Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

“AI slop” is a practical label, not a formal defect category. In Kiran Kunapuli V S’s Stop AI Slop article, it covers output that looks plausible but is unnecessary, generic, incorrect, unsafe, or poorly reviewed. The useful first question is simple: does this need to exist? Then check whether the code works, respects project boundaries, and preserves the behavior the project needs.

What are the 22 patterns of AI slop?

The list below comes from Kiran Kunapuli V S’s article. Its 18 code patterns and four generated-prose patterns are a review aid, not a standardized taxonomy. A pattern is a reason to investigate—not proof of a defect.

Code patterns

  1. Plausible but wrong logic: code appears reasonable while implementing the wrong rule or producing incorrect results.
  2. Hallucinated APIs or packages: a call, API, or dependency that does not exist or is not available in the project’s environment. Verify a proposed dependency in the actual package registry before adding it.
  3. Swallowed errors and silent fallbacks: failures disappear or produce a default value that masks a problem.
  4. Missing trust-boundary checks: input is accepted without the validation or authorization required where data crosses a boundary.
  5. Secrets in code or logs: credentials or other sensitive values are embedded or exposed.
  6. Unsafe retries: retry logic ignores Retry-After, timeouts, or rate limits.
  7. Non-idempotent retries and race conditions: repeating an operation can duplicate effects, or concurrent work can produce inconsistent outcomes.
  8. N+1 queries and unbounded results: repeated per-record requests or unrestricted result sets create avoidable load.
  9. Speculative abstractions: layers and interfaces are added for hypothetical future needs rather than a real requirement.
  10. Reinvented standard-library functionality: custom code duplicates a stable built-in capability without a project-specific reason.
  11. God functions and shotgun diffs: one function takes on too much, or a change spreads broadly beyond the task.
  12. Architecture or layer violations: code crosses boundaries the project’s design intends to preserve.
  13. Generic naming: names such as “data” or “handler” obscure what a value or operation means in its context.
  14. Redundant or stale comments: commentary repeats the code or no longer describes its behavior.
  15. Defensive bloat: checks and branches accumulate without addressing a credible failure mode.
  16. Dead code: unused paths or declarations remain in the change.
  17. Formatting noise: unrelated formatting changes obscure the substantive diff.
  18. Tests that cannot catch the bug: assertions cannot fail, or tests reproduce the same mistaken assumption as the implementation.

Generated-prose patterns

  1. Filler or buzzwords: language adds volume or jargon without useful information.
  2. Warm-up openers: introductory sentences delay the actual point.
  3. Formulaic reveals or hype structures: predictable build-up and dramatic claims substitute for specific explanation.
  4. Commit or pull-request clutter: summaries are padded, vague, or less useful than a concise account of the change.

How can you tell what to remove?

Kunapuli’s quick screens help focus a review. They are heuristics, not automatic deletion rules.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Ask whether it is required. Consider each feature, abstraction, flag, and line. As Kunapuli puts it: “If a feature, abstraction, flag, or line is not required, delete it.”
  • Ask whether it is project-specific. Could the function, comment, or sentence move unchanged into an unrelated project? If so, it may communicate little about this project and deserve closer scrutiny.

Neither question means that generic-looking code is necessarily wrong. Preserve load-bearing domain rules, security controls, accessibility behavior, concurrency safeguards, validation and authorization at trust boundaries, and error handling that prevents data loss. A short diff is not a goal if it removes necessary behavior.

What does simplification look like in the invoice example?

Kunapuli’s example starts with an invoice-saving implementation that has a one-implementation interface, a factory for a single product, generic names, six comments that restate the code, and an exception handler that turns an unparseable amount into zero. The author shows a shorter function and reports a diff of 8 insertions and 54 deletions. That is the author’s illustration, not an independently reproduced benchmark.

The important change is not merely fewer lines: the example removes the broad exception handling that concealed an invalid amount by converting it to zero. That alters failure behavior. Do not generalize this into “remove error handling”; retain handling needed to prevent data loss, and make failures visible or recoverable in a way that fits the application.

Why verify generated dependencies and behavior?

A 2025 USENIX Security study evaluated 576,000 generated code samples in Python and JavaScript. In the study’s tested setup, the models produced an average of at least 5.2% hallucinated packages among the commercial models tested and 21.7% among the open-source models tested, with 205,474 unique hallucinated package names identified. These are results for the selected models and experimental conditions—not universal rates for generated code. See the USENIX Security 2025 paper.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A separate 2025 USENIX ;login: Online author summary reports a 19.6% average hallucination rate; it says approximately 45% of hallucinated packages were regenerated every time for the same prompt and about 60% recurred at least once in ten subsequent prompts. These figures use a different aggregate and persistence framing from the conference abstract, so they should not be combined as if they measured the same thing. See the USENIX ;login: Online summary.

The studies document risk in dependency recommendations under their test conditions; they do not establish that Stop AI Slop prevents dependency incidents. Independently verify a new package’s existence and inspect it as a supply-chain input before relying on it.

Review the agent’s conduct as well as its code

Some risks concern what an agent does or claims, rather than a line in the diff. Kunapuli calls attention to test tampering or reward hacking, false reports of success, changes outside the requested task, silent behavior changes, and self-review blindness. Treat these as review prompts, not as five additional entries in the 22-pattern list or as evidence that such behavior is prevalent.

  • Inspect the full diff, including tests and configuration, for changes beyond the request.
  • Check that tests still exercise the intended behavior and that assertions can fail when it is wrong.
  • Run the relevant checks yourself when practical; distinguish a reported result from a result you verified.
  • Look for behavior changes that were not made explicit in the summary or request.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What does the skill’s evaluation establish?

The article reports a small evaluation using three labeled fixtures—two described as sloppy and one clean—with one run per model. It reports these results:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Model named in the article Recall Precision Clean fixture
gpt-6-luna (default) 1.00 0.91 Zero findings
claude-haiku-4-5-20251001 1.00 0.83 Zero findings

The author says the harness uses keyword scoring and describes the result as a floor rather than a grade. With only three fixtures and one run per model, these figures do not establish general effectiveness, performance across repositories, or reliable false-positive rates in real code review.

How is Stop AI Slop used?

The article names npx skills add kirankunapuli/stop-ai-slop and a GitHub Action that reviews pull requests in report-only mode. It claims the skill installs to 79 agents and that the action supports several model-provider categories; those are claims in the article, not an independently audited compatibility list, and coverage may change. Decide whether an automated report fits your workflow, and review its findings rather than treating them as verdicts.

The article’s closing question is worth applying to your own reviews: “Where has your agent produced slop that a reviewer waved through?”

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.