How to Write Test Cases for Code an AI Agent Wrote

AI coding assistants can write a working function in seconds. The problem is that “it runs” and “it works correctly” are not the same thing. AI-generated code often looks clean and confident while hiding edge-case bugs, wrong assumptions, outdated library calls or security holes. That is why knowing how to test AI-generated code is now one of the most valuable skills a developer, freelancer or vibe coder can have.

This guide gives you a practical, step-by-step testing process that works whether you use GitHub Copilot, Cursor, Claude Code, ChatGPT or any other AI coding tool. It is written for beginners and busy developers alike, with simple checklists you can apply to every change before it ships.

Why AI-Generated Code Needs Extra Testing

AI models predict code that looks right based on patterns they have seen. That makes them fast, but it also creates specific risks:

• Happy-path bias: the code works for the example you gave but fails on empty inputs, unusual values, large data or errors.
• Hallucinated APIs: the AI may call functions, options or packages that do not exist or that changed in newer versions.
• Silent logic errors: an off-by-one mistake, a wrong comparison or a missed condition can pass a quick manual check.
• Security gaps: missing input validation, unsafe database queries or exposed secrets. We cover these in detail in our guide to common security vulnerabilities in AI-written code.
• Confident explanations: AI tools often explain their code convincingly even when it is wrong, which makes it easy to trust too quickly.

The fix is not to stop using AI. It is to treat AI output like code from a fast but junior teammate: helpful, but always tested.

Step 1: Understand the Code Before You Run It

Read the code first. You do not need to understand every line deeply, but you should be able to answer these questions:

• What does this code do, in one sentence?
• What inputs does it expect, and what does it return?
• What external things does it touch: files, databases, APIs, environment variables?
• Did it add new packages or dependencies?

If you cannot answer these, ask the AI to explain the code line by line, then check the explanation against the code yourself. If something seems unnecessary or confusing, ask why it is there. Our guide on how to review AI-generated code before production includes a full review checklist.

Step 2: Check Dependencies and Imports

Before running anything, look at every import and new package:

• Does the package actually exist on npm, PyPI or your language’s registry?
• Is the name spelled exactly right? Attackers publish fake packages with names similar to popular ones, hoping AI tools or developers will install them by mistake.
• Is it actively maintained, with recent releases?
• Is the version compatible with your project?

Only install packages you have verified. When in doubt, ask the AI to solve the problem with libraries you already use.

Step 3: Run It Locally in a Safe Environment

Never test AI-generated code for the first time on a live website or production database. Use:

• A local development environment on your computer.
• A staging site or a copy of your project.
• Test data, never real customer data.
• Version control (Git), so you can see exactly what changed and roll back instantly.

This is especially important when you let AI agents run commands. Our article on the risks of using an AI coding agent on a live WordPress site explains why, and AI coding agent auto-approve mode covers when it is safe to let an agent act without asking.

Step 4: Write Unit Tests (and Let AI Help)

Unit tests check small pieces of code, like a single function, automatically. They are the backbone of testing AI-generated code because you can run them every time the AI makes a change.

AI is actually very good at writing tests. Try a prompt like:

“Write unit tests for this function. Cover normal inputs, empty inputs, very large inputs, invalid types, boundary values and error cases. Use [pytest / Jest / PHPUnit]. Do not change the function itself.”

Then review the tests carefully. AI-written tests can be weak: they sometimes test only the happy path, or assert whatever the current code returns instead of what it should return. A test that checks the wrong expected value just locks in a bug.

Good test frameworks to start with include pytest for Python, Jest or Vitest for JavaScript and TypeScript, and PHPUnit for PHP and WordPress.

Step 5: Test the Edge Cases Yourself

Edge cases are where AI code breaks most often. Always try:

• Empty values: empty strings, empty lists, null or undefined.
• Boundaries: zero, negative numbers, the first and last item, maximum lengths.
• Wrong types: a string where a number is expected, or an object instead of a list.
• Special characters: emoji, accents, quotes, very long text, HTML tags.
• Dates and time zones: leap years, daylight saving changes, different time zones.
• Large data: what happens with 10,000 records instead of 10?
• Failures: what if the API times out, the file does not exist, or the database is down?

Write down what should happen in each case before you test, so you are not just accepting whatever the code does.

Step 6: Run Integration and End-to-End Tests

Unit tests check pieces in isolation. Integration tests check that pieces work together: your code with the database, the API, the payment provider or the email service. End-to-end tests check full user journeys, like signing up, adding to cart and checking out.

