The Bug Class AI Coding Agents Keep Introducing (and How We Started Catching It in CI)

Avalon Labs has released Agent Code Merge Gate, a free GitHub Action that scans pull requests for two specific regression classes commonly introduced by AI coding agents: dropped authorization checks and queries that perform poorly on production data. The tool runs an offline heuristic pass plus an AI-backed summary, posting a single comment per PR, and is designed to catch issues that existing CI and code review often miss.

AI coding agents are good at producing a diff that works in the narrowest sense — the function still returns what the test expects. What they're not reliably good at is preserving properties nobody wrote a test for in the first place. The two we kept running into: an authorization check quietly dropped during an agent-driven refactor nothing failed, because no test covered who was allowed to call the route — only that the route worked , and a rewritten query that behaved fine against a small dev dataset and full-table-scanned the moment it hit production data. Neither shows up in CI as it exists today. Both show up in code review only if the reviewer happens to look at exactly the right five lines out of a few hundred. Agent Code Merge Gate https://github.com/avalonlabs-platform/agent-code-merge-gate is a free GitHub Action, now live on the GitHub Marketplace https://github.com/marketplace/actions/avalonlabs-agent-code-merge-gate , that runs on every pull request and scans the diff specifically for those two regression classes. It runs an offline heuristic pass fast, no external call plus one AI-backed pass for a short Executive Summary, and posts a single comment back to the PR that updates on every push rather than piling up duplicates. Deliberately narrow scope — it's not trying to be a general linter. It covers the two failure modes we found ourselves manually re-checking for once AI-generated PRs became the majority of our merge volume. Three lines in a workflow file: - name: Agent Code Merge Gate uses: avalonlabs-platform/agent-code-merge-gate@v1.0.0 ​ {% endraw %} No signup and no config needed for the default behavior. Two inputs worth knowing about: {% raw %} fail-on-critical: true turns a CRITICAL finding into an actual failed check instead of just a comment, and comment-on-pr: false if you'd rather build your own notification from the raw status output. What's next Right now it's diff-scoped — it sees what changed in this PR, not the whole repo's history of how that code got there, which limits how much context it can reason about. Whole-repo context is the obvious next step, and it's also where this stops being a free CI script and starts being a product decision — worth its own post once it's built rather than speculated about here. If you've hit a different bug pattern that seems to show up disproportionately in AI-generated PRs, I'd genuinely like to hear about it — that's exactly the kind of thing worth building detection for next.