Handling AI-Generated Code: Challenges & Best Practices • Roman Zhukov & Damian Brady

Concise summary — handling AI-generated code (challenges, practices, tooling)

High-level points

• AI-assisted development amplifies developer productivity but does not replace human responsibility. It can speed many tasks but may slow end-to-end delivery for complex features.

  Participants cited research that developers felt about ~20% faster with AI but were ~19% slower on complex deliveries.

• Responsibility remains with human developers. Current law and practice treat AI systems as non‑authors; committers are accountable for quality, security, and licensing.

• Practical problems — quality, security, and supply-chain risk — are not new but are happening at larger scale and with increased opaqueness because of large language models (LLMs).

Key technological concepts and product/features discussed

• GitHub Copilot and related features
  • Copilot coding agents that can create or change multiple files.
  • Copilot Code Review — used internally at GitHub; Copilot agent described as a top contributor to some repos.
  • Agent-based workflows: agent-produced work should be submitted and tracked as pull requests with traceability (for example, “committed by Copilot agent on behalf of X”).
• VS Code / Microsoft
  • Microsoft moved Copilot extension work into product and open sourced parts of it.
• LLMs vs domain-specific developer tools
  • Raw LLMs (chat-style) are more brittle and non-deterministic.
  • Specialized developer-focused tools add filters, responsible-AI tests, and organization-level controls to reduce risk.
• Model and data provenance
  • Need metadata and verifiable artifacts attached to training data, models, and AI applications — analogous to software provenance.
  • Use model cards and AI system cards (a nutrition-label idea) to document datasets, architecture, operational environment, and security posture.
• Security and supply-chain risk examples
  • Hallucinated or malicious packages (for example, a fake package suggested and ingested).
  • Hidden malicious content in models or artifacts.
  • Risk increases when developers pull models or artifacts from hubs (e.g., Hugging Face) without inspection.
• Prompting and “human in the loop” patterns
  • Better prompts, examples, and iterative challenge/verification improve outputs (ask the model to explain security implications, use bounded functions, etc.).
  • Custom instructions and agent files (agents.md or org-level instructions) help enforce organizational standards.

Practical process recommendations and best practices

• Traceability and disclosure
  • Document when code is AI-assisted (use “assisted by” disclaimers) and track agent contributions in PRs.
• Maintain standard software engineering controls
  • Keep code reviews, automated builds/tests, security audits, and CI/CD gates regardless of the code’s source.
• Education and developer guidance
  • Train developers (particularly juniors) on secure prompt design, how to verify AI outputs, and safe use of AI tools.
• Use curated tools and org-level policies
  • Prefer developer-focused AI tooling with safety filters and the ability to inject organizational prompts/standards over raw LLM use.
  • Define org/enterprise-level prompts and guardrails (for example, pre-approved crypto libraries, banned packages).
• Legal and ethical standards
  • Do not present substantially AI-generated output as purely your own work; follow licensing and IP rules.
• Apply zero-trust thinking
  • Assume artifacts/models could be compromised; verify provenance and integrity before use.
• Contribute to and use community standards
  • Adopt and contribute to shared guidance and standards (for example, OpenSSF recommendations).

Guides, reviews, tutorials, and resources mentioned

• Red Hat blog: guidance on “navigating legal issues while accepting AI-assisted code contributions” (public).
• OpenSSF (Open Source Security Foundation): free AI secure development practices guidance and checklist (search “OpenSSF AI secure development practices”).
• Org-level agent instructions / agents.md files (e.g., Claude agents) — recommended to codify project constraints and safety rules.

Emerging role and skill impact

• Shift from purely coding/syntax tasks toward higher-level system architecture, verification, prompt engineering, and review skills.
• Need for industry-wide training so developers can safely get value from AI tools; spec-driven or prompt-driven workflows are emerging.

Speakers and sources

• Roman Zhukov — cybersecurity expert, Red Hat (open-source security strategy)
• Damian Brady — GitHub (formerly Microsoft), developer and AI-assisted development tooling advocate

Podcast / context

• Source: GoTo / GoTo Unscripted podcast — a conversation about responsible adoption of AI in developer workflows.