{
  "id": 9867150,
  "title": "When AI-generated code outruns the reader, the fix is tooling, not a stronger reviewer",
  "url": "https://urgent.news/2026/09/26/when-ai-generated-code-outruns-the-reader-the-fix-is-tooling-not-a",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-26T00:15:06.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cole_halton_42f71d71b809b/when-ai-generated-code-outruns-the-reader-the-fix-is-tooling-not-a-stronger-reviewer-5676"
  },
  "original_language": "en",
  "account": "Six months before the Miden zkVM audit began, Trail of Bits had already invested heavily in building missing tooling. Instead of merely reviewing AI-generated code, they created an LSP server, decompiler, static analysis engine, and Lean formal model for the VM executor—all from scratch with the help of AI agents. This approach offers a solution to the challenge of reviewing a growing volume of AI-generated code.\n\nThe Miden core library, written in Miden assembly (MASM), poses significant difficulties for manual review. MASM is a stack machine architecture with implicit inputs and outputs, no signature declarations, and varying stack effects in loops and branches. This complexity makes it nearly impossible for a reviewer to hold every stack effect in their head while reading the code.\n\nTrail of Bits recognized that reading MASM is not feasible for thorough review, so they built tools to alleviate this burden. They developed an LSP server and VS Code extension that annotates stack effects and provides inline instruction documentation within the editor, allowing reviewers to stay focused on the code without constantly looking up semantics. Additionally, they created a decompiler for a well-defined subset of MASM, focusing on correctness rather than completeness. Furthermore, they constructed a Lean model of the VM executor, which produced 95 machine-checked correctness proofs for a substantial portion of the Miden core library. One critical discovery was an unvalidated prover-supplied input that could enable a malicious prover to forge Falcon signatures and steal funds from Miden account holders—a flaw that would go unnoticed by a human reviewer.\n\nWhile the decompiler's primary value was not the decompiled output, it offered valuable internal analysis frameworks and an intermediate representation that they repurposed for static analysis. Building tooling yielded useful artifacts that went beyond the surface output, making the investment worthwhile.\n\nTrail of Bits' approach contradicts the prevailing notion that the bottleneck in PR review is the time spent reading diffs. Instead, they argue that the real constraint lies in the size of the surface that the reviewer must trust. Tooling that reduces the surface area is crucial for effective review, as it allows human or model reviewers to focus on the critical parts of the code.\n\nMoreover, the article highlights the importance of separating the writer from the judge. Trail of Bits employed Claude for planning and development, while Codex reviewed the decompiler. By using different models for writing and reviewing, they avoided the \"five-reviewers-one-opinion\" failure, ensuring a more reliable and consistent outcome. This practice aligns with the deterministic-judge argument, emphasizing the need for a judge that remains consistent over time and is not influenced by the model under test.",
  "summary": "Six months before the Miden zkVM audit even started, Trail of Bits had already spent most of the real work. Not staring at code. Building an LSP server, a decompiler, a static analysis engine, and a Lean formal model of the VM executor, from scratch, with AI agents, before opening a single review ticket. Their writeup of that effort is the closest thing I've seen to an honest answer to the…",
  "key_points": [],
  "editors_take": "Building custom tooling enables effective review of AI-generated code by reducing complexity and surface area, allowing reviewers to focus on critical parts and ensuring more reliable outcomes.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}