A practical checklist for reviewing AI-generated code

The failure modes are different

Human-written bugs tend to cluster around edge cases the author did not think of. AI-generated bugs cluster around things that look right but drift from the codebase's actual conventions.

The checklist

1. Does it match existing patterns? Same error handling, same naming, same layering.
2. Does it invent APIs? Grep every unfamiliar function name.
3. Are the tests real? Confirm they would fail without the change.
4. Does it handle the null path? Agents love the happy path.
5. Is the diff minimal? Extra "improvements" often aren't.

Run this list every time. It is boring and it works.