Do we still need to review AI-generated code?

In my day-to-day work, code review still requires human approval to be merged. But more and more frequently, the author doesn’t even review the code anymore and reviewers rely more on the AI code review comments. AI will provide the verdict to Approve or just leave blocking comments. I also see people don’t even review the comments provided by AI and just post them, all of that information flooded to the author is hard to process and likely the author will just use AI to handle all those comments.

I am also working on a side project after work. It is still in the early phase of the development, and I am not reviewing any code generated by AI. The major reason is AI is writing code way faster than people can review, so humans will be the bottleneck for delivering the feature. But it is not no review: I use an adversarial AI agent to run code review against the change, and it will usually generate some feedback and AI will address those first with the feedback loop. I will just merge the AI code and rely on the next version of the app with new code to verify the behavior.

So back to the title, do we still need to review AI-generated code? I think it still depends. In the early phase of the feature development, or if you have limited users and you can accept the risk of AI taking down your service and hurting the existing experience and prefer faster iteration, yes, you don’t need to review the code anymore, that is slowing you down. Instead, create some feedback loop and set certain guardrails, like code still builds (compiler), linting still passes (linter), integration tests about the behavior. Rely on those to keep AI on track instead of reviewing each line of code.

But the story changes once you have more and more users and handle critical data. The stories about AI bringing down the whole service and deleting the DB are still happening. In those cases, how can you trust the AI will not accidentally pass the test by just deleting them? Humans should still be the gate for those cases if you want more reliable code. Though such things also happened before AI came, fully human-written code will also cause such issues. The thing about developing is that writing bugs doesn’t change, it is just how we hold people, or AI, accountable.

Also for open source projects, do you trust any random person’s code generated by AI, to merge it into your code base and have it lose your control? Most people don’t want that. AI is not that welcome in open source; it is still about building your reputation in the open source community, people will trust the people.