As QA engineers, we’re entering a new era where AI doesn’t just generate code — it also writes the tests that are supposed to validate that code.
That sounds like a win.
In practice, it’s creating a new kind of bug — one that’s much harder to catch, because the same AI that made the mistake is also the one grading its own homework.
According to CodeRabbit’s State of AI vs Human Code Generation report, which analyzed 470 real-world GitHub pull requests, AI-assisted PRs contain around 1.7× more issues than purely human-written code — including more logic flaws, security problems, performance issues, and code quality issues.
The bugs aren’t obvious about syntax errors. They’re plausible-looking code with hidden assumptions, inconsistent patterns, and edge cases nobody has exercised. Our tests pass green. Our coverage looks perfect. But production is quietly accumulating technical debt that will explode when the right customer triggers it.
The validation gap between a fast skim and merge is where most AI-generated defects slip through.
Let’s walk through some failure patterns showing up most in AI-assisted implementation, and what we can actually do about them.
When AI generates code and tests together, the tests share the same blind spots as the code.
Here’s what that looks like in practice.
As a result, the test can still pass at 95% rate by default while the real business rule is broken. Tests assert what AI expected, not what requirements say.
That is the danger of mirror-image validation: the code and the test reflect each other, but neither one is truly checking the requirement.
What this looks like:
**The problem: **The test passes, but it only confirms that the code matches its own assumptions — not that it matches the business rule, which is how false confidence slips into production.
AI-written code often makes assumptions it has no way of verifying — about a dependency, an edge case, or a pattern the rest of your codebase follows.
Suppose AI generates code to integrate a new payment gateway:
At first glance, it looks clean and passes basic checks. But here’s how it hits every risk pattern:
Real impact: AI-generated code may appear well-structured and pass all automated checks with subtle hidden errors that appear later in the release pipeline.
According to Veracode’s 2025 GenAI Code Security Report, 45% of AI-generated code introduces security flaws — including OWASP top 10 vulnerabilities like SQL injection and cross-site scripting.
The reason this keeps happening is straightforward: AI models are trained on public repositories with full of insecure patterns. They reproduce those patterns fluently, confidently, and without any signal that something is wrong.
On the credentials side, GitGuardian’s State of Secrets Sprawl 2026 report found 28.65 million new hardcoded secrets exposed in public GitHub commits in 2025 — a 34% year-over-year increase, the largest single-year jump ever recorded.
In April 2026, IOActive published The Security Gap in AI-Generated Code, which evaluated 27 leading AI models and coding tools across 730 real-world programming prompts. Their finding saw nearly one-third (31.6%) of AI-generated code samples being fully exploitable, with average security performance across all models sitting at just 59%.
What commonly gets missed:
**❗The scary part: **There’s no obvious signal in the output. The code looks clean but carries well-known vulnerability classes.
One principle behind every fix:“Never let the thing that produced the artifact also be the same thing that approves it.”
Every strategy below is the same idea applied differently:
Run a second, isolated prompt only the spec/ticket — not the implementation. Have it generate tests from that alone. Cross‑check tests against documented business logic or acceptance criteria.
Then diff those against the implementation-derived tests. Any mismatch is a candidate bug, surfaced automatically.
You can take this further by building a lightweight validation agent that checks whether each AI-generated test:
Run a mutation-testing tool like Stryker or PIT. It makes small, targeted changes to your code:
Mutation score is the percentage of mutants your tests successfully kill. If mutation score is low while coverage is high, you’ve caught the mirror-image pattern mechanically — no human had to spot it.
This way, AI isn’t only a generator — it becomes part of a governance loop that ensures tests are valid and valuable.
An AI harness is the infrastructure layer that prevents AI from generating bad tests. Using an AI harness as a mandatory planning and verification step significantly reduces AI hallucinations and phantom dependencies by forcing claims to be source-backed, dependencies to be explicit, and outcomes to be test-verified.
Test generation and execution
**Example: **For a story like “User should be able to reset password,” a well configured harness creates cases for valid email, unregistered email, expired reset link, weak new password, and token reuse attempt. During execution, it runs only related tests and records to pass or fail per task.
Test automation
**Example: **For “Manager creates a task,” harness generates scenarios for successful creation, missing required fields, and max-length validation, then helps run those scenarios in the automation pipeline.
Test reporting
**Example: **Task 1 logs “pass” with automated output summary, Task 2 logs “pending manual” with a clear UAT verification hint, and Task 3 logs “fail” with failure summary and retry direction.
AI can generate test artifacts quickly. But humans must review them to make sure they’re grounded in reality, aligned with business rules, and strong against edge cases and security gaps.
Business Alignment
☐ Every generated test maps to a real acceptance criteria
☐ Tests reflect actual business logic, not just what the AI inferred from the code
Technical Correctness
☐ APIs, fields, DB columns, and libraries referenced in tests exist
☐ No phantom dependencies or hallucinated method names
Assertion and Coverage Quality
☐ Assertions are meaningful — not mirror-images of the implementation
☐ Edge cases are covered: null values, invalid inputs, timeouts, concurrency, retry logic
Security and Reliability
☐ No injection or auth gaps in generated test code
☐ No secrets or PII in test fixtures or assertions
☐ No flaky or duplicated automation
Report Clarity
☐ Clear status split per task: pass, fail, blocked, pending manual
AI cannot take release-risk decisions tied to customer or compliance impact. It doesn’t fully understand business intent from incomplete inputs. It can invent endpoints, fields, or workflow behavior, and it has real blind spots on performance, production reliability, and cross-system dependencies. These aren’t edge cases — they’re the exact scenarios where bugs that make it to production actually live.
Manual review isn’t enough. We need automated gates that block AI-generated code from merging if it fails for security, quality, or dependency checks. Here’s the core gate configuration:
Key components to include:
Static Analysis (SAST and Linters)
Dynamic Analysis (DAST)
Dependency Scanning
Secret Scanning
When AI writes the code and the tests, a passing result doesn’t ensure quality — it’s just an echo chamber. Need to validate the requirement, not the output.
As a QA, what worries me most about the AI wave in development isn’t the speed — it’s the type of bugs we’re starting to see.
To properly validate AI-generated output, you need an independent check that sits outside the generation loop. Not a smarter AI reviewing the same code, but a separate process that traces back to the original requirement and asks: does this test confirm what the spec says, or does it only confirm what the AI assumed?
The question is no longer “Should we use AI to code?” but: Is our QA model ready for AI-generated code, or has it quietly become the weakest link in our delivery chain?
Your product quality depends on the answer. Start building AI-aware QA today.
When AI Writes Both Code and Tests: New Risks QA Engineers Can’t Ignore was originally published in Towards AI on Medium, where people are continuing the conversation by highlighting and responding to this story.