One reason you shouldn’t blindly outsource your engineering judgment to AI, especially in security-sensitive code.
I asked an AI to implement private IP filtering. It produced a solution based on string prefix matching.
At first glance it looks fine… until you inspect it closely.
The bug
It checks something like:
"172.2" prefix match
Which is incorrect. This would wrongly classify:
172.21.x.x
172.201.x.x
as valid private ranges based purely on string matching logic.
That’s not how IP ranges work.
What I implemented instead
I used Rust’s standard library IP parsing via IpAddr, and relied on built-in classification methods like:
private ranges (RFC1918)
loopback
link-local
IPv6 local equivalents
This immediately removes ambiguity and edge-case parsing errors.
Why this matters
Because I’m familiar with RFC1918 ranges, I immediately noticed the flat, the AI wasn’t actually parsing IPs, just doing string comparisons.
That difference is critical.
The deeper issue
String-based IP validation opens up real attack surface:
* IPv6 representations
* alternative IP notations
* malformed or mixed formats
* DNS rebinding scenarios
* other non-canonical encodings
Proper parsing (IpAddr) already accounts for these cases in a way string matching never can.
Moral: AI can generate code fast, but without domain knowledge, it can quietly introduce subtle security bugs.