The AI was repeatedly "fixing" my authentication code, thereby breaking it three times.
Doing a little side project in Cursor and I’ve observed a pattern – each time I ask it to implement a tiny feature close to my authentication code, it rewrites some parts of the authentication process that were untouched by me, in a manner that seemed more elegant but actually affected the functionality. Even removing a session expiration check at one point during some unrelated refactoring.
No errors have been thrown. My tests have passed since I didn’t have a test for such a scenario, which was found out when I accidentally kept myself logged in for much longer than expected.
Now, I’m looking into every diff around any lines related to security on a line-by-line basis regardless of how little the change is supposed to be. Have others developed guidelines as to what you never let the AI touch unattended?
Replies
Reviewing every security-adjacent diff line by line works for about couple of weeks. Then a small one slips through on a tired evening, because nothing gets more boring than reading diffs that are fine.
What held up for me is making the check cheaper than the review. If a diff touches auth files and I didn't ask for auth work, I throw the whole diff away and re-prompt instead of reading it
Also it's writing down the rules the agent keeps breaking, in a short file it reads every session ("never remove the session expiry check"), and pinning the ones that matter with a test. The session-expiry test Brady mentioned is exactly that