AI coding tools optimize for one thing above all: producing code that runs and matches the prompt. That's genuinely useful - but "runs on the happy path" and "holds up in production" are different standards, and the difference is where businesses get hurt. Here's what tends to fall through the cracks.
1. Authentication and authorization boundaries
Generated code will happily add a login screen while leaving the real question unanswered: can one logged-in user reach another user's data by changing an ID in the URL? Authorization - who can do what - is routinely weaker than it looks.
2. Input validation and injection
User input is assumed to be well-behaved. In the real world it's hostile. Missing validation and unsafe queries open the door to injection, broken data, and worse.
3. Error and failure handling
The code assumes every call succeeds. Networks time out, third-party APIs go down, and payments fail halfway. Without deliberate failure handling, one hiccup becomes a broken screen or a corrupted record.
4. Data integrity under concurrency
Two users acting at the same time, a retry that runs twice, an update that arrives out of order - these are where quietly wrong data comes from. Generated code rarely reasons about concurrency at all.
5. Secrets and configuration
API keys hard-coded into the source, credentials committed to the repo, no separation between test and production. It works in the demo and becomes a liability the moment the code is shared or deployed.
6. Backups and recovery
Can you restore after a bad deploy or an accidental deletion? If the answer isn't a confident yes, you don't have a backup strategy - and AI tools almost never set one up for you.
7. Rate limits, cost, and abuse
Nothing stops a single user - or a bot - from hammering an endpoint, running up a cloud bill, or exhausting a third-party quota. Throttling and abuse protection are an afterthought at best.
8. The unhappy business workflows
Refunds, cancellations, partial failures, edge-case states no one mentioned in the prompt. The core flow gets built; the messy real-world branches that actually run your business don't.
9. Observability
When something breaks in production, can you tell what happened? Without logging, monitoring, and alerting, your first notice of an outage is an angry customer.
10. Deployment and performance at scale
What runs instantly for one test user can crawl - or fall over - under real load. Database queries that never got an index, assets that never got optimized, and a deploy process held together by hand all surface at the worst possible time.
None of this means "don't use AI"
Used well, AI tools are a real accelerant - we use them too. The point is simpler: the speed is real, and so are the gaps. Before you put an AI-built app in front of customers, money, or sensitive data, it's worth having someone look specifically for the things the tool wasn't trying to find.