Most AI code review prompts say something like "review this code and find bugs". The assistant obliges with a tidy list: a naming nit, a missing null check, a suggestion to add comments. What it cannot tell you is whether the change does what was asked, because nobody told it what was asked.
Here is a prompt that fixes that. It works in any chat assistant or coding agent.
The prompt
You are reviewing a code change. Here is what was asked for:
[paste the ticket, issue or request]
Review the diff against that request, not against your own idea of good code.
1. List anything the request asks for that the change does not do.
2. List every change the request did not ask for, including refactors,
renamed helpers, loosened checks and edited or deleted tests.
3. For each new or changed test, describe one way the code could be wrong
while that test still passes.
4. List edge cases and failure paths the change does not handle:
empty, zero, one, limits, bad input, timeouts, missing config.
5. Flag any dependency, function or option you are not sure exists in the
version this project uses.
For every point, quote the line it is about. Do not rewrite the code.
If you are unsure about something, say so instead of guessing.Why it is built this way
The request comes first. Without it, a reviewer can only judge whether code looks reasonable, and AI-written code nearly always looks reasonable.
Unrequested changes get their own list. Assistants like to tidy as they go. An unasked-for rewrite of working code is a second change with no request and no review, and it is where surprises hide.
Tests are questioned, not counted. When code and tests come from the same prompt, they tend to agree, including where both are wrong. Asking how each test could pass on broken code finds the ones that check nothing.
Quoted lines keep it honest. A finding tied to a line can be checked in seconds. A vague one cannot.
No rewrites. Once a reviewer starts producing a new version, you are reviewing that instead.
Using it
Paste it into a chat with the diff, or save it in the instructions file your tool reads, such as AGENTS.md, CLAUDE.md or .github/copilot-instructions.md, so it runs on every review. Keep the request slot: it is the part that matters most.
Then treat the output as a list of leads, not a verdict. Check each point yourself. Run the case it suggests, look at the line it quotes, and throw away anything you cannot confirm. An AI reviewer that is confidently wrong costs you time. One whose every claim you check can save you a lot of it.
A prompt is a second pair of eyes, not a replacement for yours. The free AI code review checklist covers the parts only a person can do, like writing your own tests before reading the AI's. The one-hour team session is a good way to try both on real patches with your team.