AI Code Generation Tools: GitHub Copilot, Cursor, and Using AI in Engineering Teams

AI coding assistants have moved from novelty to infrastructure for most engineering teams. The productivity gains are real — but so are the risks: code that looks correct but isn't, security vulnerabilities introduced silently, and junior engineers who can generate code faster than they can understand it.

This guide covers which tools work best for which tasks, and how to adopt them in a way that improves your team rather than creating technical debt faster.

---

Tool Comparison (2026)

For most teams in 2026: Cursor for engineers who do heavy feature development; Copilot for teams who want IDE-native integration without switching editors.

---

What AI Code Generation Is Good At

1. Boilerplate and Scaffolding

Prompt: "Write a FastAPI endpoint for user registration:
- Accept email, password, name
- Hash password with bcrypt
- Create user in PostgreSQL via SQLAlchemy
- Send welcome email via SendGrid
- Return JWT on success
- Return proper error codes for duplicate email, weak password"

AI generates a complete, structurally correct implementation in seconds. What you still need to verify:

• Is the password hashing actually using bcrypt with appropriate cost factor?
• Is the SQL injection-safe (parameterized queries)?
• Does the error handling match your existing patterns?

2. Test Generation

// Give AI your function, ask for tests:
// "Write comprehensive Jest tests for this function,
//  covering happy path, edge cases, and error conditions"

function calculateDiscount(
  subtotal: number,
  couponCode: string | null,
  userTier: 'free' | 'pro' | 'enterprise'
): number {
  // ... implementation
}

// AI generates:
describe('calculateDiscount', () => {
  it('returns 0 discount for free tier with no coupon', () => {
    expect(calculateDiscount(100, null, 'free')).toBe(0);
  });

  it('applies 10% discount for pro tier', () => {
    expect(calculateDiscount(100, null, 'pro')).toBe(10);
  });

  it('applies coupon on top of tier discount', () => {
    expect(calculateDiscount(100, 'SAVE20', 'pro')).toBe(28);
  });

  it('handles zero subtotal', () => {
    expect(calculateDiscount(0, null, 'enterprise')).toBe(0);
  });

  it('caps discount at subtotal', () => {
    expect(calculateDiscount(5, 'SAVE20', 'enterprise')).toBe(5);
  });
});

AI-generated tests are often comprehensive on happy paths and obvious edge cases. They frequently miss domain-specific business rules ("a coupon can only be used once per customer") — which is exactly where your review should focus.

3. Refactoring and Transformation

Prompt: "Refactor this Express route to use async/await instead of callbacks,
add proper error handling, and convert to TypeScript"

AI excels at mechanical transformations: callback → promise, JavaScript → TypeScript, REST → GraphQL resolver, SQL → ORM query. These tasks are tedious for humans and low-risk for AI — the output is structurally verifiable.

4. Documentation

Prompt: "Write JSDoc comments for each function in this file,
describing parameters, return values, and thrown errors.
Also write a README section explaining when to use this module."

---

What AI Code Generation Is Bad At

Security-Sensitive Logic

AI models are trained on public code, which includes code with security vulnerabilities. In particular:

• Authentication flows: AI often suggests patterns that look secure but aren't (JWT without expiry validation, bcrypt cost factors that are too low, OAuth state parameter omissions)
• SQL queries with dynamic parts: Will often produce string concatenation instead of parameterized queries in unfamiliar patterns
• Cryptography: Tends to use deprecated algorithms or incorrect initialization

Rule: Never ship AI-generated security-critical code without security review. Always check:

// AI generated this — is it actually secure?
const hash = await bcrypt.hash(password, 10);  // Cost factor 10: OK (12 is better)
const token = jwt.sign({ userId }, secret);    // ⚠️ No expiry! Add { expiresIn: '15m' }
const query = `SELECT * FROM users WHERE email = '${email}'`;  // ⚠️ SQL injection!

