Reviewing AI-generated PRs: the 10-minute checklist

AI-generated PRs have a tell: they're too clean. Perfect formatting, thorough comments, confident summaries. And that's exactly why they need a different review: the polish hides the same failure modes every time.

The 10-minute checklist

Minutes 0–2: What did it touch that it shouldn't have?

Open the file list first, not the diff. Agents are notorious for scope creep: reformatting untouched files, "fixing" adjacent code, adding dependencies for one helper function. If the PR touches files outside the task, that's your first question, not your first approval.

Minutes 2–4: The tests it wrote for itself

Agents write tests that pass, not tests that protect. Check:

• Do the tests assert behavior or implementation? A test that mirrors the code line-by-line will pass forever and catch nothing.
• Are the edge cases real? Empty inputs, nulls, permission failures, timeouts, or just the happy path three times?
• Would the test fail if the code were wrong? Mutate the logic mentally. If the test still passes, it's decoration.

Minutes 4–6: Error handling and the unhappy path

This is where AI code most consistently underperforms. Look for:

• Bare except: / empty catch blocks
• Errors swallowed and logged but never surfaced
• Retries without backoff or limits
• User-facing errors that leak stack traces or internals

Ask: "what happens when this fails?" If you can't answer from reading the code, neither can the on-call engineer.

Minutes 6–8: Security basics

Agents don't think adversarially. Scan for:

• SQL/query construction with string interpolation
• Missing authorization checks (authentication ≠ authorization)
• Secrets or tokens in code, logs, or error messages
• Mass assignment / over-permissive input binding

You don't need a full audit, just the OWASP top-10 instincts applied for two minutes.

Minutes 8–10: Would you have written it this way?

Not style, judgment. Did it pick the simple approach or the clever one? Did it add an abstraction for a single use? Did it duplicate something that exists three files over? Agents optimize for completing the task, not for the codebase's future. That's your job, and it's the part that takes the longest to learn and the least time to check once you know the smell.

What to automate

Everything above that's mechanical belongs in CI, not in your 10 minutes:

• Scope check: fail if files outside the ticket's area change without explanation
• Test mutation score on AI-generated PRs (higher bar than human PRs, not lower)
• Secret scanning, obviously
• Lint rules for the error-handling patterns your team keeps seeing

The mindset shift

Reviewing human code, you ask "is this correct?" Reviewing AI code, ask "what did it not consider?" The agent did the typing. Your review is the engineering.