AI coding mistakes: 15 ways teams misuse coding agents, and the fixes

The most common AI coding mistakes are vague tasks, no way for the agent to verify its work, bloated context, and merging code nobody reviewed. This guide lists 15 mistakes teams make with coding agents such as Claude Code, Codex and Copilot, explains why each one hurts, and gives a concrete fix you can apply this week.

What are the most common AI coding mistakes?

The most common AI coding mistakes fall into five groups: unclear tasks, messy context, missing verification, unsafe setups and weak team process. Most of them have little to do with which model or tool you use; they are workflow problems, and they show up the same way in Claude Code, Codex, Copilot's agent mode or Cursor.

Here are all 15 at a glance, with the fix for each:

The sections below explain each one.

Task mistakes: how you ask for the work

Most bad agent output starts with a bad task. Claude Code's best practices guide puts it plainly: "Claude can infer intent, but it can't read your mind."

1. Writing vague tasks

"Fix the login bug" forces the agent to guess what the bug is, where it lives and what "fixed" means. It will guess something, fix that, and report success.

Fix: state the symptom, the likely location, the constraints and the definition of done.

Users report that login fails after a session timeout. Look at the authflow in src/auth/, especially token refresh. First write a failing testthat reproduces it, then fix it. Don't change the public API ofAuthService. Done when the new test and the existing auth tests pass.

Our guide on how to write tasks for AI coding agents has templates for features, bugs and refactors.

2. Handing over tasks that are too big

"Build the billing system" produces a 3,000-line diff that nobody can review, built on assumptions you never checked. Big tasks also fill the context window, and quality drops as it fills.

Fix: split work into pieces that each produce a diff you can review in 15 minutes or less: the data model, then the API, then the UI, then the edge cases. Each piece gets its own session and its own pull request.

3. Skipping the plan on complex work

Letting an agent jump straight into code on an unfamiliar, multi-file change often produces a well-written solution to the wrong problem.

Fix: use a read-only planning step first. In Claude Code, press Shift+Tab until plan mode is on (or start with claude --permission-mode plan), ask for a plan, correct it, then let it implement. The docs also note the opposite: "If you could describe the diff in one sentence, skip the plan." Planning a typo fix wastes time.

Context mistakes: what the agent knows

An agent only knows what is in its context window, and Anthropic's context window docs warn that as token count grows, "accuracy and recall degrade." Managing context is managing quality.

4. No project instructions file

Without a CLAUDE.md (Claude Code) or AGENTS.md (Codex and others), the agent rediscovers your build commands every session, runs the wrong test runner and ignores conventions it had no way to know.

Fix: run /init in Claude Code to generate a starter file, then edit it down to what the agent can't infer from the code:

## Commands- Install: pnpm install- Test one file: pnpm vitest run path/to/file.test.ts- Typecheck: pnpm typecheck (run after every change)## Rules- Never edit files in src/generated/; run pnpm codegen instead.- API handlers return Result types; don't throw.- Branch names: feat/<ticket>, fix/<ticket>.

5. Letting the instructions file bloat

The opposite mistake: a 600-line instructions file covering every preference anyone ever had. The best practices guide says bloated files "cause Claude to ignore your actual instructions" because important rules get lost.

Fix: for each line, ask whether removing it would cause mistakes; if not, delete it. Move rarely needed knowledge into skills that load on demand, and turn must-always-happen rules (formatting, blocking writes to a folder) into hooks, which run every time instead of being advisory. See CLAUDE.md best practices for structure and length.

6. Running the kitchen sink session

You start on a bug, ask an unrelated question, review some other file, then go back to the bug. The context now holds three topics, and the agent mixes them up.

Fix: one task per session. Use /clear between unrelated tasks, and delegate wide exploration to subagents, which read files in their own context and return a summary.

7. Correcting the same mistake over and over

The agent gets it wrong, you correct it, it gets it wrong differently, you correct again. Each failed attempt stays in the context and pulls the next attempt toward it.

Fix: follow the rule from Anthropic's guide: after two failed corrections on the same issue, run /clear and start again with a better first prompt that includes what you learned. A clean session with a precise prompt beats a long session full of failed approaches.

Verification mistakes: how you know it works

This group causes the most shipped bugs. An agent's summary ("All tests pass, the feature is complete") needs evidence behind it before you trust it.

8. Giving the agent no way to verify its work

Without a check it can run, an agent stops when the code looks finished. The best practices guide calls this the single most valuable thing to set up: give Claude "a check it can run: tests, a build, a screenshot to compare."

Fix: put a runnable check in every task: specific test cases, a build command, a script that compares output to a fixture, or a screenshot to match. Ask the agent to show evidence (the command it ran and the output) rather than asserting success. For unattended runs, enforce it with a Stop hook or a goal condition so the run can't end while the check fails.

