.jpg)
In modern software development, artificial intelligence has become an indispensable ally for accelerating code writing and review. However, a recent incident shows that blindly trusting two AI models that work with the same approach can create a false sense of security. The case: a Node.js module import error that was documented in a comment within the same directory, but went unnoticed by both the author and the automated reviewer. This type of failure reminds us that no matter how advanced AI agents are, their effectiveness depends on the scope of the tests they run.
The technical problem is revealing. A developer extracted a JSON parsing function to a file with a .mjs extension, correctly assuming that in the local environment the import from an ESM module worked. And it did: all local checks —syntax, unit tests, logic review— returned positive results. The error appeared in production, where the runtime transformed the module system and used require() (CommonJS) on a .mjs file, which is prohibited by the specification. The irony is that the solution was written in a comment in the neighboring file: “CommonJS on purpose”. The documentation existed, but it was not being executed by any tool.
This incident exposes a recurring weakness in AI-assisted review pipelines. When two models are used —one to generate code and another to review it— both often share the same scope of analysis: logical correctness within the local environment. If both models think similarly, their blind spots are also similar. Stacking reviews does not equal defense in depth if all look in the same direction. True redundancy is only achieved when reviewers examine different aspects of the system, such as integration coverage with the real deployment environment or compliance with project conventions that are not encoded in tests.
For companies developing custom applications, these types of lessons are critical. It is not enough to integrate artificial intelligence into the workflow; verification processes must be designed to cover all levels, from syntax to behavior in cloud infrastructures like those offered by AWS and Azure cloud services. A review that is not executed against the real production environment is an incomplete review. That is why at Q2BSTUDIO we approach each project with a holistic vision, combining custom software with cybersecurity practices and business intelligence service strategies like Power BI, to ensure that business rules do not remain mere comments.
The documented failure a file away was not because the AI was unable to read the comment, but because its prompt did not ask it to verify conventions external to the diff. The solution lies in expanding the scope of automated checks. For example, you can add a lint rule that prohibits .mjs extensions in directories where code is consumed via CommonJS, or force a test run in the staging environment before merging any changes. Tools like continuous integration pipelines with AI for companies can include steps that run the module in a container that exactly replicates production conditions.
The lesson that transcends this case is that passive knowledge —a comment, documentation, a style guide— does not guarantee compliance. If a rule is important enough to cause a production failure, it must be encoded in a test, a linter, or a deployment gate. Teams developing custom software must adopt platforms that allow automating these validations. At Q2BSTUDIO we integrate AWS and Azure cloud services to build staging environments that faithfully reflect the target architecture, and we use AI agents trained with project-specific context, not just generic patterns. This way we reduce the gap between what is documented and what is actually executed.
In short, two AI reviews let an error that was written in a neighboring file slip through because both shared the same blind spot. To avoid this, organizations must diversify the scopes of their checks and not trust that more models equal more security. If you want to know how we apply these lessons in the development of custom applications and in the implementation of AI for companies, at Q2BSTUDIO we are ready to help you build robust software from the first commit.
