Loading lesson…
There are real moments where AI coding is slower, worse, or ethically wrong. Naming those moments is as important as naming the hype.
Every vendor will tell you to use AI everywhere. The honest answer is narrower. There are real categories of work where AI is slower, riskier, or ethically indefensible. Learning to refuse is a senior skill.
Engineers who let agents write everything lose sharpness on fundamentals. Recognizing pointer arithmetic bugs, reading a stack trace cold, debugging a race condition — these remain your skills alone. Use AI to accelerate learning, not to replace the reps.
| Category | Example | Why |
|---|---|---|
| PII | Customer names, emails, addresses | Privacy law and consent |
| PHI | Health records, diagnoses | HIPAA and equivalents |
| Credentials | API keys, DB URLs, tokens | May appear in logs or training sets |
| Trade secrets | Proprietary algorithms, competitive info | Potential IP exposure |
| Legal holds | Litigation documents | Privilege and chain of custody |
# Before pasting anything into a public AI tool, grep it for red flags.
# Save this as check.sh and run on any diff before copy-paste.
# Look for common secret patterns
grep -nE 'api[_-]?key|secret|token|password|BEGIN (RSA|EC) PRIVATE' "$1"
# Look for obvious PII
grep -nE '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}' "$1"
# If anything matches, stop. Redact or use an enterprise tier instead.A 3-second check before pasting into any AI tool. Make it muscle memory.AI-generated code's copyright status is unsettled and varies by jurisdiction. The US Copyright Office has indicated purely AI-generated work may not be copyrightable. If that matters to your product, document which parts are human-authored and preserve that provenance.
The ability to say no, with reasons, is the skill that separates engineers from typists.
— A principal engineer
The big idea: AI coding has real limits drawn by privacy law, licensing, learning, and craft. Naming those limits is how you use AI responsibly without pretending they do not exist.
15 questions · take it digitally for instant feedback at tendril.neural-forge.io/learn/quiz/end-coding-when-not-to-use-ai-creators
A developer is building a healthcare application that must comply with HIPAA. They want to use a free, publicly-available AI coding tool to help with a feature that processes patient medical records. What should they do?
Which scenario represents the strongest case for refusing to use AI coding tools?
A junior developer is learning a new programming language. They want to use an AI coding assistant to speed up their learning. What does the material recommend?
A developer is working on a highly novel algorithm that could be a breakthrough in distributed systems. They consider using an AI coding assistant. What does the material advise?
An engineer wants to paste proprietary competitor code into an AI coding tool to help understand and improve upon it. What is the primary risk?
A team is about to work on a legacy codebase that has zero automated tests. They want to use AI to help add new features. What should they do first?
Which category of data should never be pasted into any AI coding tool, regardless of tier?
An organization implements several enterprise mitigations for AI coding tools. Which approach provides the strongest protection for highly sensitive proprietary algorithms?
A developer notices they have been relying on AI for almost all coding tasks for six months. They can now write basic code without AI but struggle to debug complex issues independently. What is this phenomenon called?
What is the current legal status of AI-generated code regarding copyright in the United States?
A startup is building a commercial software product. They heavily used AI coding assistants throughout development. What should they document to protect themselves legally?
Which of the following is listed as a 'soft no' category - situations where AI usually makes things worse?
An enterprise wants to deploy AI coding tools company-wide. What should their policy explicitly include?
A developer is working on a very short task - a five-line function to validate an email address. What does the material recommend?
A developer wants to paste customer addresses into an AI tool to help format them consistently. What category of data is this and why is it risky?