Unpopular opinion: you should never let AI write test files unsupervised

I keep seeing these glowing threads about how an AI assistant "wrote all our unit tests" and "increased coverage to 95%." The collective enthusiasm is enough to make me check if I've accidentally joined a vendor's marketing channel.

Let's be clear: an AI can generate test *code*, but it cannot generate test *intent*. It's a syntax engine, not a security auditor or a domain expert. Handing it your codebase and telling it to "write tests" is a fantastic way to:

- Create a massive, passing test suite that validates the happy path and little else.
- Miss edge cases that a human attacker (or a grumpy user) would find in seconds.
- Generate tests with flawed assumptions, copying the very logical errors present in the implementation.
- Inflate your coverage metrics, giving you a false sense of security right before a breach.

I've seen the output. You get tests that assert `add(2, 2) == 4` but never check what happens when you pass `null`, a string, or a negative integer to a function that only works with positive ints. For anything involving auth (SSO flows, RBAC checks), the generated tests are often dangerously naive.

If you're going to use AI for this, treat it like an intern with a talent for boilerplate. You must provide the adversarial thinking. For example:

* **Define the attack surface first.** Before generating a single test, list the unexpected inputs, permission bypass scenarios, and failure modes.
* **Use it to fill the boring gaps.** "Write a test for each of these ten invalid input types for this function signature."
* **Never trust its security logic.** It will happily write a test that passes a JWT without validating the signature, or assumes a user is admin because a flag exists in the request.

The real recipe is using the AI as a force multiplier for *your* test strategy, not as a substitute for one. Otherwise, you're just automating the creation of a compliance checkbox that's hollow at its core.