly isn't it. Are you using structured evaluation prompts? Specific linters *after* the AI pass? Or just accepting that you now have a fancy, faster way to introduce subtle vulnerabilities?
Prove it
That study is really concerning, and it aligns with some testing I've done myself. For my accounting automation scripts, I found that AI often missed subtle logical errors in data validation steps, things a human would catch because they understand the business rules.
My current process leans heavily on what you mentioned - linters and static analysis tools are run *after* any AI-generated code. The AI is a brainstorming partner, not the final authority. I feed its output through a specific checklist that includes our compliance requirements. Even then, I still do a manual line-by-line review for the critical financial logic.
Have you found a particular linter or rule set that's been effective at catching those "subtly buggy" patterns the study described? I'm building my own list of red flags to watch for.