Do not review a large AI-generated change as one block. Ask for it to be split into small, independently deployable pieces, run automated checks on each, and spend human attention on the parts that touch authentication, data and dependencies. DORA's research points to small batches as the countermeasure.
What DORA says
DORA's small batches page says AI adoption often leads to increased software delivery instability, and that working in small batches acts as a critical countermeasure so that faster generation turns into value rather than chaos. It also says AI is good at generating large blocks of code quickly, but large changes are difficult to review, test and integrate safely. It recommends focusing the developer on decomposition and verification rather than raw generation.
For security, the risk is that a big diff gets approved because it looks plausible.
A review plan
- Split first. If a pull request is large, send it back with a request to split it by behavior. A good split lets each part deploy alone.
- Run machine checks before human review. Dependency checks, static analysis and tests should be green before anyone reads the diff.
- List new dependencies. AI tools sometimes add packages. Check each new one: does it exist, is it maintained, is it the one intended?
- Read the risky paths. Identify files touching login, permissions, payments, data export, file handling and external calls, and review those line by line.
- Check the tests. Generated tests may only assert what the generated code does. Ask whether any test would fail if the security behavior were removed.
- Look for removed checks. Compare what validation or authorization existed before.
What to look for
| Pattern | Why it matters |
|---|---|
| New package you did not request | Supply chain risk |
| Broad exception handling that swallows errors | Hides failed security checks |
| Disabled certificate or signature checks | Often added to make tests pass |
| Hardcoded test credentials | May reach production |
| Wider permissions than needed | Common shortcut |
Set a size policy
Pick a pull request size above which human reviewers may decline to review until it is split. Make the rule team-wide, so nobody feels they are being difficult. Track median size and the share of oversize pull requests.
What to measure
DORA's metrics help here. Watch change fail rate and deployment rework rate after AI use rises. If instability climbs, batches are probably getting bigger. See our related post on DORA metrics for teams using AI assistants.
Quick check
Is AI generated code less secure by default?
This post does not claim that. The point is that large changes are harder to review, whoever writes them.
Can an AI tool review its own output?
It can help find issues, but it should not be the only reviewer. Keep a human on security-sensitive paths.
Try it yourself
Click through it at your own pace, or open it full screen.
See how code findings are reported with location and detail, the kind of automated pass to run before human review.
How Safeguard fits
Safeguard offers dependency scanning, policy gates and an MCP Guardrail for agent tool use, which help check what AI-assisted changes bring in. Try a free scan at gold.safeguard.sh/scan.
Sources
- DORA, Working in small batches: https://dora.dev/capabilities/working-in-small-batches/
Last reviewed: 19 October 2026.
