Recap — Where AI Coding Fails Today

# Where AI Coding Fails Today AI tools in 2026 are powerful but not magic. Knowing the failure modes is critical to using them well. ## Failure 1: Hallucinations AI confidently invents APIs, functions, libraries that don't exist. Examples: - "Use `pandas.dataframe.fast_filter()`" — no such function. - "The `axios.fetchWithRetry()` method..." — doesn't exist. - "Pass `mode='safe'` to `json.loads()`" — not a valid arg. Why: AI is pattern-matching on similar APIs; sometimes the match is fictional. Mitigation: - **Verify imports/APIs**: run the code; check docs. - **Use IDE that catches undefined**: red squiggles save you. - **Tests**: if the test passes, the API exists. - **Ask AI to verify**: "Check that all the methods you used exist in the actual library." ## Failure 2: Context limits Modern models have 200K-1M context windows but degrade with size. Failure modes: - Forgets details from earlier in the conversation. - Misses files outside its view. - Generates code referring to outdated info. Mitigation: - **Start fresh sessions** for new tasks. - **Provide relevant files explicitly** rather than expecting AI to find them. - **Summarize state** if the conversation gets long. - **Use tools with codebase indexing** (Cursor, Claude Code) so AI can fetch files dynamically. ## Failure 3: Subtle bugs Code looks reasonable; runs; produces wrong results. Examples: - Off-by-one in pagination ("limit + 1" or "offset + 1" wrong). - Wrong operator precedence (`a or b and c` vs intended). - Slightly wrong SQL (`WHERE a OR b AND c` parsing). - Edge cases not handled (empty list, None, single-element). Why: pattern-matched from similar code that had the same bug. Mitigation: - **Tests, especially edge cases**: empty inputs, single items, None, max sizes. - **Read code carefully**: don't just glance at AI output. - **Diff before committing**: clean visual review. - **Type checker + linter**: catches many. ## Failure 4: Style drift AI generates code that works but doesn't match your conventions. Examples: - Uses `print` when you use `logging`. - Snake_case in a camelCase codebase. - Different exception handling pattern. - Different naming (`get_user_data` vs `fetch_user`). Why: AI doesn't infer style strongly without seeing your codebase. Mitigation: - **.cursorrules / CLAUDE.md** with style rules. - **Show examples**: "Follow the style of src/auth.py". - **Linters/formatters in CI**: catches mismatches. - **Review for style during code review**. ## Failure 5: Security issues AI generates code with vulnerabilities. Examples: - SQL injection from string concatenation. - Path traversal in file operations. - Logging sensitive data. - Missing authz checks. - Insecure crypto choices (MD5, weak random). Why: training data includes insecure code; AI doesn't always pick safe pattern. Mitigation: - **Review every input boundary**: where does user data enter? - **Static security analyzers**: Bandit, Semgrep, Snyk. - **Ask AI to security-review** its own output: "What are the security issues in this code?" - **Don't trust generated auth/crypto code without expert review**. ## Failure 6: Over-engineering AI sometimes generates more code than needed: - Adds error handling for impossible cases. - Creates classes when functions would do. - Premature abstractions. - Excessive logging. Why: pattern-matched from "robust production code" examples; can't always tell minimal vs maximal. Mitigation: - **Specify "minimal"**: "Keep it simple; no premature abstractions." - **Review and simplify**: delete unnecessary layers. - **Prompts**: "What's the simplest implementation that handles these cases?" ## Failure 7: Under-engineering Or the opposite: AI writes happy-path code that breaks on edge cases. Examples: - No validation on inputs. - Assumes data is well-formed. - No error handling on external calls. - Missing transactions where needed. Mitigation: - **Prompt for edge cases explicitly**: "Handle empty input, None, and oversized data." - **Test thoroughly**. - **Production-mindset prompts**: "This is production code; handle realistic failure modes." ## Failure 8: Outdated knowledge AI's training has a cutoff. May not know: - Latest library versions. - New features added recently. - Deprecated patterns. Examples: - Suggests Pydantic v1 syntax in 2026 (v2 has been standard for 2+ years). - Uses old SQLAlchemy 1.x query patterns. - Recommends deprecated cryptography functions. Mitigation: - **Note the year/version**: "We use Pydantic 2.5; use model_config not Config class." - **Verify with current docs**. - **Update CLAUDE.md / .cursorrules** with version specifics. ## Failure 9: Confident wrongness AI rarely says "I don't know". It generates confidently even when it shouldn't. Mitigation: - **Treat all output as draft**. - **Verify especially when AI sounds 'too sure'** — that's often where it's wrong. - **Ask for confidence**: "How confident are you about this? What might go wrong?" ## Failure 10: Bad arch