AI Code Reviewer Missed 8 Real Bugs That Strangers Caught in Three Days

A non-developer building internal hospital tools relied on a multi-agent AI system — separate roles for implementation, testing, and security review — to oversee code quality for months. The security reviewer flagged almost nothing, which the author initially interpreted as a sign the code was clean. Over just three days, eight genuine defects were identified by outside readers commenting on the author's public posts, none of which the AI reviewer had ever flagged. The author concluded the core problem was structural: the implementer and reviewer agents share the same underlying model and therefore share the same blind spots, making true independent review impossible. The experience highlighted that silence from an AI reviewer and genuine code health produce identical output, and that real independence requires perspectives from outside the original context entirely.