AI-written code passed tests and review but missed an authz check, leaking user records
Mangwe_Tanser · reddit · 2026-09-11
A developer shares a real incident: an AI-written endpoint shipped a few weeks ago let any logged-in user read other users' records. It passed tests and two-person PR review — the ownership check simply wasn't there, and nobody caught it in the diff.
Key observations from the post:
- Most PRs are now mostly AI-generated with large diffs that humans can't properly review
- Hardcoded keys and SQL injection usually get caught by scanners or careful review
- The missing authz check is the one that slips through, because the code reads completely normal
- A single dev with an agent opens far more code per day than a person can meaningfully review
The author asks the community for practices that actually catch these holes before merge, not policy-doc platitudes.
More from coding & agent
- Shopify ditches React Native, returns to native iOS and Android development because of AI — CtrlAltDwayne · 2026-09-11
- Google's ToolGrad generates tool-use datasets answer-first, hitting near 100% pass rate — DuRuofei · 2026-09-11
- Pydantic AI shows how to build your own coding harness with Codex subagents — samuelcolvin · 2026-09-11
- Google Cloud ships agent starter pack with MCP docs and 100+ on-demand skills — rseroter · 2026-09-11
- The GUI may be the greatest accidental AI API ever created — signulll · 2026-09-11
- MCP drama: early spec contributor now advises against it, Sentry CEO says it already paid for itself — zeeg · 2026-09-11