Can You Really Trust AI-Generated Code? - JSJ 699  ## Document Notes ## Highlights - **Code Review Is About Ownership** - Code review's core purpose is team ownership and collective responsibility for code. - AI won't remove the need for humans to own, learn, and be accountable for production code. Transcript: Itamar Friedman Kodo stands, you mentioned the name, Kodo stands for quality of development. And the most focus of our platform is around AI code review. In general, we deal with quality, different AI quality workflows, et cetera. Basically, helping enterprise, professional dev teams to standardize their quality via the code review process or shift left code review and testing, et cetera. Yeah, serving the Fortune 5000 around the world. But I think like really, really exciting, for example, just to talk, is code review important at all right now and in the future? Forget about Codo. That's, I think, like a cool topic. Yeah, absolutely. Charles Max Wood Well, you know, you kind of hit on something that I think a lot of people are talking about with the AI stuff, you know, whether it's AI code review or AI generated code, maybe it's AI generated Code that's code reviewed by AI. I mean, I don't know. It seems like there's a lot of concern as well, as far as, okay, well, if I've got, you know, an AI and LLM generating code, am I even going to have a job or, you know, maybe they just downsize Most of my team. And so I have to be the most elite of the awesome elite at my company. And so, yeah, there is a lot of concern there. And then the other piece of it is, okay, I've got this powerful tool. Am I using it right? And so let's talk about the code reviews first, ([Time 0:01:40](https://share.snipd.com/snip/d9387bb0-0798-45fe-9b30-d2e046cb34d4)) - **Grow Skills Around AI Workflows** - Learn AI as a core developer tool: prompt, review, and own AI-produced artifacts. - Specialize in higher-level tasks like specs, guardrails, and agent orchestration to stay valuable. Transcript: Itamar Friedman Pointers. So you touch like interesting point. They're related and different. So let's tackle some of them. Like first about losing your job. Like you get to that point really quickly. I think like, first of all, in the next few years, I'm not talking about 15 years. That's, it's hard to predict, especially the future. So let's focus on five years and we can we can go to further than that. I do have like my opinion, strong opinion about the five next year. Forget about it. Sorry, Dario from Entropic and Sam Altman claiming, I don't know, half a year ago, one year ago, that in 2025, zoning any more developers, 90% of code generated by developers. Sweebench, if you know this benchmark, software engineering benchmark, going to be 99 by none of the year. We're far from all of that. And now I claim that while they decreased their predictions for 2026 lower than 2025, I think even there, they're wrong. But that doesn't mean that the future is not going to be strong right now. It already is. And it's going to be more and more AI empowered. And yes, at some point, there is going to be an inflection point where we're actually going to see end-to automation of software, certain aspect of software development. But we can talk about it via the code review, specifically about, you know, Copata, etc. We are actually good friends. Like we have multiple clients that we are partnering together. They focus more on code generation and agentic workflow that are pushing like GitHub issue into a PR much quicker. We're more focused on how do you know that you can trust that lines of code and i'll elaborate about that now sometimes there are some you know feature like think about the cloud like cloud Have cloud observability tools but still you have the data dog of the world and that's a difference between like a few features that the cloud have around observability to a full-fledged Platform that gives you the confidence so i won't go deeper on that competition because it's actually quite a symbiotic. The more people use Copilot, the more you need Codo in order to trust the code. So it's actually good. But code review specifically, I think some might think about a synonym for where you deal with software quality, but actually the difference, it is part of it, but let's think about Code review. The purpose, it's meaningful purposes. First, like owning the code and learning two different, very close related buckets. Like as a team, first the developer, mostly single-handed, like developing a feature or a subfeature. And then there's that moment where the team take responsibility. If that person is going to be on vacation, who's going to do root code analysis if something happens, right? So it's a moment where you like learn to each other code, learn the software and own it together. Even if an AI generated it completely 100% from one prompt to a PR, which is rare, but let's assume we're going to maybe talk about a spec during development, et cetera. But let's say you did write your spec. Yeah. Let's say you did write your