Can I use AI to write my tests?

Last reviewed 2026-09-30Written by Jacob Masse, TrazTech Inc.

Yes, and you should keep them, but they are not a substitute for independent testing. AI writes tests from its own understanding of the app, the same understanding that produced the bugs, so tests often confirm the bug rather than catch it. Ask specifically for negative tests: user A cannot read user B's data, unpaid users cannot reach paid features, invalid input is refused.

Tests to ask for

• Cross-user access denied for every record type.
• Role checks on every admin endpoint.
• Payment-gated features refused without a paid plan.
• Boundary values: zero, negative, empty, huge.
• Double submission creates one record.

What they miss

Anything nobody thought of. That is what a QA test and a security test bring: a different mind looking at the app.

A prompt that produces useful tests

Vague requests produce tests of the happy path. Specific ones produce tests that catch real problems. For example: "Write integration tests for the orders API. Create two users in different organizations. Assert that user B gets a 403 or 404 when reading, updating or deleting user A's order by ID. Assert that an unauthenticated request is refused. Assert that a member without the admin role cannot call the refund endpoint."

Then read the generated tests. Check that each one actually makes the request it claims to and asserts a refusal, rather than mocking the check it is meant to prove. Run them against a deliberately broken version, by temporarily removing an ownership check, to confirm they fail. A test that passes either way is not protecting anything.

Getting it checked

TrazTech offers vibe-coding QA and security review, listed from $2,000 CAD. Get at least one other quote on the same scope; the questions to ask a testing firm help compare them.

Related questions

• Can AI fix its own security bugs?
• QA versus security testing
• Reviewing AI-written code from Cursor

Common questions