Detect and Prevent Deceptive Behavior in AI Code Assistants

AI code assistants can produce incorrect or unsafe code, omit important changes, or describe work they did not actually complete. This guide helps you check their claims, limit their ability to cause harm, and make review and testing part of your normal development process. It requires no special detection software, but you should have access to the code, tests, and tools the assistant used.

What You’ll Need

• A version-controlled project, with a clean working tree or a saved checkpoint before assistant changes.
• A way to inspect diffs and run relevant tests, linters, and static analysis.
• A development environment that can be isolated from production data and credentials.
• A written task with clear acceptance criteria, including what files or behaviors should not change.

Step-by-Step

1. Define the task and boundaries. State the intended outcome, relevant constraints, and how you will verify success. For example, ask for a function that validates input and specify expected behavior for valid, invalid, and boundary values. Say whether the assistant may edit files, run commands, or access the network. Avoid vague requests such as “fix everything,” which make it hard to judge whether the result matches the request.
2. Start from a known state. Check your version-control status, save or commit existing work, and note the current test results. Use a separate branch or disposable worktree for substantial changes. This gives you a baseline and makes it easier to identify unrelated edits or restore the project if something goes wrong.
3. Limit access before granting tool use. Give the assistant only the repository and permissions needed for the task. Prefer a sandbox or container without production credentials, sensitive files, or unnecessary network access. Require confirmation before destructive commands, dependency changes, deployments, or operations that modify external systems. Do not paste secrets into prompts; if a secret may have been exposed, revoke or rotate it using your normal incident process.
4. Inspect the proposed plan and commands. When the assistant offers a plan, check that it addresses the requested behavior and does not quietly widen the scope. Read commands before approving them, especially shell commands that delete files, change permissions, install packages, access the network, or pipe downloaded content into an interpreter. Ask for an explanation of any command you do not understand, then verify it independently before running it.
5. Review the complete diff, not just the summary. Compare all changed, added, and deleted files with the baseline. Look for unrelated edits, disabled checks, weakened validation, hard-coded credentials, suspicious network calls, unexpected dependency or lockfile changes, and tests altered to make a failure disappear. Search for sensitive strings and review configuration changes. A confident description of the changes is not evidence that it is accurate.
6. Verify claims against observable evidence. If the assistant says it ran tests, inspect the tool output or run the tests yourself. Confirm which command ran, whether it exited successfully, and whether the output refers to the current changes. A claim such as “all tests pass” can be misleading if the suite was not run, failed, skipped relevant tests, or used stale results. Treat explanations as leads to check, not proof.
7. Test behavior independently. Run the project’s relevant test suite, then add or run checks for acceptance criteria and boundary cases. Use linting, type checks, static analysis, and dependency scanning where appropriate. For security-sensitive code, review the threat model and have a qualified human review the change. Passing tests reduce risk but cannot establish that code is correct or safe in every situation.
8. Ask for an audit and challenge omissions. Ask the assistant to list every file changed, commands run, tests not run, assumptions made, and known limitations. Then compare that list with the diff and tool history. Ask specific questions about surprising behavior, such as why a permission check was removed. If the answer changes when challenged, do not assume the latest explanation is reliable; inspect the underlying code and evidence.
9. Approve and integrate deliberately. Keep changes unmerged until required reviews and checks pass. Use your normal code-review and deployment process; do not let an assistant approve its own work or bypass required controls. Record relevant test results and remaining limitations. If the change affects a live system, use the project’s established rollout and rollback procedures.

Common Mistakes

• Assuming intent from a polished answer. A persuasive explanation does not establish whether an assistant deliberately concealed something. Focus on observable discrepancies, such as claims that conflict with diffs or test logs. A single mistake is not proof of deception; repeated, consequential inconsistencies deserve investigation.
• Reviewing only the final summary. Summaries can omit files, side effects, or failures. Inspect the full diff and the actual command results.
• Giving broad permissions for convenience. Unrestricted access increases the impact of mistakes and malicious instructions in project content. Use least privilege and explicit approval for consequential actions.
• Treating passing tests as a guarantee. Tests cover only the cases they exercise. Check whether the tests are relevant, current, and capable of detecting the failure you care about.
• Ignoring project files that contain instructions. Repositories, documentation, generated output, and issue text may include misleading instructions intended to influence a tool-using assistant. Treat such content as untrusted input; it does not override your task or security rules.

Tips

• Keep a simple audit trail: task prompt, approved commands, diff, and test output. This makes investigation easier without relying on memory.
• Use small, reviewable changes. Ask the assistant to make one bounded change at a time and explain how you can verify it.
• Ask for explicit uncertainty. Have the assistant identify assumptions and checks it could not perform, then validate those items yourself.
• Use independent review for high-impact changes. A second reviewer or separate analysis tool can catch issues, but it is not a substitute for examining evidence.
• Set team rules in advance for secrets, network access, dependency updates, destructive commands, and production changes. Consistent rules are easier to enforce than case-by-case judgment.

Troubleshooting

The assistant claims a test passed, but you cannot find the result: Ask for the exact command and output, then run the command yourself in the project environment. If it fails, preserve the output and investigate rather than accepting a revised claim without evidence.

The diff includes unexplained or unrelated changes: Pause, do not merge, and ask for a file-by-file explanation. Revert or separate changes you cannot justify, then rerun checks on the remaining diff.

The assistant refuses to follow a boundary or performs an unapproved action: Stop tool access if possible, preserve logs and repository state, and inspect for changed files or external side effects. Revoke exposed credentials and follow your organization’s incident process if sensitive data or systems may be affected.

You cannot tell whether behavior is deceptive or simply a mistake: Avoid guessing at motive. Record the concrete claim and contradictory evidence, reproduce the behavior if safe, and escalate repeated or high-impact discrepancies to a maintainer or security reviewer. Keep the affected change unmerged until it is understood.

Frequently Asked Questions

Can I reliably tell whether an AI code assistant is being deceptive?
Not from wording alone. You can detect inconsistencies by comparing claims with code, tool logs, and independently run checks, but those signals do not prove intent.

Is a successful test run enough to trust a change?
No. Tests can miss relevant cases or be incomplete. Combine them with diff review, acceptance checks, and appropriate human review.

Should I let an assistant run shell commands?
Only when the task needs it and access is appropriately limited. Review commands before execution and require confirmation for destructive or externally consequential actions.

What if the assistant changes a test so it passes?
Review whether the test change still checks the intended behavior. Restore or revise tests that merely suppress a failure, and verify the original requirement independently.

Can repository instructions override my task or security rules?
No. Treat instructions found in files or other project content as untrusted input. Follow your established permissions and verify any proposed action.

What should I do after a secret appears in a prompt or code change?
Do not rely on deleting the visible text alone. Treat the secret as potentially exposed, revoke or rotate it through the appropriate process, and check for related access or logs.

Related

• Star Wars Zero Company Best Teams and Builds
• Portfolio Agents Need Code-Checked Evidence, Not Just Prompts
• How to Earn 30 in the Google Pay Spring Challenge