7 ms·

This is exactly what I'd want from an 'AI coding companion'. Don't write or fix the code for me (thanks but I can manage that on my own with much less hassle),

This is exactly what I'd want from an 'AI coding companion'. Don't write or fix the code for me (thanks but I can manage that on my own with much less hassle), but instead tell me which places in the code look suspicious and where I need to have a closer look. When I ask Claude to find bugs in my 20kloc C library it more or less just splits the file(s) into smaller chunks and greps for specific code patterns and in the end just gives me a list of my own FIXME comments (lol), which tbh is quite underwhelming - a simple bash script could do that too. ChatGPT is even less useful since it basically just spend a lot of time to tell me 'everything looking great yay good job high-five!'. So far, traditional static code analysis has been much more helpful in finding actual bugs, but static analysis being clean doesn't mean there are no logic bugs, and this is exactly where LLMs should be able to shine. If getting more useful potential-bugs-information from LLMs requires an extensively customized setup then the whole idea is getting much less useful - it's a similar situation to how static code analysis isn't used if it requires extensive setup or manual build-system integration instead of just being a button or menu item in the IDE or enabled by default for each build.

walthamstow 1y ago
Cursor BugBot is pretty good for this, we did the free trial and it was so popular with our devs that we ended up keeping it. Occasional false positives aside, it's very useful. It saves time for both the PR submitter and the reviewer.
simonw 1y ago
Suggestion: run a regex to remove those FIXME comments first, then try the experiment again. I often use Claude/GPT-5/etc to analyze existing repositories while deliberately omitting the tests and documentation folders because I don't want them to influence the answers I'm getting about the code - because if I'm asking a question it's likely the documentation has failed to answer it already!
trenchpilgrim 1y ago
I use Zed's "Ask" mode for this all the time. It's a read only mode where the LLM focuses on figuring out the codebase instead of modifying it. You can toggle it freely mid conversation.
flaviolivolsi 1y ago
I found GPT-5 to be very much less sycophantic than other models when it comes to this stuff, so your mention of 'everything looking great yay good job high-five' surprises me. Using it via Codex CLI it often questions things. Gemini 2.5 Pro is also good on this.
vidarh 1y ago
I've "worked" with Claude Code to find a long standing set of complex bugs over the last couple of days, and it can do so much more. It's come up with hypotheses, tested them, used gdb in batch mode when the hypotheses failed in order to trace what happened at the assembly level, and compared with the asm dump of the code in question. It still needs guidance, but it quashed bugs yesterday that I've previously spent many days on without finding a solution for. It can be tricky, but they definitely can be significant aid for even very complex bugs.
Sharlin 1y ago
This is a point I see discussed surprisingly little. Given that many (most?) programmers like designing and writing code (excluding boilerplate), and not particularly enjoy reviewing code, it certainly feels backwards to make the AI write the code and relegate the programmer to reviewing it. (I know, of course, that the whole thing is being sold to stakeholders as "LoC machine goes brrrr" – code review? what's that?)
- alexchantavy 1y ago
  There are a lot of good AI code reviewers out there where they learn project conventions based on prior PRs and make rules from them. I've found they definitely save time and catch things I would have missed - things like cubic.dev or greptile etc etc. Especially helpful for running an open source project where code quality can have high variance and as a maintainer you may feel hesitant to be direct with someone -- the machine has no feelings so it is what it is :)
- SAI_Peregrinus 1y ago
  Creativity is fun. AIs automate that away. I want an AI that can do my laundry, fold it, and put it away. I don't need an AI to write code for me. I don't mind AI code review, it sometimes has a valid suggestion, and it's easy enough to ignore most of the rest of the time.
  - diggan 1y ago
    > Creativity is fun. AIs automate that away. I've been developing with LLMs on my side for months/about a year now, and feels like it's allowing me to be more creative, not less. But I'm not doing any "vibe-coding", maybe that's why? The creative parts (for me) is coming up with the actual design of the software, and how it all fits together, what it should do and how, and I get to do that more than ever now.
    - dingnuts 1y ago
      I'm still faster than the cheap bots. The creative part for me includes both the implementation and the design, because the implementation also matters. The bots get in the way. Maybe I would be faster if I paid for Claude Code. It's too expensive to evaluate. If you like your expensive AI autocomplete, fine. But I have not seen any demonstrable and maintainable productivity gains from it, and I find understanding my whole implementation faster, more fun, and that it produces better software. Maybe that will change, but people told me three years ago that we would be at the point today where I could not outdo the bot; with all due respect, I am John Henry and I am still swinging my hammer. The steam pile driving machine is still too unpredictable!
mhitza 1y ago
