Bugs in AI-Generated Code: Ten Common Ones and How to Spot Them

Bugs in AI-generated code repeat from project to project. Models learned from a huge number of examples, and examples more often show how to make something work than how to keep it from breaking. So the bugs are predictable, which is good news: you can hunt for them with a checklist.

Here are the ten most common. For each one: what it looks like and how to spot it, even if you don’t read code every day.

1. Hard-coded secrets

A payment, database or model API key is written as a string in a file, sometimes in the part that ships to the browser.

How to spot it: search the project for sk_, secret, api_key, password, service_role. Anything found outside your environment variables file is a problem. If the file ever went to GitHub, rotate the key; deleting it isn’t enough.

2. Missing auth checks on the server

The interface only shows your own records, but the server returns any record by ID. The “whose is this” check lives in the button, not in the request.

How to spot it: create two accounts, take the ID of a record from the first and request it while logged in as the second. Try reading, editing and deleting it.

3. No error handling

The code assumes the external service will respond, the database is up and the file exists. When that’s not true, the user gets a blank screen or an endless spinner.

How to spot it: cut the network mid-action, enter an address that doesn’t exist, exhaust the limit on a test key. See what the person sees and what ends up in the log.

4. Race conditions

Two requests arrive at once and both pass the check: a promo code applied twice, the last item sold to two people, a balance gone negative.

How to spot it: hit the pay or apply-code button several times very fast, or send two identical requests in parallel. If the result doubled, you need a lock or a unique constraint in the database.

5. N+1 queries

A list page makes one query for the list and then one more per row, for the author, the price, the image. Invisible with ten records; with a thousand, the page takes seconds to load.

How to spot it: turn on database query logging and open the list. If the number of queries grows with the number of rows, that’s the one.

6. Dates and time zones

Times are stored without a time zone, compared in the server’s zone and displayed in the browser’s. A 10:00 booking turns into 13:00, and an “ends today” discount ends at lunchtime.

How to spot it: change your computer’s time zone and look at the same data. Test the edge cases: midnight, the last day of the month, daylight saving changes where they apply.

7. Unvalidated input

The server trusts whatever the browser sends: price, role, quantity, owner ID. The form won’t let you enter a negative number, but the API accepts one.

How to spot it: send a request that bypasses the form, with negative numbers, huge strings, extra fields like role: admin, or someone else’s user_id.

8. Silent failures

An error is caught and then nothing is done with it. The email didn’t send, the payment wasn’t recorded, the file wasn’t saved, and the user sees “Done.”

How to spot it: search the code for empty error handlers, a catch with no body or one that only logs to the console. Each one is a place where you’ll hear about the problem from a customer.

try { await sendEmail(user) } catch (e) {}

9. Duplicated logic

Every time you ask for a new feature, the AI writes it from scratch instead of reusing what exists. Price calculation ends up in three places, and after a discount change the cart and the receipt show different totals.

How to spot it: change one rule, say tax or phone number format, and check every screen where it appears. If one still shows the old behaviour, look for a copy.

10. Outdated APIs

The model knows a library as it was when the model was trained. Removed functions, old configuration styles and patterns the library’s authors stopped recommending long ago end up in your code.

How to spot it: deprecation warnings in the console during build and run, errors after updating dependencies, code that doesn’t match the current documentation.

In short

• Bugs in AI-generated code are predictable, which makes a checklist an effective way to find them.
• The most dangerous are hard-coded secrets, missing auth checks and trusting input from the browser.
• Race conditions, N+1 queries and time zones don’t show in a demo and appear with real users.
• Silent failures and empty catch blocks hide problems until a customer reports them.
• Most checks on this list take minutes and don’t require reading the code in depth.

If you’d like to run this checklist on your project with engineers alongside, SUBXCAT can help.