Post

AI made junior code look like senior code. Here's what that means for code review in 2026. 🧵

Veracode 2026: AI-generated code introduces security vulnerabilities in 45% of cases. In Java: 72% of AI-generated code has at least one known vulnerability (CWE). This isn't anti-AI. It's a "the bar just moved" argument.

The 3 questions I ask on every AI-assisted PR: Question 1: What is this code optimizing for? AI optimizes for "solves the stated problem" and "compiles." Not your SLAs, your error-handling conventions, your threat model. If the author can't answer → the review shouldn't proceed.

Question 2: What happens when this fails? AI excels at happy-path code. Look specifically at: - What exceptions are caught and swallowed? - What happens if the external call is slow? - Is the failure mode recoverable or catastrophic?

Question 3: Would a junior on this team maintain this in 18 months? AI-generated code can be locally clever and globally incomprehensible. If the implementation requires patterns not in your team's vocabulary → code smell, even if it technically works.