Reviewing Agent-Written .NET Code: Green Builds Can Still Hide Bugs
Mehdi Mohseni argues that coding agents now write much of the code, but developers still need the judgment to spot code that looks right and is wrong. Using ASP.NET Core examples, he shows how generated code can compile, pass tests and still hide a fail-open security check or a silent misconfiguration. A practical read for anyone reviewing agent output.
Key points
- Turning an exception into an empty result turns an outage into a refusal; model failure states with distinct types
- Make security checks fail closed, and let the app refuse to start when required settings are missing
- Combine ValidateDataAnnotations with ValidateOnStart so missing options fail at host startup
- Write negative tests for outages and misconfiguration, not only for the happy path
- Tests that stub the other side of an integration can hide mismatches; verify the real boundary too
Mehdi Mohseni argues that coding agents now write much of the code, but developers still need the judgment to tell correct code from code that only looks right. He calls the middle ground a narrow sidewalk between refusing agents and trusting them blindly. He cites a METR trial in which experienced open-source developers took about 19% longer with AI tools while believing they had been faster, so gut feeling is a weak measure of agent value.
The core of the piece is a set of .NET examples where generated code compiles and passes its tests yet hides a bug. A permission check that treats a failed lookup as an empty permission set returns 403 during an outage, when it should return 503. A token check that skips validation when its issuer setting is missing trusts every token. The suggested fixes are a discriminated AccessDecision result, ValidateOnStart for options validation, and negative tests for outage and misconfiguration cases.
Real-world use
- An ASP.NET Core API that calls an external permission service and must separate refusals from outages
- Teams whose token validation could be silently skipped by a missing configuration value
- Developers reviewing agent-generated pull requests before they reach production
Why it matters
Agent-written code can pass every check and still be wrong, so reviewers need to test the negative cases and the real integration boundaries themselves.