Where AI-Generated Code Should Not Be Trusted Yet

Updated: 2026-08-15 | Reading time: 5 min

We are enthusiastic about AI-assisted development and we teach it every week. This article is about its sharpest edge, because a student who does not know where the edge is will eventually cut somebody.

The consistent weak spot

Across the industry the same areas come up as the ones where AI-generated code cannot be trusted without expert review: authentication, payment processing, and encryption. Regulated fields — health records, financial services — expect human audit before AI-written code goes near real data.

The reason is that this code can be wrong in ways that still work. A broken login page announces itself. A login page that works but stores passwords badly looks perfect until the day it is attacked.

What we forbid in student projects

• No real payment handling. Students practise with a proper payment provider's test mode, never by writing card handling themselves.
• No storing real personal data. Practice projects use invented names and numbers, never classmates' or family members' real details.
• No secrets in code. Passwords and keys never get typed into a file that could end up on GitHub — a mistake many professionals have made publicly.
• No "the AI said it was secure". That sentence is not evidence of anything.

The questions to ask about any generated code

Before a student ships anything to a real user, we walk through:

• What happens if someone types something unexpected here — very long text, symbols, nothing at all?
• Where is data stored, and who can read it?
• What did this pull in from the internet, and do I know what it is?
• If this failed at 2am, what would the damage be?

Why we teach the limit, not just the tool

A student who can build fast and knows what they are not qualified to build is genuinely employable. They will tell a client, "I can build your booking form; for taking payments we should use an established provider rather than writing it ourselves." That answer earns more trust than a confident claim would.

Knowing the boundary is not a weakness in an AI-assisted developer. Right now it is the main thing separating a professional from someone with a fast tool.