9. Merging without reading the diff

Teams that trust green CI and a confident summary end up with dead code, duplicated helpers, silent behavior changes and edits to files nobody asked about.

Fix: review every AI-written diff like a pull request from a capable new colleague:

• Does it do what the task asked, and nothing else?
• Are there changes outside the stated scope?
• Did it delete or weaken a test, add a try/catch that swallows errors, or suppress a lint rule?
• Would you understand this code in six months?

An AI reviewer in a fresh context (a subagent, or a separate session) is a useful first pass because it isn't biased toward code it wrote moments ago, but it doesn't replace your review. See AI code review for setups that work.

10. Accepting tests that test nothing

Agents asked to "add tests" can produce tests that mirror the implementation, mock everything or assert that a function returns what it returns. Coverage goes up while the tests catch almost nothing.

Fix: specify the cases yourself ("logged-out user gets 401; expired token triggers refresh; refresh failure logs out"), ask for a failing test before the fix, and occasionally break the code on purpose to confirm the tests fail. Our guide to writing unit tests with AI covers this in depth.

Safety mistakes: where and how agents run

Coding agents run real commands with real permissions. These mistakes turn a bad suggestion into a real incident.

11. Ignoring security in AI-written code

Models write code that works before code that's safe. Veracode's 2025 GenAI Code Security Report tested more than 100 models on 80 coding tasks and found they chose the insecure option 45 percent of the time; it also reported that security performance had not improved as models got better at syntax.

Fix:

• Run static analysis and dependency scanning on every pull request, AI-written or not.
• Ask for a security-focused review of changes touching auth, input handling, file paths, SQL or secrets.
• Check that new dependencies exist and are the packages you expect; models sometimes suggest names that don't exist or are misspelled.
• Keep secrets out of the repository and out of prompts.

More detail is in is AI-generated code safe.

12. Skipping permissions on your main machine

Approving everything automatically (for example Claude Code's --dangerously-skip-permissions) on a laptop that holds production SSH keys and cloud credentials means one bad command, or one instruction hidden in a README or issue, can do real damage.

Fix: on your own machine, keep approvals on, pre-approve safe commands with an allowlist, and enable sandboxing where the tool supports it. Run fully autonomous agents in a container, VM or separate server that holds only development credentials.

13. Running parallel agents in one checkout

Two agents editing the same working directory overwrite each other, run tests against each other's half-finished changes and commit to the same branch.

Fix: give each agent its own git worktree and branch. Claude Code does this with claude --worktree <name>, which per its worktree docs creates the checkout under .claude/worktrees/ on its own branch. Pick parallel tasks that touch different parts of the codebase, and merge them one at a time.

Process mistakes: how the team works

Individual habits don't scale without shared rules. These two mistakes show up once a whole team uses agents.

14. Having no team rules for AI-written code

Without shared rules, one developer merges agent output unread, another bans it, and reviewers don't know what to expect. Large AI-generated pull requests land on reviewers with no context about how they were produced.

Fix: agree on a one-page standard:

1. The author is responsible for every line, however it was written, and can explain it.
2. Pull requests stay small; agent-generated changes over a size limit get split.
3. The PR description says what the agent did and how it was verified.
4. Security-sensitive areas always get a human reviewer who knows the code.
5. The shared CLAUDE.md or AGENTS.md lives in git and is reviewed like code.

15. Not measuring cost or results

Teams often know their AI subscription bill but not what it bought. Without measurement, you can't tell whether agents save time, which tasks they do well, or whether one runaway session burned a week of budget.

Fix: track a few numbers per project: spend, pull requests merged, rework (follow-up fixes to AI-written changes) and review time. Cost per merged pull request is a useful single metric; our guide to measuring AI ROI for engineering teams shows how to report it.

How to fix these AI coding mistakes this week

Pick the three that hurt you most and start there. A practical order:

1. Add verification to every task. No acceptance criteria and runnable check, no agent run.
2. Trim your instructions file to commands, rules and gotchas the agent can't infer.
3. Adopt one task per session and /clear between tasks.
4. Review every diff with the four questions under mistake 9.
5. Move autonomous runs off your laptop into an isolated environment with development credentials.
6. Use worktrees before running a second agent in parallel.
7. Write the one-page team standard and put it next to your contributing guide.
8. Start tracking cost per merged pull request.

If you want agents to run unattended without tying up your laptop, Orkio rents an isolated, always-on cloud box where agents like Claude Code work on your own Claude account, and its Insights view shows spend per project, per model and per merged pull request.

Frequently asked questions