Copilot, Cursor, and Claude can scaffold a working React component in seconds. That speed is real, and it has changed what a junior developer produces in their first month on the job. What it hasn't changed is whether that developer understands why the component works, and that gap is starting to show up in the code we're asked to fix.
What AI tools are actually good at right now
Large language models are strong at pattern completion: generating CRUD boilerplate, writing a Tailwind layout from a description, converting a REST call to a GraphQL query, or producing a first-pass Jest test suite. We use these tools daily on client work — GitHub Copilot for autocomplete, Claude for architecture discussion, and Cursor's agent mode for mechanical refactors across a codebase. On a recent WordPress-to-headless migration, AI-assisted scaffolding cut the initial component-porting phase from an estimated three weeks to eight days.
Where they fail consistently: reasoning about state that lives across multiple files, understanding business rules that aren't written down anywhere, and knowing when a shortcut will bite you in production. An LLM will happily generate a Supabase row-level security policy that "compiles" and is a security hole, because it pattern-matched on similar-looking policies rather than reasoning about your actual access model.
The skill that's quietly eroding
We've noticed a specific failure mode in developers — usually under three years of experience — who've learned to prompt well but not to read the code the prompt produces. They can get a feature working. They can't explain why the useEffect dependency array is what it is, or what happens if the API call in it fails. When something breaks in production, they re-prompt instead of debugging, which works until the bug is in the interaction between two AI-generated pieces that were never reasoned about together.
This isn't a moral failing, it's a predictable consequence of the tool. Autocomplete that's right 85 percent of the time trains you to stop checking the other 15 percent, especially under deadline pressure. The developers who stay sharp are the ones who still read every diff before committing it and can articulate, in a code review, why an approach was chosen — not just that it passed the tests.
Where we still draw a hard line on human review
- Authentication and authorization logic, including RLS policies, JWT validation, and session handling — always reviewed line by line by a senior developer, never merged on AI output alone
- Anything touching payment processing (Stripe webhooks, Shopify checkout extensions) — a misread edge case here costs real money
- Database migrations, particularly ones with data backfills — AI-generated migrations have shipped column drops we've had to catch in review
- Accessibility markup — LLMs frequently generate div soup with ARIA attributes that look plausible but fail WCAG 2.2 AA in an actual screen reader test
A hiring and mentoring problem, not just a tooling one
Firms optimizing purely for output-per-developer are quietly building a bench of people who can't operate without the assistant. We handle this on our team with a simple rule: any pull request generated substantially with AI assistance gets flagged in the description, and the author has to be able to walk a reviewer through the logic verbally, no notes, no re-reading the prompt. Junior developers pair on legacy-code debugging tickets specifically because there's no clean prompt for "figure out why this fifteen-year-old Drupal module breaks intermittently" — that task still requires the underlying skill.
The net effect for clients hiring a dev shop
Ask any vendor how they use AI tools and what their review process looks like before code ships. A shop that says "we don't use AI" is probably slower and more expensive than it needs to be. A shop that can't describe a human review gate is one where nobody may actually understand the codebase they're handing you. Both are worth knowing before you sign a contract.
Want a second opinion on a codebase you suspect was AI-assembled with no review process behind it? We do standalone code audits and can tell you within a day whether it's maintainable or needs a rebuild.
Surrey, BC
A full-service digital agency working in WordPress, Drupal, Shopify, Webflow, React, and React Native. We partner with universities, governments, and growing brands to ship sites and products that hold up after launch.
