Guide

What coding agents still get wrong

Models improved. The failure shape did not disappear. These patterns show up across tools and years. Treat them as review prompts, not as proof that any named vendor is unsafe or safe.

Invented dependencies

An agent will import a helper that “should” exist. Compilation in a sandbox may still succeed if the sandbox is incomplete. Check the lockfile.

Happy-path tests

Agents write tests that encode the implementation they just invented. That is circular. Prefer tests written from the ticket, before the patch.

Authorization as an afterthought

New routes often inherit “if we have a user session, allow.” Object-level checks get dropped. This is why humans still own auth review.

Time and money functions

Interest, tax, FX, and calendar math look easy and are usually wrong at boundaries. Do not let an agent own them without a specialist.