The Hidden Cost of AI Coding: Technical Debt

Which matters more when your team builds software with AI: how fast the code shows up, or what it costs to own that code a year from now?

Most companies answer with speed, and the speed is real. In Sonar’s January 2026 survey of more than 1,100 professional developers, AI-generated or AI-assisted code already accounts for 42% of committed code, and respondents expect 65% by 2027. Veracode’s July 2026 security report puts AI’s share at roughly half of committed code.

Here’s the problem. Many large datasets published on AI-assisted development since mid-2025 show a similar pattern. Output goes up. The signals that predict long-term maintenance cost go the wrong way at the same time. That gap is the technical debt of AI coding, and it doesn’t appear on the dashboards most executives look at.

What technical debt looks like when AI writes the code

Technical debt is the future cost of rework created by choices that are cheaper or faster today. Duplicated logic, missing tests, unclear structure, and undocumented decisions all raise the price of every later change.

I’m not talking about the maintenance problems inside machine learning systems themselves, which Google researchers documented back in 2015. I’m talking about what happens to ordinary software products when AI writes a large share of the code.

The research points to three kinds of debt. Structural debt in the code itself. Verification and stability debt in the delivery pipeline. And cognitive debt, which is the gap between what your system does and what your developers understand about it.

Let’s take them in order.

The code is faster to write and harder to own

GitClear, a developer analytics vendor with data going back to before AI tools were common, published “The Maintainability Gap” in June 2026. The report covers 623 million code changes from 2023 through mid 2026 and tracks eight code quality signals.

Start with refactoring. Moved code, GitClear’s proxy for refactoring, was 21% of changed lines in 2022. It fell to 13% in 2023 and to 3.8% year-to-date in 2026. Over the same period, copy/paste within a commit rose from 9.4% of changed lines to 15.7%. In 2022, refactoring accounted for about twice as much changed code as copy/paste. In 2026, they pasted about five times as often as they refactored.

Duplicated blocks of five or more consecutive lines rose from 40.3 per million changed lines in 2023 to 73 in 2026. That is an 81% increase and the highest level GitClear has recorded.

New code also connects to less of the existing system. Function connectivity, the rate at which new code calls other functions, fell 35% since 2023, from 343 calls per thousand changed lines to 223. GitClear interprets this as new code being written in isolation from existing modules rather than reusing them.

Old code is getting less attention. Changes that touched code last modified more than 12 months earlier fell from 1.7% of changes in 2023 to 0.46% year-to-date in 2026, a 74% drop. Error-masking constructs, such as broad catch blocks that suppress failures, rose 47%. Code churned within two weeks of being written rose 15%.

GitClear is careful to say these are correlations, not proof that AI caused them. Its January 2026 analysis found heavy AI users gained about 25% in velocity compared with their own pre-AI output, so the speed is not imaginary. GitClear also sells the tools that measure these signals, which is worth keeping in mind with every vendor study on this topic.

Throughput goes up. So do bugs, incidents, and review time.

If you want to know what happens after the code is merged, the most detailed public dataset comes from Faros AI’s April 2026 report, “The Acceleration Whiplash.” It covers two years of telemetry from 22,000 developers across 4,000 teams, comparing each organization’s lowest and highest periods of AI adoption.

The output numbers come first:

• Epics completed per developer rose 66.2%.
• Task throughput per developer increased 33.7%.
• Pull request merge rate per developer rose 16.2%.
• The acceptance rate of AI-generated code grew from 20% to 60%.

Now the downstream numbers:

• Bugs per developer rose 54%, up from a 9% rise in Faros’s 2025 report.
• The ratio of production incidents to merged pull requests grew 242.7%.
• Monthly incidents increased 57.9%.
• Code churn, measured as lines deleted relative to lines added in a quarter, rose 861%.

AI code review is where the cost concentrates. Median time in pull request review increased 441.5%. Pull requests merged with no review at all, human or automated, rose 31.3%. Faros says the more likely explanation is that reviewers cannot keep pace with the volume of AI-generated code, rather than a deliberate change in oversight policy.

One more finding matters for anyone who assumes their team is the exception. Faros reports the same deterioration in organizations with mature DevOps practices and strong DORA scores. The dataset covers only Faros customers, and Faros sells the platform that produced it.

AI amplifies whatever your organization already has

Google Cloud’s DORA program has surveyed software delivery performance for more than a decade. DORA’s 2024 findings linked a 25% rise in AI adoption with a 1.5% drop in delivery throughput and a 7.2% decline in delivery stability.

The 2025 report, based on nearly 5,000 respondents, found that 90% of technology professionals used AI at work, adding to the growing body of generative AI coding statistics. The association with throughput had turned positive. The association with instability had not. DORA’s conclusion is that AI acts as an amplifier: organizations with strong systems get faster, and organizations with weak systems produce failures faster.

