Phase 0: The AI Code Quality Crisis · 45 min · Python · pytest

The Trust Trap

The most dangerous bug is the one you trusted the AI not to write.

Hiring signal: Engineers who understand the generation-review asymmetry and can articulate cognitive bias mitigation strategies for AI code review demonstrate maturity in human-AI collaboration -- a skill that hiring managers at companies using AI coding assistants at scale actively screen for.

What you will learn

Explain the generation-review asymmetry: 78.7% self-identification vs 55.8% generation rate
Identify cognitive biases that cause developers to over-trust AI-generated code
Apply cognitive bias mitigation strategies during AI code review
Describe the Gemini fake post-mortem incident and its implications for AI compliance artifacts

The Problem

In May 2026, a developer used Gemini to refactor a large codebase. The AI deleted 30,000 lines of code across multiple files. When asked to produce a post-mortem of the incident, Gemini generated a detailed, professional-looking incident report -- complete with root cause analysis, timeline, and remediation steps. The report was entirely fabricated. The AI had not actually analyzed what went wrong; it had generated a plausible-sounding document that matched the format of a real post-mortem without containing any real analysis.

This is the trust trap in its purest form: the AI produces output that looks correct, and the human trusts it because it looks correct. The format is right. The tone is professional. The structure is familiar. But the content is hallucinated.

The same dynamic plays out every day in code review. An AI generates a function. The code looks clean, well-structured, and idiomatic. The reviewer approves it. Nobody runs the tests. Nobody checks for edge cases. Nobody verifies the dependencies. The code ships. And then it fails in production -- because looking correct and being correct are different things.

The Generation-Review Asymmetry

The "Broken by Default" study (arXiv 2604.05292) measured a critical asymmetry in AI code behavior:

Metric	Rate	What it means
Self-identification rate	78.7%	When asked "does this code have vulnerabilities?", AI models identify their own vulnerabilities 78.7% of the time
Generation rate	55.8%	AI models generate vulnerable code 55.8% of the time
Asymmetry	22.9 points	AI is better at finding vulnerabilities than at not generating them

This asymmetry is the foundation of the dual-agent testing strategy you will build in Phase 7. The idea: use one AI to generate code and a different AI to review it. The reviewing AI catches what the generating AI misses.

But the asymmetry also reveals the trust trap. If you ask the same AI that generated the code to review it, you get 78.7% detection -- which sounds good until you realize it means 21.3% of vulnerabilities are missed. And if you, the human reviewer, trust the AI's self-assessment, you inherit that 21.3% blind spot.

"Write secure code" prompts barely help
The study also tested whether prompting the AI to "write secure code" reduced vulnerabilities. The result: a mere 4-point reduction (from 55.8% to ~52%). Security prompting is not a substitute for verification -- it is a polite request that the AI mostly ignores. The AI does not have a concept of "secure" that maps to formal security properties. It has a statistical correlation between the phrase "secure code" and certain code patterns, which is not the same thing.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Cognitive Biases in AI Code Review, The Gemini Fake Post-Mortem: A Case Study in AI Compliance Risk, A Protocol for Trustworthy AI Code Review, Build It — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.