Reviewing Code an AI Agent Wrote

An agent's pull request usually looks tidy and confident, with a summary saying everything is done. That is exactly why it needs a careful review. These are the checks we run on every agent change.

1. Start with the tests

Is there a test for each behaviour the issue asked for, and would it fail without the change?
Were any existing tests changed, weakened or deleted? If so, is the reason stated and right?
Does an assertion actually check something? Agents sometimes write tests that always pass.
Did the tests really run? Read the CI output, not the summary.

2. Check the scope

Does the change do what the issue asked, all of it, and nothing more?
Are unrelated "improvements" mixed in? Ask for them separately.
Is anything marked done in the description that isn't in the diff?

3. Look for quiet shortcuts

Errors swallowed, checks skipped, or a hook or test disabled to get a green build
Hard-coded values where configuration belongs
New dependencies nobody asked for
Copies of existing code instead of reuse
Comments that describe what the code should do rather than what it does

4. Security and data

No secrets, tokens or personal data in code, logs or test fixtures
Input from outside validated at the boundary
Anything that changes what is stored, logged or shared reflected in your privacy notes

5. Fit with your codebase

Names use your domain's terms, not near-synonyms the agent made up
The change follows your existing patterns and structure
Generated files such as database migrations were produced by your tools, not written by hand

Then improve the system

When a review finds a problem, fix the pull request, then ask why the agent made the mistake. Usually the answer is a missing instruction, a missing test or a missing automated check. Add it, and the next change starts from a better place.