spec completely like perfect and you got a feature. Even then a human needs to take over at least for the next few years and take responsibility. So that's one, one thing about code review. And the second thing is like, like until now, and it's going to be in the next few years, even if you do the best spec and the best like work you're still going to have ai that needs sorry code That needs to be uh reviewed and there's a difference between a tool that is meant to help you review and standardized quality to the one that is trying to help you generate code same of How there's a difference between code observability and cloud. So to TLDR, hey, don't worry, in my opinion, about your job. I would even recommend people as different than all other, I think, 99th industry do go learn like, you know, computer science, but do like work with AI as one of your main tools throughout The SDLC and code generation, code review, root code analysis, generating your spec, everything. And you will just alleviate together with the profession. ([Time 0:03:40](https://share.snipd.com/snip/79e91446-7a21-43ae-9739-991ea097e5ca)) - **Use AI To Prioritize Human Attention** - Free humans from repetitive checks so they can focus on higher-value review tasks. - Configure AI to surface the risky parts of a PR so reviewers spend time where it matters most. Transcript: Itamar Friedman So to TLDR, hey, don't worry, in my opinion, about your job. I would even recommend people as different than all other, I think, 99th industry do go learn like, you know, computer science, but do like work with AI as one of your main tools throughout The SDLC and code generation, code review, root code analysis, generating your spec, everything. And you will just alleviate together with the profession. And that, I think, my point about that. Charles Max Wood Yeah, I agree with a lot of what you said there. And I'm going to back up through some of it. And then I've got a couple of questions as we go through. But one is, you know, because, yeah, you kind of wove in the am I going to lose my job or where do I go with my job, along with, hey, where does the code review stuff fit in? And that's where I have more questions. But I just want to reiterate a couple of things. One is, is that we're not getting away from people having to be involved in the process is what I heard you say. And so to a certain degree, yeah, you may have tools that take on certain aspects of the job or, you know, do some of the things that are involved in, you know, understanding and figuring Out what's going on. But at the end of the day, yeah, you need a human ([Time 0:07:11](https://share.snipd.com/snip/95de2acf-d218-4aca-8126-47493263c76e)) - **Large PRs Break Human Review Capacity** - Large PRs overwhelm human reviewers and reduce comment quality as size grows. - AI can classify and prioritize PRs, improving review coverage and catching more issues in big changes. Transcript: Itamar Friedman But if I have to force you, like choose one, I think I know what you're going to choose. And think about how much we delegate to Google or other technologies on the internet and intranet that we're not going to validate right now to the deepest part of it. So I think it's right now already like a very human digital i we call it ai or not like technology based like development already as as it is today and and and i think like the same thing is Going to happen with code review where actually if you have a 100 and we are seeing customers that have more than that, like a set of guardrails, rules, standards. And I can give you an example. Like having a human reviewer doing that like all at once in the time, the limited time is actually problematic. And if you can free the time to focus on what, you know, where could be the most useful for that code review, it's actually going to have better learning. Especially if the tool, ai tools that are using cares about learning so even if it caught something it's just like oh i fixed it it's rather hey this is the reasoning and that's what we Learned from it and by the way this is how we changed our second brain like that and so let me give an example like there could be that someone in the company really cares about you know uh Feature flags and they didn't manage to tell everyone no. And the 500 developers, 700 developers, 7,000 developer organizations, that's what you care about. You can configure that in the system, AI system. And now if you develop a new feature, you get an alert. Hey, you didn't put a feature flag also, you shouldn't. You know, this is also learning. Like, hey, oh, the company cares about feature flag. I have a 100 example like this, but just one, you know, very, I think famous, funny, or scary, or not funny, mim. I'm a developer, this is the minute, like, I'm a developer, I wake up in the morning, I have a slot, 40 minutes to review a PR, a pull request. If you give me five lines of code in that PR, I'll give you 50 comments. If you give me 50 lines, I'll give you five comments. If it's 500 lines, looks good to