In an application I'm working on, I use gpt-oss-20B. In a prompt I dump in the OWASP Top 10 web vulnerabilities, and a note that it should only comment on "definitive vulnerabilities". Has been pretty effective in finding vulnerabilities in the code I write (and it's one of the poorest-rated models if you look at some comments). Where I still need to extend this, is to introduce function calling in the flow, when "it has doubts" during reasoning, would be the right time to call out a tool that would expand the context its working with (pull in other files, etc).
- airstrike 1y ago
  Tool calling is the best lever for getting value out of LLMs
- diggan 1y ago
  > (and it's one of the poorest-rated models if you look at some comments). Yeah, don't listen to "wisdom of the crowd" when it comes to LLM models, there seems to be a ton of fud going on, especially on subreddits. GPT-OSS was piled on for being dumb in the first week of release, yet none of the software properly supported it at launch. As soon as it was working properly in llama.cpp, it was clear how strong the model was, but at that point the popular sentiments seems to have spread and solidified.
CharlesW 1y ago
> When I ask Claude to find bugs in my 20kloc C library it more or less just splits the file(s) into smaller chunks and greps for specific code patterns and in the end just gives me a list of my own FIXME comments (lol), which tbh is quite underwhelming - a simple bash script could do that too. Here's a technique that often works well for me: When you get unexpectedly poor results, ask the LLM what it thinks an effective prompt would look like, e.g. "How would you prompt Claude Code to create a plan to effectively review code for logic bugs, ignoring things like FIXME and TODO comments?" The resulting prompt is too long to quote, but you can see the raw result here: https://gist.github.com/CharlesWiltgen/ef21b97fd4ffc2f08560f969a77e9f42 https://gist.github.com/CharlesWiltgen/ef21b97fd4ffc2f08560f... From there, you can make any needed improvements, turn it into an agent, etc.
- OGWhales 1y ago
  I've found this a really useful strategy in many situations when working with LLMS. It seems odd that it works, since one one think its ability to give a good reply to such a question means it already "understands" your intent in the first place, but that's just projecting human ability onto LLMS. I would guess this technique is similar to how reasoning modes seems to improve output quality, though I may misunderstand how reasoning modes work.
  - ako 1y ago
    Works for humans the same? Even if you know how to do a complex project, it helps to first document the approach, and then follow it.
- einarfd 1y ago
  This is a great idea, and worth doing. An other option in Claude code, that can be worth trying, is the planning mode, which you start with ctrl+tab. Have it plan out what it's going to do, and keep iterating it, until the plan seems sound. Tbh. I wish I've found the planning mode earlier, it's been such a great help.
- alickz 1y ago
  I have also had some success with this method I asked ChatGPT to analyze its weaknesses and give me a pre-prompt to best help mitigate them and it gave me this: https://pastebin.com/raw/yU87FCKp https://pastebin.com/raw/yU87FCKp I've found it very useful to avoid sycophancy and increase skepticism / precision in the replies it gives me
llleeeooo 1y ago
Indeed, in many machine learning models, classification is always easier than generation. Maybe that's consistent with chatgpts intelligence level
notatoad 1y ago
i've had great success with both chatGPT and claude with the prompt "tell me how this sucks" or "why is this shit". being a bit more crass seems to bump it out of the sycophantic mode, and being more open-ended in the type of problems you want it to find seems to yield better results. but i've been limiting it to a lot less than 20k LoC, i'm sticking with stuff i can just paste into the chat window.
freedomben 1y ago
I've had reasonably good success with asking Claude things like: "There's a bug somewhere that is causing slow response times on several endpoints, including <xyz>. Sometimes response times can get to several seconds long, and don't look correlated with CPU or memory usage. Database CPU and memory also don't seem to correlate. What is the issue?" I have to iterate a few times but it's hinted me a few really tricky issues that would have probably taken hours to find. Definitely optimistic for this way to use AI
KronisLV 1y ago
> When I ask Claude to find bugs in my 20kloc C library it more or less just splits the file(s) into smaller chunks and greps for specific code patterns and in the end just gives me a list of my own FIXME comments (lol), which tbh is quite underwhelming - a simple bash script could do that too. I explicitly asked it to read all the code (within Cline) and it did so, gave me a dozen action items by the end of it, on a Django project. Most were a bit nitpicky, but two or three issues were more serious. I found it pretty useful!
fhd2 1y ago
My thoughts exactly. So many actually useful tools could be built on top of LLMs, but most of the resources go into the no code space. I get it though, non programmers or weak programmers don't scrutinise the results and are more likely to be happy to pay. Still, bit of a shame. Maybe these tools exist, but at least to me, they don't surface among all the noise.
oezi 1y ago
Really surprised that nobody in this thread mentions using Gemini 2.5 Pro. Its 1m context really shines for code review. GPT 5 has been disappointing with thinking and without.
jiggawatts 1y ago
Because most LLMs are just a REST call, it’s a trivial matter to wire them up in a loop over all source files. The fiddly part is finding a good library for enumerating files while adhering to .gitignore and/or “project” file include/exclude rules! Even very simple prompts can yield very useful outputs. “Report each bug you spot in this code with a markdown formatted report.” worked better than I expected. It costs just a couple of dollars to scan through an entire codebase with something like Gemini Flash.

