{"slug": "when-ai-writes-both-code-and-tests-new-risks-qa-engineers-cant-ignore", "title": "When AI Writes Both Code and Tests: New Risks QA Engineers Can’t Ignore", "summary": "AI-assisted pull requests contain 1.7 times more issues than purely human-written code, according to CodeRabbit's State of AI vs Human Code Generation report analyzing 470 real-world GitHub pull requests. The report found that AI-generated code and tests share the same blind spots, creating mirror-image validation where tests pass but fail to check actual business requirements. Veracode's 2025 GenAI Code Security Report adds that 45% of AI-generated code introduces security flaws including OWASP top 10 vulnerabilities.", "body_md": "As QA engineers, we’re entering a new era where AI doesn’t just generate code — it also writes the tests that are supposed to validate that code.\n\nThat sounds like a win.\n\nIn practice, it’s creating a new kind of bug — one that’s much harder to catch, because **the same AI that made the mistake is also the one grading its own homework.**\n\nAccording to [CodeRabbit’s State of AI vs Human Code Generation report](https://www.coderabbit.ai/blog/state-of-ai-vs-human-code-generation-report), which analyzed 470 real-world GitHub pull requests, AI-assisted PRs contain around **1.7× more issues than purely human-written code** — including more logic flaws, security problems, performance issues, and code quality issues.\n\nThe bugs aren’t obvious about syntax errors. They’re plausible-looking code with hidden assumptions, inconsistent patterns, and edge cases nobody has exercised. Our tests pass green. Our coverage looks perfect. But production is quietly accumulating technical debt that will explode when the right customer triggers it.\n\n*The validation gap between a fast skim and merge is where most AI-generated defects slip through.*\n\nLet’s walk through some failure patterns showing up most in AI-assisted implementation, and what we can actually do about them.\n\nWhen AI generates code and tests together, the tests share the same blind spots as the code.\n\nHere’s what that looks like in practice.\n\nAs a result, the test can still pass at 95% rate by default while the real business rule is broken. Tests assert what AI expected, not what requirements say.\n\nThat is the danger of mirror-image validation: the code and the test reflect each other, but neither one is truly checking the requirement.\n\n**What this looks like:**\n\n``` python\n# AI-generated code def calculate_shipping(weight):     if weight > 10:# ❌ WRONG: Should be >= 10         return 15.00  # Heavy items     return 5.00 # Light items   # AI-generated \"test\" - mirror-image validation def test_calculate_shipping():     assert calculate_shipping(5) == 5.00  # ✅ Passes (light)     assert calculate_shipping(15) == 15.00 # ✅ Passes (heavy)\n```\n\n**The problem: **The test passes, but it only confirms that the code matches its own assumptions — not that it matches the business rule, which is how false confidence slips into production.\n\nAI-written code often makes assumptions it has no way of verifying — about a dependency, an edge case, or a pattern the rest of your codebase follows.\n\nSuppose AI generates code to integrate a new payment gateway:\n\n``` python\n# AI-generated code def process_payment(amount, card_info):\tgateway = PaymentGateway()\tresponse = gateway.charge(amount, card_info)\treturn response.success\n```\n\nAt first glance, it looks clean and passes basic checks. But here’s how it hits every risk pattern:\n\n**Real impact:** AI-generated code may appear well-structured and pass all automated checks with subtle hidden errors that appear later in the release pipeline.\n\nAccording to [Veracode’s 2025 GenAI Code Security Report](https://www.veracode.com/resources/analyst-reports/2025-genai-code-security-report/), **45% of AI-generated code introduces security flaws** — including OWASP top 10 vulnerabilities like SQL injection and cross-site scripting.\n\nThe reason this keeps happening is straightforward: AI models are trained on public repositories with full of insecure patterns. They reproduce those patterns fluently, confidently, and without any signal that something is wrong.\n\nOn the credentials side, [GitGuardian’s State of Secrets Sprawl 2026 report](https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/) found **28.65 million new hardcoded secrets exposed in public GitHub commits in 2025 — a 34% year-over-year increase**, the largest single-year jump ever recorded.\n\nIn April 2026, IOActive published [The Security Gap in AI-Generated Code](https://www.ioactive.com/the-security-gap-in-ai-generated-code/), which evaluated 27 leading AI models and coding tools across 730 real-world programming prompts. Their finding saw **nearly one-third (31.6%) of AI-generated code samples being fully exploitable**, with average security performance across all models sitting at just 59%.\n\n**What commonly gets missed:**\n\n**❗The scary part: **There’s no obvious signal in the output. The code looks clean but carries well-known vulnerability classes.\n\nOne principle behind every fix:“Never let the thing that produced the artifact also be the same thing that approves it.”\n\nEvery strategy below is the same idea applied differently:\n\nRun a second, isolated prompt only the spec/ticket — not the implementation. Have it generate tests from that alone. Cross‑check tests against documented business logic or acceptance criteria.\n\nThen diff those against the implementation-derived tests. Any mismatch is a candidate bug, surfaced automatically.