Test and Secure AI-Generated & Unknown Code — Practical Developer Workflow

Introduction

As AI code generation and large dependency graphs become standard parts of developer workflows, teams increasingly face the question: how do you test and ship code when you don’t fully know what’s inside it? Recent conversations about code-generation, supply-chain risk, and exploit automation make this a central, practical problem for engineers.

This guide gives a repeatable workflow you can apply today to vet AI-generated or otherwise unknown code, with actionable examples for local checks, CI gates, and runtime protections.

Why this matters

Speed vs. trust: AI tools accelerate code creation but can introduce subtle bugs or insecure defaults.
Supply-chain risk: Third-party packages and generated snippets may include vulnerable patterns or unexpected transitive dependencies.
Testing gaps: Traditional tests assume human-written contracts — generated code requires extra validation and isolation.

Core risks to address

Unintended logic errors and edge cases in generated functions
Insecure defaults (e.g., missing input validation, unsafe deps)
Malicious or poorly licensed code pulled from external sources
Hidden transitive dependencies that introduce vulnerabilities

A practical, repeatable workflow

Treat new/generated code as untrusted by default.
Require a short human review and automated checks before merging. Surface diffs and include a one-paragraph rationale for generated changes in the PR description.

Automated static checks and linters first.

Run linters, type checks, and security linters as pre-commit hooks and CI steps. These are fast and catch many obvious issues.

Example: a pre-commit Python script that runs ruff and mypy.

#!/usr/bin/env python3
import subprocess
import sys
 
checks = [
    ["ruff", "check", "."],
    ["mypy", "--ignore-missing-imports", "src"]
]
 
for cmd in checks:
    print("Running:", " ".join(cmd))
    r = subprocess.run(cmd)
    if r.returncode != 0:
        print("Pre-commit checks failed")
        sys.exit(r.returncode)
print("Pre-commit checks passed")

Sandbox and run targeted unit tests before integration.

Isolate generated functions in small testable modules and add unit tests that express both nominal and edge behavior.

Example: imagine an AI-generated function that parses a date string. Add tests for expected formats and invalid inputs.

def parse_iso_date(s: str) -> tuple:
    # AI-generated implementation (treat as untrusted until tested)
    parts = s.split("-")
    return int(parts[0]), int(parts[1]), int(parts[2])
 
 
def test_parse_iso_date_valid():
    assert parse_iso_date("2025-12-31") == (2025, 12, 31)
 
 
def test_parse_iso_date_invalid():
    try:
        parse_iso_date("not-a-date")
        assert False, "should raise"
    except Exception:
        assert True

Running these tests early prevents incorrect assumptions from leaking into higher-level code.

Dependency hygiene: pin, lock, and audit.

Always use lockfiles, pin direct dependencies, and run an SCA (software composition analysis) scan. For JavaScript projects, include an audit step; for Python, run pip-audit or similar.

{
  "scripts": {
    "pretest": "npm audit --audit-level=moderate || true",
    "ci-test": "npm test"
  }
}

Make the audit step fail CI for high/critical findings. Consider automated PRs for dependency updates (Dependabot, Renovate) but gate those with the same tests.

Use SBOMs and provenance metadata.
Generate a Software Bill of Materials for the build artifact and include information about any AI tool used to generate code. This helps incident investigations and compliance.

Property-based and fuzz testing for parsers and inputs.

When generated code handles inputs (parsers, serializers, deserializers), property-based testing (Hypothesis for Python) or fuzzing can find edge-case crashes faster than example-based tests.

from hypothesis import given, strategies as st
 
@given(st.text())
def test_no_crash_on_random_input(s):
    try:
        parse_iso_date(s)
    except Exception:
        # OK: function should not crash the test runner or exhibit unsafe behavior
        pass

CI gating and policy-as-code.
Enforce gates in CI: lint/type/security checks, test coverage lower bounds, and SCA thresholds. Encode these policies so they’re consistent and auditable.
Runtime defenses and monitoring.
Apply runtime controls for critical paths: sandboxing (containers, seccomp, AppArmor), input validation, rate limiting, and behavioral monitoring. Add error budgets and alerting for anomalous failures introduced after a generated change.

Concrete example: vetting an AI-generated npm helper

Scenario: an AI assistant suggests a new helper that reads a URL, fetches JSON, and returns a value. Before merging:

Run lint and unit tests locally and in CI.
Review the diff for network calls and unsafe evals.
Ensure dependency lockfile is updated and audited.
Isolate network calls in a wrapper so tests can mock them.

Example: wrap fetch in an adapter and add a unit test that mocks the adapter instead of making network requests.

// httpAdapter.js
module.exports = {
  fetchJson: async function (url) {
    const res = await fetch(url);
    if (!res.ok) throw new Error('fetch failed');
    return res.json();
  }
}
 
// helper.js (AI-generated uses adapter)
const { fetchJson } = require('./httpAdapter');
 
async function getValue(url, key) {
  const data = await fetchJson(url);
  return data && data[key];
}
 
module.exports = { getValue };

Tradeoffs

Time vs. safety: Extra checks add latency. Mitigate with parallel CI and fast pre-commit checks.
False positives: Security scanners sometimes create noise. Use risk thresholds and triage workflows.
Developer friction: Rigid gating slows iteration. Balance by making non-critical paths more permissive while strictly protecting critical services.

Checklist you can adopt today

Require a short human review for generated code changes.
Run linters, type checks, and SCA in pre-commit and CI.
Write unit tests for generated modules before integration.
Use lockfiles and fail CI on critical SCA findings.
Sandbox risky operations and add runtime monitoring.

Conclusion

AI-generated and unfamiliar code are here to stay. Treat new code as untrusted until it's proven: fast automated checks, focused unit tests, dependency hygiene, and runtime controls form a practical, repeatable workflow that balances velocity and safety. Start small (pre-commit hooks and isolated unit tests) and expand policies into CI and monitoring as you gain confidence.

How to Test and Secure AI-Generated and Unknown Code: A Practical Developer Workflow