Review, test, verify

Treat AI-written work like a new colleague’s first pull request: test it, have it reviewed with fresh eyes, check what it depends on, and approve it yourself.

1. Test it. In a study run in 2021, GitHub Copilot completed 89 security-relevant coding scenarios, producing 1,689 programs; about 40 percent were found vulnerable.¹ Tests and security checks catch what reads fine.
2. Review with fresh eyes. Ask for a review in a new session, or from a different model. In one study, language models judging summaries favored summaries they had written themselves.²
3. Check what it depends on. Code-writing models also recommend software packages that don’t exist: across 16 models and 576,000 code samples, at least 5.2 percent of packages recommended by commercial models and 21.7 percent by open-source models were made up.³ Look each new dependency up before you install it.
4. Don’t let it obey what it reads. Web pages and files can carry hidden instructions (Chapter 10).⁴ Keep an agent’s permissions narrow, and review before it acts.
5. Check its sources the way Chapter 14 describes: open them.

For how much the parts around a model matter, see the case study in Appendix B.