\n\nYou can take this further by building a lightweight validation agent that checks whether each AI-generated test:\n\nRun a mutation-testing tool like **Stryker** or **PIT**. It makes small, targeted changes to your code:\n\n**Mutation score** is the percentage of mutants your tests successfully kill. If mutation score is low while coverage is high, **you’ve caught the mirror-image pattern mechanically — no human had to spot it.**\n\n*This way, AI isn’t only a generator — it becomes part of a governance loop that ensures tests are valid and valuable.*\n\nAn AI harness is the infrastructure layer that prevents AI from generating bad tests. Using an AI harness as a mandatory planning and verification step significantly reduces AI hallucinations and phantom dependencies by forcing claims to be source-backed, dependencies to be explicit, and outcomes to be test-verified.\n\n**Test generation and execution**\n\n**Example: **For a story like “User should be able to reset password,” a well configured harness creates cases for valid email, unregistered email, expired reset link, weak new password, and token reuse attempt. During execution, it runs only related tests and records to pass or fail per task.\n\n**Test automation**\n\n**Example: **For “Manager creates a task,” harness generates scenarios for successful creation, missing required fields, and max-length validation, then helps run those scenarios in the automation pipeline.\n\n**Test reporting**\n\n**Example: **Task 1 logs “pass” with automated output summary, Task 2 logs “pending manual” with a clear UAT verification hint, and Task 3 logs “fail” with failure summary and retry direction.\n\nAI can generate test artifacts quickly. But humans must review them to make sure they’re grounded in reality, aligned with business rules, and strong against edge cases and security gaps.\n\n**Business Alignment**\n\n☐ Every generated test maps to a real acceptance criteria\n\n☐ Tests reflect actual business logic, not just what the AI inferred from the code\n\n**Technical Correctness**\n\n☐ APIs, fields, DB columns, and libraries referenced in tests exist\n\n☐ No phantom dependencies or hallucinated method names\n\n**Assertion and Coverage Quality**\n\n☐ Assertions are meaningful — not mirror-images of the implementation\n\n☐ Edge cases are covered: null values, invalid inputs, timeouts, concurrency, retry logic\n\n**Security and Reliability**\n\n☐ No injection or auth gaps in generated test code\n\n☐ No secrets or PII in test fixtures or assertions\n\n☐ No flaky or duplicated automation\n\n**Report Clarity**\n\n☐ Clear status split per task: pass, fail, blocked, pending manual\n\nAI cannot take release-risk decisions tied to customer or compliance impact. It doesn’t fully understand business intent from incomplete inputs. It can invent endpoints, fields, or workflow behavior, and it has real blind spots on performance, production reliability, and cross-system dependencies. These aren’t edge cases — they’re the exact scenarios where bugs that make it to production actually live.\n\nManual review isn’t enough. We need automated gates that block AI-generated code from merging if it fails for security, quality, or dependency checks. Here’s the core gate configuration:\n\n**Key components to include:**\n\n**Static Analysis (SAST and Linters)**\n\n**Dynamic Analysis (DAST)**\n\n**Dependency Scanning**\n\n**Secret Scanning**\n\nWhen AI writes the code and the tests, a passing result doesn’t ensure quality — it’s just an echo chamber. Need to validate the requirement, not the output.\n\nAs a QA, what worries me most about the AI wave in development isn’t the speed — it’s the type of bugs we’re starting to see.\n\nTo properly validate AI-generated output, you need an independent check that sits outside the generation loop. Not a smarter AI reviewing the same code, but a separate process that traces back to the original requirement and asks: does this test confirm what the spec says, or does it only confirm what the AI assumed?\n\nThe question is no longer “Should we use AI to code?” but: **Is our QA model ready for AI-generated code, or has it quietly become the weakest link in our delivery chain?**\n\nYour product quality depends on the answer. Start building AI-aware QA today.\n\n[When AI Writes Both Code and Tests: New Risks QA Engineers Can’t Ignore](https://pub.towardsai.net/when-ai-writes-both-code-and-tests-new-risks-qa-engineers-cant-ignore-d9f2f33527fa) was originally published in [Towards AI](https://pub.towardsai.net) on Medium, where people are continuing the conversation by highlighting and responding to this story.", "url": "https://wpnews.pro/news/when-ai-writes-both-code-and-tests-new-risks-qa-engineers-cant-ignore", "canonical_source": "https://pub.towardsai.net/when-ai-writes-both-code-and-tests-new-risks-qa-engineers-cant-ignore-d9f2f33527fa?source=rss----98111c9905da---4", "published_at": "2026-07-30 10:21:45+00:00", "updated_at": "2026-07-30 10:40:18.544351+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety", "ai-ethics", "developer-tools"], "entities": ["CodeRabbit", "Veracode", "GitGuardian", "IOActive", "OWASP"], "alternates": {"html": "https://wpnews.pro/news/when-ai-writes-both-code-and-tests-new-risks-qa-engineers-cant-ignore", "markdown": "https://wpnews.pro/news/when-ai-writes-both-code-and-tests-new-risks-qa-engineers-cant-ignore.md", "text": "https://wpnews.pro/news/when-ai-writes-both-code-and-tests-new-risks-qa-engineers-cant-ignore.txt", "jsonld": "https://wpnews.pro/news/when-ai-writes-both-code-and-tests-new-risks-qa-engineers-cant-ignore.jsonld"}}