me, right? Like in 40 minutes, how can I review 500 lines of code? That's a reality. And by the way, AI could even help us with classifying like which review, which PR you can actually do for 40 minutes. That's how also doctor works. Like they get an AI tool that helps them prioritize, not necessarily tell them that person is whatever diagnostic, but just surfacing. So the opportunities are awesome. Actually, the problem is real, already existing around learning and catching issues. ([Time 0:12:30](https://share.snipd.com/snip/5bc13d15-26fa-4ebf-af4c-fb4456200cab)) - **Mix Static Tools With LLM Checks** - Combine static analysis with LLM-based checks to cover both deterministic rules and fuzzy patterns. - Integrate tools to avoid duplicate noise and achieve complementary coverage. Transcript: Itamar Friedman Philosophy around like how would you how would you actually exploit LLMs like AI to work with rules or standard standards that are written down? So it's for those who are watching the video,'m actually having i have here like a uh a black shirt but it's really where usually i wear purple and i'll explain why because i think the world's Roughly speaking divided into two and i'm relating to how you use rules and standard and markdown etc i'm going to explain it's connected i swear so there is the blue team and the red team, Like, principle. At Coda, we see ourselves, like, more in the red with mix. That's one of the reasons we chose the purple. So I'll explain. The blue team, which we admire, like, the windsurf, the cursor of the world, etc. Right. Cloud code, copilot, everyone. Basically, they take those, like, rules. You can write them in different. And they mostly put it as part of their context which in many cases is actually listening to but there's two problems one i said many cases the second is that maybe it took it as part of the Context but as you usually it doesn't work you don't finish a feature like at least not a meaningful feature from prompt to code even if it's an agent that runs for 10 minutes usually or One hour now sometimes you usually like get to prompt it over like like navigate it then at your 10th you know prompt it actually very very probably like missed something from your spec Or your rules or even your own prompt and the second one. That's a blue way of thinking. Would they prioritize their KPIs like UX UI? We admire them on that. And speed from prompt to code, etc. The red team is how we take every fact that is there as an intent, they're functional or non-functional, and verify it. That's a totally different process. So you take the list of your 100 rules, whether it's 10 or 1,000, by the way, and you check them with and write LLM to really increase, I can't say 100%, but really 99, whatever, increase The chance that they're actually checked. I just wanted, you know, that it's important to differentiate between different philosophies and it actually leads to a different UX UI, et cetera. And that relates to the first topic of ASTs. I think that they're actually very powerful tools like Sonar, for example. I would definitely, I have like high expectation of that company. ([Time 0:19:14](https://share.snipd.com/snip/c5e34da0-e923-45fb-b37a-5b66e722c6df)) - **Consultant Built App In Weeks With AI** - Obi Fernandez built an app in one month using AI that would have taken a team months before. - AI made solo development massively faster and far cheaper for that consultancy example. Transcript: Charles Max Wood I was having a conversation yesterday with Obi Fernandez. He's a Ruby developer, but I've seen the same thing from JavaScript friends where, you know, they use Cloud Code and they have it generate a bunch of the code, right? And then they kind of review it on their own. And the thing that he basically said, because he used to run a consultancy, one of the bigger consultancies out there in the Ruby space. And he was saying, I built this app in a month that it would have taken us six months and probably $500,000 of developer salary to build this. And I've done it by myself in a month with AI help. And so I'm looking at it and go, well, so to a certain level, I guess the answer to can I trust AI generated code is yeah. I mean, because it works, right? ([Time 0:25:23](https://share.snipd.com/snip/463fba9e-cae8-4238-ac39-ca7433d4d876)) - **Trust Comes From Process, Not Origin** - You shouldn't blindly trust AI-generated code any more than human code without process. - Trust grows when AI-generated code passes verified, automated pipelines and human checkpoints. Transcript: Itamar Friedman We hear it a lot. The last point, I think like short, what I mostly want to relate about is the main question of the topic of today. Like, should you trust AI generated code? I do have an answer. But I just say like, I do think the future is already happening now, like multiple of our client connecting Coda with cursor or Coda with Copilot or whatever. And that's more. Yeah, I just don't want to like, okay, yeah, I just don't want to like spend too much time with that. I