AI code is cheap, verification is expensive: a 6-layer checklist for reviewing AI-generated code

This shifts the verification budget from reading syntax to testing intent and boundaries. It also names the AI-specific failure modes Western teams will hit — hallucinated dependencies, tautological tests, and indirect prompt injection into coding agents — and gives a practical delete-or-rewrite trigger to avoid drowning in a bad diff sunk cost.

AI has made writing code cheap, but it made verifying code expensive. A patch that takes AI 5 minutes to write can take a human 45 minutes to validate. The six-layer checklist starts by running every machine check: compile, lint, type checking, and the existing test suite. Only after those gates pass does the human step in, and the goal is explicit: catch code that passes CI but is still wrong.

Those errors come from structural causes. AI predicts patterns rather than reasons, its tests often mirror its own implementation instead of the requirement (tautological tests), and AI-based reviewers share the generator's training bias, so their failures correlate. The cost is measurable: CodeRabbit's analysis of 470 production PRs found AI code raises about 1.7x more issues than human code, with 75% more logic and correctness errors.

The checklist covers all of that: review intent before syntax, read tests before implementation, check boundary and security cases, verify whether the diff is atomic and rollbackable, and when to delete. Layer 6 includes concrete rewrite triggers — a diff over 300 lines, more than 2 new dependencies for a small feature, an intent you cannot explain after 10 minutes. A portable Python script demonstrates Layer 1 plus Layer 4 by flagging hardcoded secrets, eval/exec, pickle, SQL string concatenation, and dangerous subprocess calls before any human looks at the receipt.