Five questions to ask a developer who uses AI

Ask who reviews the code, what agents may do, where your code goes, what speed-up is promised and whether they can explain what they deliver. I answer each one myself, after 10 years of web development, the last 3 with AI tools.

Published 13 October 2026 · Jean-Baptiste Thery · EURL jCode

001

001·Question 1

Who reviews the code before it reaches production?

Generated code still fails security tests often. In Veracode's July 2026 report, AI-generated samples passed only 56% of them, a rate almost unchanged in a year.

What a good answer sounds like

Every change is read and tested before delivery, whoever or whatever wrote it, and the project's automated checks must pass.

How I answer

I do, for every change. Where the project has continuous integration, its checks must pass too, and I never weaken one to get a change through.

Source

Veracode, 2026 GenAI Code Security Report, 28 July 2026: veracode.com/news/llms-are-getting-smarter-but-not-safer-veracode-2026-genai-code-security-report-finds-ai-generated-code-security-has-stalled-at-56%25-pass-rate

Back to the questions

002

002·Question 2

What may an agent do without your approval?

With an agent, a coding mistake becomes an action. In July 2025, an agent on Replit wiped a production database during a declared code freeze.

What a good answer sounds like

Nothing hard to undo without approval, and no access to production credentials.

How I answer

Without my explicit approval, my agents do not commit, push, merge, deploy or delete anything, and they never sign in to your services.

Sources

Heise, July 2025: heise.de/-10499597

OWASP, Top 10 for Agentic Applications, 9 December 2025: genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026

Back to the questions

003

003·Question 3

Where does your code go?

Some AI plans train on what you send them. Since 24 April 2026, GitHub uses interaction data from Copilot Free, Pro and Pro+ for training unless the user opts out.

What a good answer sounds like

The name of every service that sees your code, and whether its terms allow training on it.

How I answer

Only where your company's rules allow it: to coding agents such as Claude Code and Codex, through business or API accounts that do not use your code for training. Ragmir indexes and searches locally, but any passage sent to an AI service falls under that service's terms.

Source

GitHub, changelog of 25 March 2026: github.blog/changelog/2026-03-25-updates-to-our-privacy-statement-and-terms-of-service-how-we-use-your-data

Back to the questions

004

004·Question 4

Do you guarantee a productivity gain?

Be wary of a yes. In a randomised trial METR published in July 2025, experienced developers took 19% longer with early-2025 AI tools, yet believed they had been 20% faster.

What a good answer sounds like

No promised percentage. The work itself is priced and checked, whatever the tools.

How I answer

No, and I do not sell one. I quote the work at a fixed price or a day rate.

Source

METR, 10 July 2025: metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study

Back to the questions

005

005·Question 5

Can you explain what you deliver?

Delegating everything erodes understanding. In a randomised trial published by Anthropic in January 2026, developers who learned a library with AI scored 50% on a comprehension quiz, against 67% for those without it.