Get featured

How to review AI-written code before you keep it

Guide · checked against the docs on

AI coding agents can write a lot of code fast, and some of it will be wrong. Cursor's docs put it plainly: "AI-generated code can look correct but be subtly wrong. It might follow existing patterns, compile, and pass tests you wrote, but still miss edge cases, have security issues, or duplicate logic that exists somewhere else in your codebase." GitHub says the same about Copilot: "you should always validate the code it suggests."

This guide is a beginner checklist for reviewing an agent's changes, using Git and each tool's own review and undo features. It's quoted from Anthropic, OpenAI, Cursor, GitHub, VS Code, Git and OWASP docs, checked Oct 2026.

Not affiliated with or endorsed by Anthropic, OpenAI, Anysphere, GitHub, Microsoft or OWASP. Check their current docs before relying on these details.

Cursor also says: "Your standards for what gets merged should be the same whether the code was written by hand or by an agent."

Step 1: Commit before the agent starts

Git is your real safety net. OpenAI's Codex docs say "Create Git checkpoints before and after a task so you can revert changes," and "Commit frequently so you can roll back in small increments."

Before you ask for a change, save your current work:

git add -A
git commit -m "Before AI change"

git commit will "Create a new commit containing the current contents of the index and the given log message describing the changes."

Step 2: Look at every changed file

When the agent finishes, check what it touched:

git status
git diff

git status shows files that changed and "paths in the working tree that are not tracked by Git", meaning new files. git diff shows the "Changes in the working tree not yet staged for the next commit."

Read the whole list, not just the file you asked about. OWASP warns: "Agents routinely touch files beyond the scope of the requested change: lockfiles, CI configurations, unrelated tests, formatting changes, and dependency updates. Reviewers anchored on the requested change miss these modifications."

VS Code adds that "Agents can change files through editing tools, terminal commands, scripts, and MCP tools," so check "changes that might not appear in a tool-specific list of edits."

Step 3: Watch for these warning signs

From OWASP's AI cheat sheet, look extra hard at:

GitHub also suggests you "Consider not just the functionality and security of the suggested code, but also the readability and maintainability of the code moving forward."

Step 4: Run the checks yourself

GitHub says "Use automated tests and tooling to check Copilot's work." Anthropic suggests you "Give Claude a check it can run: tests, a build, a screenshot to compare."

But don't rely only on tests the agent wrote. OWASP notes "A passing test suite generated by the same agent that produced the code provides no independent assurance."

Step 5: Check for secrets

Make sure the change didn't add a password, API key or token to your code. If your code is on GitHub, two of its features help. "Secret scanning scans your entire Git history on all branches of your repository for hardcoded credentials," and for public repositories it "runs automatically for free." Push protection "blocks pushes that contain secrets before they reach your repository."

For more, see our guide on keeping secrets safe with AI coding tools.

Step 6: Use your tool's own review and undo

Each tool has its own features, and each one has limits.

Claude Code: "Run /rewind, or press Esc twice when the prompt input is empty, to open the rewind menu." You can restore code, the conversation, or both. But "Checkpointing does not track files modified by Bash commands," and Anthropic says to "continue using version control, such as Git" for real history.

Codex CLI: run /review to "review any changes and find issues". OpenAI's docs don't describe a built-in undo, so use Git checkpoints. The docs say to "Treat Codex suggestions like any other PR: run targeted verification, review diffs, and document decisions in commit messages."

Cursor: "After the agent finishes a task, click Review then Find Issues to run a dedicated code review." To go back, "click any checkpoint in the chat timeline to preview your files at that point, then restore to revert all files to that state." Cursor says "Checkpoints are stored locally and separate from Git," so use Git too. For bigger tasks, Plan Mode "generates a reviewable plan you can edit before building."

GitHub Copilot in VS Code: "Inspect each pending edit in the editor. Use Keep to acknowledge it or Undo to revert it." Restore Checkpoint rolls back a request, but it "doesn't reverse terminal commands, network requests, deployments, or changes to external services."

Step 7: Keep it or throw it away

If the change is good, commit it with a clear message. If it's not, Git can put files back. git restore will "Restore specified paths in the working tree with some contents from a restore source." For example:

git restore path/to/file

This throws away your uncommitted changes to that file, so be sure first.

Code review tools

Some tools review pull requests with AI. We have pages on CodeRabbit, Qodo and Greptile. They don't replace your own review.

Next steps

Not affiliated with or endorsed by Anthropic, OpenAI, Anysphere, GitHub, Microsoft or OWASP. Check their current docs before relying on these details.