The AI was repeatedly "fixing" my authentication code, thereby breaking it three times.

Doing a little side project in Cursor and I’ve observed a pattern – each time I ask it to implement a tiny feature close to my authentication code, it rewrites some parts of the authentication process that were untouched by me, in a manner that seemed more elegant but actually affected the functionality. Even removing a session expiration check at one point during some unrelated refactoring.

No errors have been thrown. My tests have passed since I didn’t have a test for such a scenario, which was found out when I accidentally kept myself logged in for much longer than expected.

Now, I’m looking into every diff around any lines related to security on a line-by-line basis regardless of how little the change is supposed to be. Have others developed guidelines as to what you never let the AI touch unattended?