guess it's not a commercial today. So it's possible it's going to that direction more and more. I do want to answer the question, but with a metaphor before. If I ask you, do you trust human code? Wait, wait, don't answer. Let me, give me a second. But just think about it for a second. Do you trust human code? Charles Max Wood Think like, let's let's well think about a little bit sorry yeah no because because you're you know it's a it's a good point the flip side though is that because i don't know that it's necessarily Do you trust human generated code a lot of it depends on the human right and you know it's like okay how much experience do they have have they done this before you know are they taking security And scaling and all the other things into account, right? But the other thing is, is that I don't think that that's the baseline that we have to look at AI from because it's not whether or not I trust human code and whether or not I trust AI code. Because at this point, the human generated code is the baseline, we've been doing that for years and years and years and years. Is the AI code better? Or the other way you look at it from a business standpoint is, is it close enough given what I had to do to generate it, which is usually a prompt and not nearly as much time, right? So maybe it's not as good as human code in a number of ways, but it's good enough and it's a lot cheaper. And so it may be worth it anyway. Itamar Friedman So I'm with you on it, but still bear with me with the metaphor. Like if I ask, and I'll borrow something that you said to make my point. If you ask, do you trust human generated code, written code or coded code? Then I think the immediate answer is like, yes, that's what we do. But then you think about a bit more like you just did. And you're thinking, if I trust that person, even if it's a senior developer, to write the code and notepad++ on the airplane and then push it to production. I'm not saying I never did that, but push it to production. I think your answer is no. And then what you are saying, like a senior developer that is going through the processes that is required, checking also for security, reviewing for the standards and all that, and Going through the review process and checking the CI results and et cetera, you do trust the human-generated code. That's my answer. Like, should you trust AI-generated code? Spit it out. You write a prompt, you wrote a prompt, it gave you a code, trust it? No. I suggest you don't also do that for the most senior developer. You have a process. The process could be quick. And I think that's what we're going to see also for the AI-generated code. You're going to see AI being used to automate more and more and more parts. And then AI-generated code is going to look like more AI-generated code, like AI-generated software development, AI software development, where AI is going to do a proper process. Humans, by the way, in certain percent, which in the beginning would be very big, very large, sorry, are going to be involved throughout the process. And over time, the process is more like, you know, like verifying that the pipeline works, you know, like we do with the manufacturing lab, right? Like it started with human labor and slowly like more and more and more automatic. Humans are still involved there, etc. It took like 50 years to do that. It will take also like 15, 20 years. We talked about predicting for totally be machines. Meanwhile, like I just invented a number like 15 years, like 2041, just to have to guess, like the four in one looks like AI. So I guess it's that's the year for me. But until then, like we're just going to see like more and more portions being automated and maybe some portion like automated end to end. And at that point, you will trust it because it's not just like spitting statistically code. And even if it's trained really, really well, but it's also going to validate itself, verify itself, going through the process, et cetera. And that's the future. That's the future we believe at Coda, right? That's where we focus on code quality, code verification, et cetera. ([Time 0:26:59](https://share.snipd.com/snip/c81e459e-1f9a-42ef-98d2-e888b32c72fd)) - **Prompt Well, But Avoid Overloading Context** - Improve prompts and provide concise, accurate specs to get better AI outputs. - Learn prompting as a skill but avoid assuming huge context always yields better results. Transcript: Itamar Friedman And that's really actually to, for example, what we talked about AWS Kiro and spec driven development. Like we were learning that the better we, the more information should be concise and accurate. But the more information we provide as part of the prompt, if we're talking about software development, like maybe if it's spec, in most cases, the better job it will do. By the way, I am like once in a while, like giving a disclaimer, trying to be careful because there's a lot of research done, for example, on Tropic are really good on it, is that if you think That you can push like as much of context