Home · Business · IT, Data & Security · Software development

YES

As of 13 August 2026, AI can find bugs in your code.

This still needs a person who signs their name to it.

Can you do it?

5 minutesto a draft.

30 minutesto something you’d act on.

Cost, all in£0

Skill neededpower-user

Who has to check ita colleague

What the alternative costsGitHub Copilot is an AI pair programmer inside your editor and GitHub; the supplied tools data does not state a price for it.

If this goes wrong: you accept a plausible but incorrect fix and introduce a production outage, data loss or security weakness.

What to actually do

  1. Hand it to a person

    The route this page recommends

    A person who owns the outcome does this end to end, worth it when the failure is dear.

  2. Use a tool built for this

    Second choice

  3. Do it yourself

    The distant third

    A chat interface, power-user skill, and roughly 30 minutes until you can act on the result.

    How to actually do it

    1. Open the relevant source files, test files and dependency or runtime configuration, then remove secrets, access tokens, customer data and other private information.
    2. Write down the expected behaviour, the language and version, the command that runs the code, and any error message, failing test or input that reproduces the problem.
    3. Paste the prompt and the smallest complete code path into an approved chatbot, including related functions, data structures and existing tests that affect the suspected bug.
    4. Ask the model to separate confirmed defects from suspicions, and save its proposed reproductions, patches and tests without applying the patch directly to the main branch.
    5. Run each proposed reproduction and test in an isolated branch or development environment, compare the result with the expected behaviour, and inspect every changed line with a colleague before merging.

    Prompt

    Act as a careful code reviewer. Analyse the code below for defects, including incorrect logic, edge cases, error handling, security issues, performance problems and failures caused by assumptions about inputs or the runtime. Do not invent missing files, APIs or requirements. First state what the code is intended to do based only on the information provided. Then produce a table with: severity, exact location, likely defect, why it is a defect, a minimal reproduction or failing input, and a proposed fix. Separate confirmed problems from suspicions. Do not propose a fix unless you can explain the behavioural change it makes. Preserve the existing public interface unless a change is necessary. After the table, write focused tests that would distinguish each suspected bug from expected behaviour. Flag anything that requires checking against the real environment, dependencies, database, configuration or business rules. Code language and version: [language and version]. Expected behaviour: [description]. Error message or failing test: [details]. Relevant constraints and security requirements: [details]. Code: [paste code here].

    Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.

What it gets wrong

  • AI cannot see defects that depend on production traffic, private configuration, undocumented dependencies or state you did not provide.
  • It reports plausible bugs that are actually valid business rules when the requirement is ambiguous.
  • It cannot prove that a patch is safe across your full test suite, deployment process and real data.
  • It does not carry responsibility for an outage, data loss or security incident caused by its suggestion.
  • It cannot replace threat modelling, code ownership or a specialist security review for high-risk changes.

Even on a YES, the friction has a name: verification cost, judgement under ambiguity and stakes of error.

How we scored this

Five axes, each scored nought to two by hand: ten means AI carries the task cleanly, and the thresholds that turn a total into YES, PARTLY or NO are published in the methodology. Each axis name links to its definition.

AxisScore (0–2)
Output2
Inputs2
Verification1
Liability1
Effort delta2
Total8 / 10

The methodology and its thresholds are published in full.

FAQ

Can ChatGPT find bugs in my code?
Yes, it can identify likely defects, explain them and suggest tests or patches when you provide the relevant code and expected behaviour. Run the suggested tests and have a developer check findings that affect security, concurrency or business rules.
Can AI fix bugs in my code?
It can propose a fix and generate a focused regression test. Apply changes in a separate branch, run the project test suite and inspect the diff before merging because a fix can introduce a different defect.
Is it safe to paste my code into AI?
Only use an approved tool and remove secrets, credentials, personal data and confidential business logic unless your organisation permits that data to be shared. Check your employer's security and data-handling rules before uploading source code.
Can AI find security bugs in my code?
It can flag common issues such as unsafe input handling, weak access checks and exposed secrets, but it cannot provide complete assurance. For an important or internet-facing system, a developer with security expertise should verify the findings and test the deployed environment.

Nearby answers

All Software development rulings

Assessed by gpt-5.6-luna (gpt-5.6-luna) on 2026-08-13, second-checked by an independent model. Wrong somewhere? Email [email protected] and it gets re-checked.

The newsletter

AI news, new answers and product picks, straight to your inbox.