Blog

What AI gets wrong

Deep dives into the bugs AI assistants introduce and how to catch them before they reach production.

Why AI Generates Insecure Random Tokens

Every AI assistant we tested uses random.randint() or Math.random() for security tokens. Here's why that's dangerous and what SEC004 catches.

Your code works in dev, passes tests, then produces different results in production. DET001 catches the nondeterministic iteration that causes it.

Calling an async function without await doesn't throw an error — it silently returns a Promise that nobody checks. ASYNC001 finds every instance.

def process(items=[]): looks innocent. It shares state between calls. AI assistants write this pattern constantly — QUAL004 catches it every time.

We found f-string SQL queries in 40% of AI-generated database code. SEC002 catches string concatenation in SQL before it reaches production.

AI writes browser code that crashes on the server. FRONT002 finds every window, document, and localStorage access that needs an SSR guard.

if file_exists then write_file looks safe. It isn't. CONC001 catches time-of-check-to-time-of-use bugs across Python and JavaScript.

TypeScript's non-null assertion on environment variables compiles fine and crashes at runtime. TYPE009 catches this before deployment.