An AI code review checklist: 7 risks to check
By the AgentReceipt team · Updated 13 November 2026
Reviewing code an AI agent wrote is different from reviewing a colleague’s. The agent does not get tired, but it also does not know which shortcuts your team would never accept. These seven checks catch the problems that show up most.
1. Secret-like values
Look for keys, tokens, passwords and connection strings in the diff and in the prompt. Agents copy values from files they read. If you find one, treat it as leaked and rotate it.
2. Weakened tests
Check whether tests were deleted, skipped, or made easier to pass. A green build is no comfort if the agent got there by removing the checks.
3. Disabled checks
Watch for changes to linting, type checking or CI settings, and for comments that switch a check off. These are quiet ways to make a problem disappear.
4. New dependencies
A new package is new code you now trust. Ask whether it is needed, whether it is maintained, and whether the name is exactly the one you meant.
5. Sensitive paths
Give extra attention to anything touching authentication, payments, database migrations or infrastructure. Mistakes there are costly and hard to undo.
6. Scope drift
Compare the files changed with what you asked for. If you asked for a button label and the diff touches the billing module, stop and find out why.
7. Oversized changes
A very large diff is hard to review properly, so problems hide in it. Ask the agent to split the work, or review it in pieces.
Let a tool do the first pass
AgentReceipt checks for exactly these seven things with fixed rules, and puts the result in a receipt for each session, with the reason for each flag. You still review the code; the receipt tells you where to look first.
agentreceipt check