10 modules AI coding tools almost always botch on the first try (after ~2 years of daily use) 2026-05-15 Open Mic · commit.show Been using Cursor / Claude Code / Copilot heavily for a while and a really consistent failure pattern shows up. The tools are great for a ton of stuff, but there are specific areas where the first draft is almost always wrong in ways that look right. Sharing in case it saves someone a 2am debugging session.Rough order of how often it bites me:Timezones and date math. UTC ↔ local, DST, month boundaries, "last day of month." Mixes new Date(), Luxon, date-fns, dayjs depending on which era of training data won out. Works in dev, breaks for users in Sydney.Auth (OAuth / JWT / sessions). Token refresh logic that's plausibly correct but skips the messy parts. CSRF, SameSite, PKCE get quietly omitted. I've had it invent OAuth library methods more than once.Fast-moving framework APIs. Next.js App Router vs Pages, RSC, Tailwind v4, LangChain, AI SDK. The model blends syntax from different versions. "use client", cookies(), headers() placement is a coin flip.Regex edge cases. Unicode, emoji, greedy vs lazy, catastrophic backtracking. Passes the happy path, silently truncates the rest.Money and decimals. Just throws number at it. 0.1 + 0.2 doesn't get a second thought. Decimal libraries only show up if you explicitly ask.SQL: N+1, NULL, transactions. Classic N+1s through the ORM. = NULL instead of IS NULL in raw queries. Transaction boundaries basically never reasoned about.Async / race conditions. Promise.all where it should be sequential, or sequential where it should be parallel. React useEffect stale closures and missing deps are practically guaranteed.Hallucinated methods on niche libraries. Anything below ~1k stars is dangerous. It invents APIs that should exist based on naming conventions of similar libs. Compiles, dies at runtime.Paths and OS differences. "/" hardcoded instead of path.join. Fine on the Mac it was generated on, breaks on Windows / Docker / CI.Security: SSRF, path traversal, dangerouslySetInnerHTML, missing sanitization. The code runs. The sanitize step is just… not there. You basically have to ask for it every single time.My current workflow for anything in this list is either (a) write the test first, or (b) do a focused second pass where I name the failure mode and ask the model to specifically check for it. The killers are the "looks right on review" ones — these aren't compile errors, they're stuff that ships.What's on your list that's not on mine? Curious what everyone else keeps tripping over. #ai-tool Read on commit.show