{"slug": "why-ai-coding-agents-make-verification-the-most-expensive-part-of-the-loop", "title": "Why AI coding agents make verification the most expensive part of the loop", "summary": "AI coding agents are making verification the most expensive part of the development loop, according to a developer who found that an agent built a password reset flow in under five minutes but missed a critical security flaw because the prompt didn't specify single-use tokens. The developer advocates shifting focus from code review to behavioral specification and automated end-to-end testing, using tools like Claude Code and testRigor to audit AI-generated code.", "body_md": "# Why AI coding agents make verification the most expensive part of the loop\n\nWriting code is now cheaper than auditing it. I recently had an agent build a password reset flow—routes, token logic, email integration, and UI—all in under five minutes. It looked perfect during the demo, but there was a critical flaw: the reset link didn't expire after one use. Because my prompt didn't explicitly state \"single-use only,\" the AI didn't implement the token invalidation. It’s a detail that usually goes without saying until you ship a security hole.\n\n## The inversion of development costs\n\nIn a traditional workflow, the bottleneck is the human writing the syntax. Now, the bottleneck is the human verifying the logic. If an agent generates a feature in five minutes, but I spend 45 minutes in manual testing and code review to ensure it doesn't break the database or leak data, the total dev time is still 50 minutes. We've just shifted the weight.\n\nAuditing code you didn't write is mentally more taxing than auditing code you did. You have to reconstruct the AI's \"intent\" while hunting for edge cases it missed. Generating more code doesn't fix this; it actually compounds the problem by increasing the surface area for bugs.\n\n## Specifications are the only durable artifacts\n\nImplementation is becoming disposable. In six months, I might switch frameworks or refactor the entire DOM, but the business requirement remains the same. For example, the core requirement for a password reset is:\n\n- User requests reset.\n- User receives email.\n- User sets new password.\n- New password works; old password fails.\n- Reset link expires immediately after use.\n\nWhen code is cheap to rewrite, the specification—not the codebase—is what you actually maintain. I've found it's far more efficient to write a rigid, behavioral specification as a standalone artifact before letting the agent touch the IDE.\n\n## Moving from implementation to behavioral testing\n\nI tried a different approach with a standard business app using [Claude Code](/en/tags/claude%20code/) and testRigor to see if I could automate the verification gap. Instead of reviewing the generated TypeScript or Python, I focused on observable outcomes.\n\nThe goal was to see if independent end-to-end (E2E) verification could act as the \"judge\" for the AI's output. Since the agent can implement the feature rapidly, the only way to scale is to have a test suite that doesn't care *how* the code is written, only *what* it does.\n\nIf you're using these tools, stop focusing on the \"prompt for the feature\" and start focusing on the \"prompt for the test.\" If you can define the expected behavior in a way that a verification tool can check, you stop being a manual auditor and start being a system architect.\n\n**My current stack for this:**\n\n- **Implementation:**[Claude](/en/tags/claude/) Code (via CLI for fast iteration)\n- **Verification:** testRigor (for natural language E2E tests)\n- **Result:** I spend less time reading diffs and more time refining the requirement list.\n\n[Next Vibe coding with Claude 3.5 is a trap if you stop reading the diffs →](/en/threads/9101/)\n\n[a library of Claude prompt techniques](https://tanyan888.com/), with plenty of directly applicable cases.\n\n## All Replies （3）\n\nFinally some clarity. I want to try this tonight, but will it work with Python 3.12?\n\nI want to try this tonight. Which model are you using for the audit, or is it just manual review?\n\nThis burned me last week. I spent three hours hunting a logic flaw in a generated Stripe webhook that passed every test. Use Pydantic?", "url": "https://wpnews.pro/news/why-ai-coding-agents-make-verification-the-most-expensive-part-of-the-loop", "canonical_source": "https://promptcube3.com/en/threads/9102/", "published_at": "2026-09-09 16:01:13+00:00", "updated_at": "2026-09-09 16:23:21.051348+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-products", "developer-tools"], "entities": ["Claude Code", "testRigor"], "alternates": {"html": "https://wpnews.pro/news/why-ai-coding-agents-make-verification-the-most-expensive-part-of-the-loop", "markdown": "https://wpnews.pro/news/why-ai-coding-agents-make-verification-the-most-expensive-part-of-the-loop.md", "text": "https://wpnews.pro/news/why-ai-coding-agents-make-verification-the-most-expensive-part-of-the-loop.txt", "jsonld": "https://wpnews.pro/news/why-ai-coding-agents-make-verification-the-most-expensive-part-of-the-loop.jsonld"}}