• Use tools like Playwright or Cypress for browser-based end-to-end tests.
• Use test or sandbox modes for payment providers and external APIs.
• Test the key flows that make or lose money first.

Even a handful of end-to-end tests for your most important features catches many problems before customers see them.

Step 7: Use Static Analysis and Linters

Automated tools can catch problems without running the code:

• Linters (ESLint, Pylint, Ruff, PHP_CodeSniffer) catch style issues, unused variables and common mistakes.
• Type checkers (TypeScript, mypy) catch wrong data types before runtime.
• Security scanners (Semgrep, CodeQL, Snyk, npm audit, pip-audit) flag known vulnerability patterns and risky dependencies.

Run these automatically on every commit or pull request. They are fast, free or low-cost, and they catch exactly the kind of mistakes AI tends to make.

Step 8: Do a Security Check

For any code that handles user input, logins, payments, files or personal data, check for the basics from the OWASP Top 10:

• Is all user input validated and sanitized?
• Are database queries parameterized (no string-built SQL)?
• Are secrets and API keys kept out of the code and out of Git?
• Are permissions checked on every sensitive action?
• Is output escaped to prevent cross-site scripting (XSS)?

If your app uses AI features itself, also test for prompt injection. Our beginner’s guide to prompt injection explains what to look for.

Step 9: Check Performance

AI code can be correct but slow. Watch for loops inside loops over large data, database queries inside loops (the classic “N+1” problem), loading entire files into memory, and missing caching. Test with realistic data sizes and time the slowest operations.

Step 10: Automate Everything with CI

Continuous integration (CI) runs your tests, linters and security scans automatically whenever code changes. GitHub Actions, GitLab CI and similar tools are free for small projects. Once CI is set up, every AI-generated change gets checked the same way, and nothing reaches production without passing.

A Simple Testing Checklist for Every AI Change

Testing Tips for Non-Developers and Vibe Coders

If you build apps mostly by prompting AI, you can still test well. Our vibe coding beginner’s guide covers the basics, but here are the essentials:

• Ask the AI to write tests for every feature and to run them after each change.
• Keep a simple list of things to click through after every update.
• Use Git, even if you only learn three commands: commit, log and revert.
• Ask a second AI model to review the code from the first. Different models catch different mistakes.
• Get a human developer to review anything involving payments, logins or customer data.

Common Mistakes When Testing AI Code

• Trusting AI-written tests blindly. Review them as carefully as the code itself.
• Testing only what you asked for. AI often changes other files too. Check the full diff.
• Letting the AI “fix” failing tests by changing the test. Make sure it fixes the code, not the expectation.
• Skipping tests for “small” changes. Small AI changes can still break important features.
• Testing on production. Always use local or staging environments first.

A Quick Example

Say you ask an AI to write a function that calculates a discount price. It returns something like price - (price * percent / 100). It works for 100 and 20 percent. But what happens with a discount of 150 percent, a negative price, a percent passed as the text “20”, or a price with many decimal places? A good test list for this tiny function would include:

• Normal case: price 100, discount 20, expect 80.
• Zero discount: expect the original price.
• Full discount (100 percent): expect 0.
• Discount over 100 percent: expect an error, not a negative price.
• Negative price or negative discount: expect an error.
• Decimal prices: check rounding to two decimal places.
• Wrong input type: expect a clear error message.

The AI’s first version would likely fail at least three of these. That is the whole point of testing: small functions can still cost real money when they go wrong.

Frequently Asked Questions

Can AI test its own code?

AI can write and run tests, and that is useful. But it can also write weak tests or adjust tests to match buggy code. Always review AI-written tests and add your own edge cases.

What is the best tool for testing AI-generated code?

There is no single tool. A good setup combines a test framework (pytest, Jest, PHPUnit), a linter, a security scanner and CI automation like GitHub Actions.

How much testing is enough?

Focus on the parts that would hurt most if they broke: payments, logins, data handling and your core features. Aim for strong coverage there before worrying about everything else.

Is AI-generated code safe to use in production?

Yes, if it has been reviewed, tested and checked for security issues like any other code. Untested AI code should never go straight to production.

Final Thoughts

AI makes writing code faster, but testing is what makes it reliable. Understand the code, verify dependencies, test locally, cover edge cases, run linters and security scans, and automate it all with CI. Once this becomes a habit, you get the speed of AI with the confidence of well-tested software. To pick the right tools for the job, compare the best AI pair programming tools next.