Novel Architecture Decisions

AI excels at implementing patterns it has seen. It struggles with:

• "What's the best architecture for our specific constraints?"
• "Should we use event sourcing here?"
• "How should we model this domain?"

These require understanding your system's history, constraints, and tradeoffs — context the AI doesn't have.

Debugging Complex System Interactions

AI can help with "this function is wrong" but struggles with "why is this failing intermittently in production under concurrent load?" — which requires understanding your system holistically.

---

Effective Prompt Patterns

The Context-First Pattern

Context about our codebase:
- Node.js 20 + TypeScript, Fastify framework
- PostgreSQL with Prisma ORM
- We use Zod for all input validation
- Error handling: throw ApiError class, Fastify catches and formats

Now write: [specific task]

Context reduces hallucination significantly. AI that knows you use Prisma won't generate raw SQL.

The Incremental Refinement Pattern

Step 1: "Write the type definitions for a notification system"
Step 2: "Now implement the NotificationService class that satisfies these types"
Step 3: "Add error handling for the case where the email provider is down"
Step 4: "Write tests for the error handling case"

Breaking complex tasks into steps produces better results than one giant prompt.

The Review Pattern

"Review this code for:
1. Security vulnerabilities (especially auth and SQL)
2. Performance issues (N+1 queries, missing indexes)
3. TypeScript type safety (any casts, missing null checks)
4. Missing error cases

Here's the code: [paste code]"

AI is often better at reviewing code than writing it from scratch — fewer confabulations, more focused.

---

Team Adoption Strategy

Week 1–2: Individual experimentation Let engineers try the tool on low-stakes tasks. No policy yet — just learn what it does and doesn't do well.

Week 3–4: Share patterns Team retrospective: what worked? What produced bad code? Build a shared prompt library for common tasks (test generation, PR description, type conversion).

Month 2: Establish norms Define what requires human review (security, auth, payments) vs. what can be shipped with lighter review (tests, boilerplate, docs).

Month 3+: Measure Track deployment frequency, PR cycle time, and defect rate before and after adoption. Most teams see 20–40% reduction in boilerplate writing time, modest improvement in test coverage.

Policy template:

## AI Code Generation Policy

### Always require human expert review:
- Authentication and authorization logic
- Payment processing and financial calculations
- Cryptographic operations
- Database migrations
- External API integrations (security config)

### Acceptable with standard PR review:
- Test generation (verify coverage, not each assertion)
- Boilerplate (CRUD endpoints, DTOs, serializers)
- Documentation and comments
- Refactoring (verify behavior unchanged via tests)
- Type conversions

### Document AI-generated code:
Add comment: `// AI-assisted: generated with Cursor/Copilot, reviewed by [name]`
This helps future maintainers know where extra scrutiny may be warranted.

---

Measuring the Impact

-- Track PR cycle time before/after AI tool adoption
-- Compare teams using vs. not using tools
SELECT
    DATE_TRUNC('month', created_at) AS month,
    AVG(EXTRACT(EPOCH FROM (merged_at - created_at)) / 3600) AS avg_cycle_hours,
    COUNT(*) AS pr_count,
    AVG(additions + deletions) AS avg_pr_size
FROM pull_requests
WHERE merged_at IS NOT NULL
GROUP BY month
ORDER BY month;

The productivity gains are real but often narrower than vendor claims — expect 20–30% reduction in time for well-defined tasks, not 10× engineering velocity.

---

Working With Viprasol

We help engineering teams adopt AI tools effectively — from tool selection and prompt engineering to establishing code review policies for AI-generated code. We've seen the full range of outcomes from "meaningfully faster" to "faster technical debt accumulation."

→ Talk to our team about AI tooling strategy for your engineering organization.

---

See Also

• Code Review Best Practices — reviewing AI-generated code effectively
• Developer Experience — AI tools as part of DX investment
• Technical Writing for Developers — AI-assisted documentation
• LLM Fine-Tuning — adapting models to your codebase and patterns
• AI and Machine Learning Services — AI engineering and tooling