The scariest pull request from an AI coding tool is not the one riddled with bugs. It is the one that compiles, passes every test, and reads like it was written by a careful engineer, because that fluency hides a quiet mismatch between the question you meant and the question the model answered.
The Details:
A model works from your words plus a statistical sense of what code usually looks like for a request shaped like yours. Most of the time those two things line up, but when they diverge you get no error, no crash, just a clean answer to a slightly different problem than the one in your head.
Take a request like "show orders from yesterday." The model picks server local time, ships clean code, and passes review. Weeks later a report is quietly missing orders between midnight and 3 AM because the database stores UTC and users span timezones. The bug was never the code; it was an unflagged choice buried inside an ambiguous word.
The same pattern hides in retry logic against a non-idempotent endpoint, in a cache key that is unique until the day it is not, and in validation that checks whether input is well-formed but never whether the caller had permission to send it. Ordinary code review cannot catch any of this because review checks the implementation against the request, not whether the request itself was the right one to make.
The fix sits before the first line of code. Ask the model to restate the problem and list its assumptions about data shape, timezone, and failure behavior. Circle every word in your spec with more than one reasonable meaning, like "active" or "complete," and force an explicit choice. That costs a paragraph instead of a two week debugging arc.
Bottom Line: Treat AI output as a hypothesis to interrogate, not an answer to accept, because the danger was never broken code; it was code that never told you a choice had been made.
Enjoy this article?
Listen to the Claude Code Conversations radio show or join the community.
