I build a hospital’s internal tools as a non-developer, which means AI writes most of the code. So of course I did the responsible thing: I had AI review it too.

Not casually. I set up separate roles — one agent implements, another runs the tests, another reads the code specifically for security problems. Different instructions, different focus, different pass over the same work. It felt like a review process. For months, the security reviewer flagged almost nothing.

I read that as good news.

Then, over three days on this site, strangers found eight real defects in the same systems. Not one of them came from my reviewer.

The number that made me stop

Here’s the honest tally from that stretch. A check that asserted something was detected rather than the specific thing it was supposed to detect. An exclusion guard that verified a pattern could recognize a folder, but never that the shipping run actually excluded it — which had been silently mis-scoring six clean files for weeks. A blind spot in the opposite direction, where widening that same pattern could swallow real code and produce a perfectly green “zero problems.” An exception list printed in the report and excluded from the pass/fail entirely. A drill I performed by hand, once, months ago, whose result had quietly expired. A scheduled job that was supposed to run all of this daily and had never been registered at all.

Eight, roughly, depending on how you count. Every single one found by someone outside my setup, usually in a comment, usually aimed at something I had just written about proudly.

My reviewer agent had been reading that same code for months. It never mentioned any of them.

The part I had backwards

My first instinct was that the reviewer needed better instructions. That’s the comfortable conclusion, because it’s fixable with a prompt.

Then someone in a thread said the thing that actually explained it: two models agreeing is often one failure mode with two signatures.

I’d been treating role separation as independence. It isn’t. My implementer and my reviewer are the same model underneath, given different jobs. Different hats, one prior. Whatever the implementer was structurally unable to notice, the reviewer was unable to notice for exactly the same reason — not because it was careless, but because it shares the shape of the blind spot. Asking it to check the work is asking the same mind to reconsider its own assumption, which is the thing minds are worst at.

There’s a second, worse layer. My agents are not outside the conversation about my systems. They are the conversation. They hold the context I gave them, the framing I chose, the vocabulary I use for my own tools. A stranger reading my post has none of that. They aren’t smarter — they’re just standing somewhere I can’t stand, and neither can anything I briefed.

The human equivalent is two colleagues who’ve worked together for years: still two people, still two signatures, but their disagreements have already been resolved into a shared way of seeing. Same trap. AI just gets there instantly, on day one, by construction.

The silence I misread

Here’s what stings, because I’d already written two posts about this exact mistake in a different costume.

A reviewer that finds nothing and a reviewer that isn’t really looking produce identical output: nothing. I know this. I’ve built dead-man switches on this principle — checks that alarm on the absence of a fresh signal, precisely because silence and health look the same from outside. And I still read months of quiet from my reviewer as evidence the code was clean.

I never once seeded it. I never handed it a file with a known planted flaw to confirm it could still see. I’d done exactly that for my automated scanner — planted ten known-bad patterns, discovered it caught seven — and it never occurred to me to do the same for the reviewer, because a reviewer feels like a colleague rather than an instrument. That’s the whole error in one sentence. It’s an instrument. I’d just never held a match under it.

The tower I built instead

Looking back, everything I’ve built this month is a monument to not trusting the previous layer’s silence.

I stopped trusting my own judgment about the code, so I had an AI review it. I stopped trusting the review, so I built a mechanical scanner with explicit rules. I stopped trusting the scanner’s green light, so I planted known-bad fixtures to prove it could see. I stopped trusting that those fixtures still meant anything, so I built a drill that deliberately breaks each guard and confirms it goes red for its own reason. And then I stopped trusting the drill, because it turned out nothing was checking whether the drill itself still ran — so a separate machine, on a separate schedule, now watches for its proof of life.

Five layers. Each one exists because the layer below it could go quiet without telling me.

And here’s the thing I can’t build my way out of: every one of those layers was designed by me and written by the same AI. They fail in different ways, which genuinely helps — a rule regression, a dead gate, and a stopped scheduler don’t happen for the same reason on the same day. But diversity of failure mode is not independence of origin. The whole tower shares an author.

What actually stands outside

The only thing in this entire setup that has ever reliably stood outside is other people.

Not because they’re better engineers than my agents — several of the sharpest corrections came in three sentences from someone who never saw a line of my code. They worked because they weren’t in the room when the assumption was made. They read what I was pleased with, and pleased-with turns out to be a reliable marker for under-tested.

So the practice I’ve landed on, stated plainly:

Agreement inside the room is not evidence. If the second opinion comes from the same model, the same session, or the same framing I supplied, it’s one opinion with two signatures. It’s useful for catching slips. It is worthless for catching assumptions.

Anything that can only stay silent is not a check. Including a reviewer. Seed it, or admit you’re reading its quiet as proof of something it never claimed.

The genuinely external check has to cost something to obtain. A stranger’s attention, a published mistake, a post that invites people to aim at your best work. It doesn’t scale, it doesn’t run nightly, and it’s the only layer I have that isn’t downstream of my own assumptions.

That’s an uncomfortable conclusion for someone whose entire toolkit is AI-built. I’m not going to pretend it resolves neatly. But five layers of automated checking, and the thing that found the live bug was a stranger with a spare five minutes and no stake in my being right.

Consider that the fence I’m handing back. If you’re building with AI and having AI check the work: when did your reviewer last tell you something you didn’t want to hear? And if the answer is “it doesn’t really find much” — that’s the same silence I spent months reading as good news.

---

This is part of Stolen from the Feed — what a non-developer carries home from dev.to and actually builds. Sister series to From Zero to Ship.

Comments

Loading comments…

Post Comment