Skip to content
spot_the_ai_bug

Wrong API usage: interview questions

Wrong API usage calls a real function in a way that doesn't do what the author thinks: default sorting, reference equality, shared defaults, a cutset instead of a prefix.

How to spot it in code review

  • Know the defaults of the APIs you use every day.
  • Be wary of methods with similar names (== vs equals, substr vs substring).
  • Read the signature: what are the extra parameters, and who passes them?
  • Test with inputs that distinguish the two behaviors.

Why AI-generated code gets this wrong

Similar-sounding APIs look interchangeable, and the happy-path example often works by luck.

Wrong API usage: 3 practice questions

Q1Pythoneasy

Mutable default argument

add_tag() should return a fresh tag list for each post unless one is passed in. Why do tags from one post show up on another?

def add_tag(tag: str, tags: list[str] = []) -> list[str]:    """Append a tag and return the list of tags."""    if tag not in tags:        tags.append(tag)    return tags  first = add_tag("python")   # ["python"]second = add_tag("sql")     # expected ["sql"]
Show answer

line 1 · Wrong API usage

Default values are evaluated once, when the function is defined, so every call without tags shares the same list. second comes back as ["python", "sql"], and the list keeps growing for the life of the process.

Fix
def add_tag(tag: str, tags: list[str] | None = None) -> list[str]:    tags = [] if tags is None else tags

Interview follow-up: Interviewers often ask why None is the conventional sentinel and whether the same trap applies to dicts and sets (it does).

Sorting numbers with sort()

topScores() should return the three highest scores. What does it return for [100, 25, 9, 1000]?

function topScores(scores) {  return [...scores].sort().reverse().slice(0, 3);}
Show answer

line 2 · Wrong API usage

Without a comparator, sort() converts values to strings and sorts them lexicographically: [100, 1000, 25, 9]. Reversed, that gives [9, 25, 1000], and 100 is dropped.

Fix
  return [...scores].sort((a, b) => b - a).slice(0, 3);

Interview follow-up: Mention that copying first ([...scores]) matters because sort() mutates in place, or use toSorted().

Q3Javaeasy

Comparing strings with ==

isAdmin() gates the admin dashboard. Why are real admins being locked out?

public boolean isAdmin(HttpServletRequest request) {    String role = request.getHeader("X-Role");    return role == "admin";}
Show answer

line 3 · Wrong API usage

== compares object references, not contents. The header value is a new String built at runtime, so it is never the same object as the "admin" literal and the check is always false.

Fix
    return "admin".equals(role);

Interview follow-up: Putting the literal first also avoids a NullPointerException when the header is missing. (And never trust a client-supplied role header for authorization in real code.)

Every day, everyone gets the same pull request written by AI. It looks clean. It has comments. It has exactly one real bug.

  1. 1

    Find the line

    Tap the buggy line, then hit Submit. You get 3 attempts.

  2. 2

    Read the hints

    A miss within 2 lines is 🔥 Warm. Anything further is ❄️ Cold.

  3. 3

    Name the bug

    Found it? Bonus round: pick the bug type from 4 options. It doesn't affect your win, just your bragging rights.

// your share card

found in 3/3

🟥 cold miss · 🟨 warm miss · 🟩 found · ⬛ unused

Keyboard: ↑ ↓ to move between lines, Enter to submit. A new bug drops every day at midnight IST.

0
Played
0
Win %
0
Streak
0
Max

Attempts distribution