Our AI coding agent passed all the tests, but the code was still wrong

wpnews.pro

Check our original article on Medium: https://luisyanguas22.medium.com/our-ai-coding-agent-passed-all-the-tests-but-the-code-was-still-wrong-d4591682b55e

coding agent passes all tests while a developer discovers a production bug in discount logic

At this moment in time all tech pros and amateurs know that when you ask an AI coding agent to implement a feature, the agent will basically get into your codebase, will change a few files, write some tests and then will run the test. And in most cases it will all look like everything passed quite properly because the agent will simply report that the task is completed, and the pull request will look reasonable. Then you review the whole thing, make a couple of small adjustments, and feel ready to go.

But then, a few days later, maybe a customer reports something strange…The feature works, but under a particular condition, it suddenly produces the wrong result.

In this scenario, we would immediately ask ourselves how did that happen if in principle the whole code was compiled, the tests passed and the AI even explained why its implementation was correct.

The explanation for the above is basically because the problem is that passing tests and correct software are not the same thing, and as AI coding agents become more capable, this detail is becoming one of the most important things software developers need to understand.

Let’s look at a simple practical example in order to understand it better. Imagine you are building an e-commerce app where your task is to implement a discount for customers who qualify for a specific promotion. In this case the requirement sounds quite easy because we set for example that eligible customers will receive a 10% discount, that this discount applies only to products included in the promotion and that the discount cannot be combined with other promotional offers, all of it typical from this kind of campaigns.

An AI coding agent might then implement the discount calculation correctly and generate tests for eligible customers, ineligible customers and the final price, so each and every of the tests will pass, but what happens when for example a customer already has another promotion applied? Or what if the discount applies to an excluded product because the eligibility check happens too late? What if the client sends a modified price instead of letting the server calculate it? The implementation might still pass every test the agent created basically because tests can only verify the behavior they actually check but they cannot automatically prove that the implementation satisfies every business rule, every security requirement or every architectural constraint.

And this is not a problem exclusive to AI. Actually human developers make the same mistakes, but the difference is that AI can generate a large amount of plausible code very quickly, making it easier to produce more code than we can carefully review, so the real problem becomes that the AI does not always understand the context, and context is often everything.

Modern coding agents can inspect entire repositories, search files, run commands, modify implementations and execute tests, all of it at the speed of light, however, understanding a codebase involves more than finding the right function because a repository can include decisions that are not always documented clearly, for example the reasons why a particular validation happens in the backend, why two services use slightly different representations of the same data or which changes might break existing integrations.

It’s very important to understand that an AI agent can identify a function and understand what it does without fully understanding why it behaves that way, and this is where apparently correct implementations become dangerous because the agent may solve the immediate task while making the wrong assumption elsewhere in the system, creating changes that can be internally consistent and still be wrong for the application. And because the generated code often looks clean and professional, the mistake is not always obvious during review.

One of the most useful things a coding agent can do is generate tests alongside an implementation, but there is a very delicate issue on this because if the agent misunderstands the requirement, it can make the same mistake in both the implementation and the tests, and this happened recently in a real case we saw where a company had created an app that included a function for calculating refunds. The business rule they implemented said customers should receive a refund for the amount they actually paid after discounts, but the implementation accidentally sometimes calculated the refund using the original price so the final result was wrong.

The generated test used that same original price as its expected result so technically the code behaved exactly as the test expected, but business wise the refund was wrong.This is why test coverage alone is not enough and why a high coverage percentage tells you how much code was exercised but not whether the tests represent the correct behavior, and for critical logic tests need to be grounded in independently verified requirements, expected outcomes and meaningful specific cases.

The goal of all this is of course not to distrust every line of AI generated code, but more specifically to build a workflow that gets in the mistakes before they reach production. And in our opinion there are five practices worth adopting:

1- Define the expected behavior before generating code:

You should always try not to start with a vague prompt like "Implement the refund feature X or y”. You need to clearly specify the rules, the constraints and specific cases first. For example, in the real case explained before, refunds must use the amount actually paid, previously refunded amounts must be deducted, a refund cannot exceed the remaining refundable balance and the server must validate all monetary values.

2- Ask for specific cases before asking for an implementation:

Before generating any code, ask the agent to identify possible failure scenarios. For our same refund example, that might include duplicate requests, partial refunds, zero valued transactions, concurrent refund attempts and currency rounding. And always review the proposed cases yourself, don’t automatically accept the agent’s list as complete, as this will help exposing assumptions before they become embedded in the implementation.

3- Separate test generation from test verification:

Ask the agent to write tests, but independently evaluate whether those tests reflect the actual requirements. And whenever it’s possible, derive expected results from business rules rather than copying the implementation’s logic into the test. The important question is not anymore if the test just passes, but if these tests would fail if the implementation were wrong in a realistic way.

4- Review it all, not just the summary: An agent might report that it modified three files and all tests passed, and while this is definitely very useful information, it is not a full code review. So inspect the actual changes, look for unnecessary abstractions, altered validation logic, unexpected dependencies, swallowed exceptions, missing authorization checks and changes to behavior outside the requested feature. Keep changes small enough to understand.

5- Validate the result in the real system:

You should take unit tests as just only one chapter, and you should run the relevant integration tests, inspect logs, verify authorization boundaries and test the feature against realistic data. And for changes that can produce high risks, use staging environments, feature flags or gradual rollouts where appropriate. Always assume that an AI agent’s successful test run is evidence that something worked under specific conditions, but it’s not a guarantee that production behavior will be correct.

Now, despite all the above, this does not mean AI coding agents are not useful or not ready. Not at all. AI coding agents can actually reduce repetitive work dramatically, accelerate debugging, help developers understand unfamiliar repositories and make it easier to implement routine changes. The only mistake is treating faster implementation as equivalent to absolutely reliable delivery, because software engineering has always involved more than writing code. Proper software development requires understanding requirements, managing trade offs, validating assumptions and anticipating how changes affect the rest of the system. That is still the whole point, despite the AI paradigm. And actually many developers today are not just benefiting from generating more code but they are becoming better professionals as they are also learning to know how to evaluate it properly, producing higher volumes and higher standards in less time.

So the next time an agent tells you that everything is implemented and all tests are ok, take a moment before moving ahead…Ask what the tests actually prove, check whether the requirements were interpreted correctly and look for assumptions that might not hold in production, because the real measure of a coding is always whether the software does the right thing when real users depend on it.

Our AI coding agent passed all the tests, but the code was still wrong

Run your AI side-project on zahid.host