and instruction as you want and expect to really work well they're actually seeing a diminishing return even like worse if you give it like a speck Of like a full book even if the context is bigger but putting that aside it is a really good like idea to learn how to use these tools and i think we're actually consciously inconsciously Like like like doing doing that and and for software development specifically and and I think even JavaScript where the language is maybe not that descriptive, etc. Like having a proper spec is a good idea. And although I have to say that I am not a big believer that spec-driven development is going to be the last thing that survived. It's going to be the big thing that actually makes a difference. ([Time 0:35:55](https://share.snipd.com/snip/de50f457-cd0e-4a8a-8b8d-27f73eb2a227)) - **Progress Is Layered, Not Evenly Smooth** - LLM improvements follow S-curves inside an overall exponential trend; specialization will continue. - Expect domain-focused models and agentic systems to keep advancing practical software automation. Transcript: Itamar Friedman By the way, I think once upon a time, my background in machine learning since 2006. Oh, okay. The neural networks in 2010. So I allow myself to talk about a history. I think once upon a time until roughly speaking, GPT-3, 3.5, every time you train a model, like really like 99% of the cases, you train it to be better than the others in a specific niche. Since GPT 3.5, I think we had like a year or two or more that we're under assumption. Doesn't matter, it's to me or not, the market that, wow, like, look at this. GPT 3.5 winning every benchmark, even human benchmark. If you remember those graphs, amazing graph on OpenAI, it's access to different professions from lawyer stuff to history. And the Y-axis is the percentile on their official tests and like gpd 3.5 like cross every armhole on all of these like forget whatever plans you have this weekend because you're staying Charles Max Wood At home and playing on spin quest and there's never been a better time to sign up than right now new users get 30 coin packs for10. All the table games you love with hundreds of slot games and real cash prizes. That's at spinquest.com. S-P dot com. SpinQuest is a free-to social casino. Void where prohibited. Visit spinquest.com for more details. Speaker 3 A lot can happen in the next three years. Like a chatbot may be your new best friend. But what won't change? Needing health insurance. UnitedHealthcare tri-term medical plans are available for these changing times. Underwritten by Golden Rule Insurance Company, they offer budget-friendly, flexible coverage for people who are in between jobs or missed open enrollment. The plans last nearly three years in some states, with access to a nationwide network of doctors and hospitals. So for whatever tomorrow brings, UnitedHealthcare tri-term medical plans may be for you. Learn more at uh1.com. Itamar Friedman 15 different professions, and then GBD-4 the same, etc. At this point, it's not the case anymore. I think since, roughly speaking, so that's 3.5, if you're familiar from Entropic, etc. Then, and I think that model was suddenly better, some claim much better than GPTs on coding, but probably not at all, and quite a few cases. And now, like there was a moment where I think people thought, only OpenAI and Antropic or whatever, Google are going to generate like foundation models, but I'm seeing dedicated foundation Models in health, medicine, customer success, etc. And we do see GPT-5, for example, and maybe there's newer versions that are coming that are better on specific aspects of software development, like specific in software development. So there is evidence that it's incremental. And I think that's actually somewhat meaning that we're not maturing. I'm not sure if that's what people thought I'm going to say. Like we're maturing. Okay, let's get to those edge cases. Let's get, okay, we probably need a specific LLM and a specific agent for specific quality measures that we want to track or help with, etc. So I think, I think like it doesn't like, it doesn't mean that the whole solution doesn't keep evolving upwards. Right. In the same or even bigger speed, you know, like the famous book, we talked about book like Carteswell, that singularity is near. We're seeing like this notion that we're seeing like exponential growth in technology. But if you're zooming in, then you're seeing like S-curve. And the thing is that each S-curve, the time, the difference between that, each S-curve just gets slower and smaller and smaller. Right. If you zoom out, it looks like exponential. So like, yeah, maybe that specific GPT, sorry, specific LLM attention, architecture, and specific training, et cetera, is slightly like the low-hanging fruits are over. But we are seeing in the agentic world and other technologies, more breakthroughs and I can mention more. And overall, we're gonna see AI keep going upwards. ([Time 0:38:32](https://share.snipd.com/snip/4f7f07ed-afae-412b-9ba4-73aa6bb9d68b))