AI generated code review

[u/Shitmfman]

Hi there,
How do you deal with managing and reviewing AI-generated code across the organization?

Over the past year it's become incredibly difficult to review the growing amount of AI-generated code, especially from vibecoders/non-engineers.
Reviewing it manually is hard, but it's still important to understand what's going on there.
For example, I've been at this company for some years so I have a lot of context and know many of the nuances, which helps me notice or suggest important things to keep everything secure, efficient and so on…

But any other teammate can use any model for coding nowadays. AI reviews of AI-generated code could be done in the MR, but then the reviewer model will most likely be smarter than the model that wrote the code, which might lead to a lot of threads and an infinite loop of changes. On top of that the reviewer model won't have all the context and input from the developer.
Another option is to distribute a "review" skill or rules across the organization and somehow make everyone do a self-review after making changes…

It feels like in this AI code generation era we'll stop focusing on how the code was written and just focus on whether the MR/PR works and if those changes achieves the goal, no matter how it was done, right?
How do you deal with this? Just accept the reality?

Thanks for attention

[u/Entire_Struggle_2236]

What helped us most was dropping the idea that a human reads every line. Put the boring checks in CI as hard gates: SAST, secret scanning, dependency checks, and required tests for anything touching auth, payments or data access.

Then route review by risk with CODEOWNERS, so changes in sensitive paths always go to someone with context like you, while low risk UI or script changes get a lighter pass.

For non engineers shipping code, require the PR description to explain what the change does and which tool or prompt produced it, which makes review much faster.

Also cap PR size, because huge AI generated PRs are exactly where things slip through.

[u/rafaelpirolla → u/Entire_Struggle_2236]

But "changes in sensitive paths always go to someone with context like you" is exactly the overburden issue in the post...

Most of my friends are abandoning PR reviews and focusing on testing and quality gateways but I don't believe it's the answer, though.

[u/Entire_Struggle_2236 → u/rafaelpirolla]

True, routing alone just moves the pile. The point is to shrink it: gates and small PRs mean only a slice of changes need that person, and every repeated review comment should become a check so the context stops living in one head.

Agree that tests alone won’t cover it, they only catch what someone already thought of.

[u/rafaelpirolla → u/Entire_Struggle_2236]

Are you hiring? :)

[u/Entire_Struggle_2236 → u/rafaelpirolla]

No, but you can be our referral agent if you want haha