walthamstow 1y ago

Cursor BugBot is pretty good for this, we did the free trial and it was so popular with our devs that we ended up keeping it. Occasional false positives aside, it's very useful. It saves time for both the PR submitter and the reviewer.

simonw 1y ago

Suggestion: run a regex to remove those FIXME comments first, then try the experiment again. I often use Claude/GPT-5/etc to analyze existing repositories while deliberately omitting the tests and documentation folders because I don't want them to influence the answers I'm getting about the code - because if I'm asking a question it's likely the documentation has failed to answer it already!

trenchpilgrim 1y ago

I use Zed's "Ask" mode for this all the time. It's a read only mode where the LLM focuses on figuring out the codebase instead of modifying it. You can toggle it freely mid conversation.

flaviolivolsi 1y ago

I found GPT-5 to be very much less sycophantic than other models when it comes to this stuff, so your mention of 'everything looking great yay good job high-five' surprises me. Using it via Codex CLI it often questions things. Gemini 2.5 Pro is also good on this.

vidarh 1y ago

I've "worked" with Claude Code to find a long standing set of complex bugs over the last couple of days, and it can do so much more. It's come up with hypotheses, tested them, used gdb in batch mode when the hypotheses failed in order to trace what happened at the assembly level, and compared with the asm dump of the code in question. It still needs guidance, but it quashed bugs yesterday that I've previously spent many days on without finding a solution for. It can be tricky, but they definitely can be significant aid for even very complex bugs.

Sharlin 1y ago

This is a point I see discussed surprisingly little. Given that many (most?) programmers like designing and writing code (excluding boilerplate), and not particularly enjoy reviewing code, it certainly feels backwards to make the AI write the code and relegate the programmer to reviewing it. (I know, of course, that the whole thing is being sold to stakeholders as "LoC machine goes brrrr" – code review? what's that?)

alexchantavy 1y ago
There are a lot of good AI code reviewers out there where they learn project conventions based on prior PRs and make rules from them. I've found they definitely save time and catch things I would have missed - things like cubic.dev or greptile etc etc. Especially helpful for running an open source project where code quality can have high variance and as a maintainer you may feel hesitant to be direct with someone -- the machine has no feelings so it is what it is :)
SAI_Peregrinus 1y ago
Creativity is fun. AIs automate that away. I want an AI that can do my laundry, fold it, and put it away. I don't need an AI to write code for me. I don't mind AI code review, it sometimes has a valid suggestion, and it's easy enough to ignore most of the rest of the time.
- diggan 1y ago
  > Creativity is fun. AIs automate that away. I've been developing with LLMs on my side for months/about a year now, and feels like it's allowing me to be more creative, not less. But I'm not doing any "vibe-coding", maybe that's why? The creative parts (for me) is coming up with the actual design of the software, and how it all fits together, what it should do and how, and I get to do that more than ever now.
  - dingnuts 1y ago
    I'm still faster than the cheap bots. The creative part for me includes both the implementation and the design, because the implementation also matters. The bots get in the way. Maybe I would be faster if I paid for Claude Code. It's too expensive to evaluate. If you like your expensive AI autocomplete, fine. But I have not seen any demonstrable and maintainable productivity gains from it, and I find understanding my whole implementation faster, more fun, and that it produces better software. Maybe that will change, but people told me three years ago that we would be at the point today where I could not outdo the bot; with all due respect, I am John Henry and I am still swinging my hammer. The steam pile driving machine is still too unpredictable!

mhitza 1y ago

In an application I'm working on, I use gpt-oss-20B. In a prompt I dump in the OWASP Top 10 web vulnerabilities, and a note that it should only comment on "definitive vulnerabilities". Has been pretty effective in finding vulnerabilities in the code I write (and it's one of the poorest-rated models if you look at some comments). Where I still need to extend this, is to introduce function calling in the flow, when "it has doubts" during reasoning, would be the right time to call out a tool that would expand the context its working with (pull in other files, etc).

