Every AI coding tool has a signature failure pattern. After enough audits, you start recognizing which tool built something just from what's wrong with it.
July 8, 2026 · 5 min read
After enough AI codebase audits, a strange thing happens: you can often guess which tool built an app before anyone tells you. Not because the code is bad (usually it isn't, not exactly), but because each tool leaves a signature. A specific shape of thing that goes wrong. Here's what I mean, tool by tool.
Cursor's agent mode is the one I most associate with duplicated logic. It edits fast and it edits wide: a single prompt can touch a dozen files, and on anything larger than what fits in its context window, it will occasionally write a new version of a helper that already exists three folders over. I've seen the same validation rule implemented three different ways in the same app, each with a slightly different bug, because three different prompts each solved the same problem in isolation.
Claude Code's tell is different: everything looks finished. It writes clean, well-organized code with sensible names and a coherent structure, which is exactly why it's easy to miss the one integration that's actually a mock with a TODO comment above it. On a long session, I also watch for drift: a pattern set early gets quietly reinterpreted by the end, because the model's working memory of its own earlier decisions isn't perfect over a long task.
Codex is precise at the level of a single file, and that precision is exactly what creates the gap. Each function it writes can be individually correct while the seam between two of them (an auth check that only got added to one of the three routes that needed it) is where the actual bug lives. I trace those seams specifically now, because the individual pieces rarely have obvious problems.
Lovable apps have a specific tell: they're demo-complete, not production-complete. The tool is optimized for the live preview looking right, which means the things that don't show up in a preview, like server-side validation, database permissions, or what happens when a webhook fails, are the first places I look. Almost every Lovable audit I've run finds at least one route that only checks auth on the client.
Replit Agent apps can fail at the boundary between working and deployed. The one-click path from prompt to live app is genuinely impressive, but it also means the steps that normally force a pause, like rotating a secret, writing a migration, or standing up a staging environment, never happen unless someone deliberately adds them back in. The first real test of a lot of Replit-built apps is production traffic itself.
“None of this means these tools are bad, or that you did something wrong by using them. They're built to get you from an idea to working software as fast as possible, and at that job, they're remarkable.”
What none of them do is the step that used to happen automatically, back when a human wrote and understood every line: verification. That step didn't disappear because it stopped mattering. It disappeared because nothing in the workflow does it for you anymore.
That's the gap an audit fills. If you want to know which of these patterns showed up in your own app, that's exactly what I look for.
Want to know what an audit would find in your app?
Email [email protected] for a free 20-minute call. No pitch, no obligation. I usually reply the same day.