AI Coding Assistants Shift the Bottleneck to Verification, Engineer Argues

AI coding assistants have moved from novelty to default tooling across much of the software industry, and the productivity numbers have followed. But the same tools are quietly reintroducing well-worn bug classes and security holes at a rate that teams are only starting to measure. In a new article for InfoQ, engineer Nitin Garg argues the constraint on AI-assisted development has shifted from generating code to verifying it.

That framing matters because most tooling investment still flows toward generation. Vendors compete on how fast a model can scaffold a service, write tests, or refactor a module, and teams judge assistants by how much boilerplate they remove. Garg's point is that this gains are real but front-loaded: the moment AI-written code lands in a repository, someone still has to confirm it matches the specification the team actually agreed on, not the one the model inferred from context.

The failure mode he describes is divergence between behavior and intent. A model can produce code that compiles, passes existing tests, and looks idiomatic while quietly changing edge-case handling, error propagation, or input validation. Those gaps tend to look like classic bugs rather than exotic AI failures, which makes them easy to wave through review when reviewers assume the assistant handled the obvious cases.

Security is where the cost shows up fastest. AI-generated code has been linked to recurring weaknesses such as missing authorization checks, unsafe deserialization, and hardcoded credentials, patterns that security teams already know how to catch in human-written code but that slip past review when volume rises. Garg's prescription leans on spec-driven development: pin down the intended behavior before generation starts, then treat the spec as the artifact the code is tested against, rather than trusting the model's reading of a prompt.

That approach changes what a pull request review is for. Instead of line-by-line style checks, reviewers compare observable behavior against a written contract, which is slower per change but catches the divergences that matter. It also puts pressure on teams to keep specifications current, a discipline many organizations have let decay as documentation moved into wikis nobody reads.

The open question is whether tooling will absorb this work. Several vendors are already shipping AI reviewers and test generators aimed at verification, but none has demonstrated that automated checking can reliably catch intent mismatches in complex systems. Until that changes, the human review step remains the bottleneck, and the productivity gains from AI code generation will keep being partly spent on cleaning up after it.