airstrike 1y ago
Tool calling is the best lever for getting value out of LLMs
diggan 1y ago
> (and it's one of the poorest-rated models if you look at some comments). Yeah, don't listen to "wisdom of the crowd" when it comes to LLM models, there seems to be a ton of fud going on, especially on subreddits. GPT-OSS was piled on for being dumb in the first week of release, yet none of the software properly supported it at launch. As soon as it was working properly in llama.cpp, it was clear how strong the model was, but at that point the popular sentiments seems to have spread and solidified.

CharlesW 1y ago

> When I ask Claude to find bugs in my 20kloc C library it more or less just splits the file(s) into smaller chunks and greps for specific code patterns and in the end just gives me a list of my own FIXME comments (lol), which tbh is quite underwhelming - a simple bash script could do that too. Here's a technique that often works well for me: When you get unexpectedly poor results, ask the LLM what it thinks an effective prompt would look like, e.g. "How would you prompt Claude Code to create a plan to effectively review code for logic bugs, ignoring things like FIXME and TODO comments?" The resulting prompt is too long to quote, but you can see the raw result here: https://gist.github.com/CharlesWiltgen/ef21b97fd4ffc2f08560f969a77e9f42 https://gist.github.com/CharlesWiltgen/ef21b97fd4ffc2f08560f... From there, you can make any needed improvements, turn it into an agent, etc.

OGWhales 1y ago
I've found this a really useful strategy in many situations when working with LLMS. It seems odd that it works, since one one think its ability to give a good reply to such a question means it already "understands" your intent in the first place, but that's just projecting human ability onto LLMS. I would guess this technique is similar to how reasoning modes seems to improve output quality, though I may misunderstand how reasoning modes work.
- ako 1y ago
  Works for humans the same? Even if you know how to do a complex project, it helps to first document the approach, and then follow it.
einarfd 1y ago
This is a great idea, and worth doing. An other option in Claude code, that can be worth trying, is the planning mode, which you start with ctrl+tab. Have it plan out what it's going to do, and keep iterating it, until the plan seems sound. Tbh. I wish I've found the planning mode earlier, it's been such a great help.
alickz 1y ago
I have also had some success with this method I asked ChatGPT to analyze its weaknesses and give me a pre-prompt to best help mitigate them and it gave me this: https://pastebin.com/raw/yU87FCKp https://pastebin.com/raw/yU87FCKp I've found it very useful to avoid sycophancy and increase skepticism / precision in the replies it gives me

llleeeooo 1y ago

Indeed, in many machine learning models, classification is always easier than generation. Maybe that's consistent with chatgpts intelligence level

notatoad 1y ago

i've had great success with both chatGPT and claude with the prompt "tell me how this sucks" or "why is this shit". being a bit more crass seems to bump it out of the sycophantic mode, and being more open-ended in the type of problems you want it to find seems to yield better results. but i've been limiting it to a lot less than 20k LoC, i'm sticking with stuff i can just paste into the chat window.

freedomben 1y ago

I've had reasonably good success with asking Claude things like: "There's a bug somewhere that is causing slow response times on several endpoints, including <xyz>. Sometimes response times can get to several seconds long, and don't look correlated with CPU or memory usage. Database CPU and memory also don't seem to correlate. What is the issue?" I have to iterate a few times but it's hinted me a few really tricky issues that would have probably taken hours to find. Definitely optimistic for this way to use AI

KronisLV 1y ago

fhd2 1y ago

My thoughts exactly. So many actually useful tools could be built on top of LLMs, but most of the resources go into the no code space. I get it though, non programmers or weak programmers don't scrutinise the results and are more likely to be happy to pay. Still, bit of a shame. Maybe these tools exist, but at least to me, they don't surface among all the noise.

oezi 1y ago

Really surprised that nobody in this thread mentions using Gemini 2.5 Pro. Its 1m context really shines for code review. GPT 5 has been disappointing with thinking and without.

jiggawatts 1y ago

Because most LLMs are just a REST call, it’s a trivial matter to wire them up in a loop over all source files. The fiddly part is finding a good library for enumerating files while adhering to .gitignore and/or “project” file include/exclude rules! Even very simple prompts can yield very useful outputs. “Report each bug you spot in this code with a markdown formatted report.” worked better than I expected. It costs just a couple of dollars to scan through an entire codebase with something like Gemini Flash.