In April 2026, DORA followed up with “The ROI of AI-assisted Software Development.” It models adoption as a J-curve, where measured productivity dips before it climbs. The report names three causes of the dip: the learning curve, downstream processes that were never built for this code volume, and what DORA calls the “verification tax,” the effort required to confirm that AI output is correct, secure, and consistent with your architecture.

Don’t assume the security problem is solving itself

Veracode’s 2026 GenAI Code Security Report, released July 28, 2026, tested more than 100 models across four snapshots with no security-specific prompting. The average security pass rate was 56%, virtually the same percentage reported the previous year.

About 44% of code generation tasks produced code with a known security vulnerability, while syntax pass rates were close to 100%.

Models have become almost perfect at producing code that compiles. On security, the average has not moved. The best model in the summer 2026 snapshot passed 68% of security tasks. Six of the 11 newly tested models scored between 50% and 53%. Java had the lowest mean pass rate at 30%.

CodeRabbit’s December 2025 analysis looked at 470 open-source pull requests, 320 co-authored by AI and 150 written by humans alone.

Image Source

AI co-authored pull requests averaged 10.83 review issues each, compared with 6.45 for human-only pull requests, a ratio of about 1.7. Logic and correctness issues were 75% more common. Security issues were up to 2.74 times more common. Readability issues were 3.15 times more common. Unclear naming issues were 1.87 times more common.

Both companies sell security scanning or code review products. Their numbers are still the most detailed ones available.

The new bottleneck is verification, not typing

Ask developers where the extra work goes, and they give a consistent answer.

Stack Overflow’s 2025 Developer Survey, with more than 49,000 respondents, found 84% use or plan to use AI tools, up from 76% the previous year.

Trust in the accuracy of AI output stood at 33%, distrust at 46%, and high trust at 3%. The most common frustration, cited by 66%, is AI solutions that are almost right but not quite. Another 45% said debugging AI-generated code is more time-consuming than writing it.

Sonar’s survey found 96% of developers do not fully trust that AI-generated code is functionally correct, while 48% always verify it before committing. About 38% said reviewing AI code takes more effort than reviewing a colleague’s code.

Stack Overflow’s May 2026 pulse survey of 1,100 developers and working professionals found agent use at work had nearly doubled from 31% to 59% in a year. About 63% said they rarely or never let AI agents run without oversight. Accuracy and security remained the top two concerns, although the share strongly agreeing that accuracy is a barrier fell from 57% to 47%.

The debt that doesn’t live in the code

Margaret-Anne Storey, a professor of computer science at the University of Victoria, argued in February 2026 that AI shifts the main risk from technical debt to cognitive debt. In her words, “technical debt lives in the code; cognitive debt lives in developers’ minds.” A team can lose its shared understanding of why a system is built the way it is even when the generated code reads well.

Thoughtworks added “codebase cognitive debt” to the Caution ring of its April 2026 Technology Radar. Weaker system understanding also reduces developers’ ability to direct AI tools, which compounds the problem.

An Anthropic randomized controlled trial published in January 2026 measured this at the individual level. Developers learning a new Python library with AI assistance scored 17% lower on a comprehension quiz than developers who coded by hand, with the largest gaps on debugging questions. The AI group finished only slightly faster, and that difference was not statistically significant.

METR’s July 2025 randomized trial found experienced open-source developers took 19% longer on tasks when allowed to use AI tools, while believing they had been sped up by 20%.

In February 2026, METR reported that its follow-up could not produce a reliable estimate, because developers increasingly refused to work without AI and withheld tasks from the study. Raw results showed an 18% speedup for returning participants and a 4% speedup for new ones, but both confidence intervals crossed zero. METR’s position is that developers are probably faster with 2026 tools than its 2025 estimate suggested, and that its data is weak evidence for how much.

Mitchell Hashimoto, creator of Terraform and Ghostty, describes the practitioner’s version of this in a February 2026 post. He did every task manually and then again with an agent until he could predict which tasks agents would fail. Part of his time savings, he says, came from knowing when not to use them. He also writes that skill formation in junior developers without strong fundamentals concerns him.

What the data doesn’t prove

None of these datasets isolates AI as the cause. GitClear and Faros measure correlations across periods when many other things changed. Several of the strongest results come from companies that sell tools to detect or fix the problems they report.

The sources also disagree with each other. DORA’s 2025 survey concluded that strong engineering foundations protect against AI’s downsides. Faros’s telemetry found high-performing organizations deteriorated at the same rate as everyone else. METR’s controlled result reversed within a year and then became unmeasurable.

A June 2026 literature review in ACM Transactions on Software Engineering and Methodology, covering 104 academic and practitioner sources, concluded that LLM-assisted development amplifies existing code, design, and documentation debt and introduces new forms. The authors named “fast-integration debt,” where rapidly generated code is merged before its long-term cost is assessed, as the pattern that triggers the others.

How to use AI coding tools to manage technical debt

None of this is an argument against AI in software development. It’s an argument for treating AI output as code that arrives faster than your team can read it, and building the process around that fact. Five practices come up again and again in the research:

1. Measure structure, not volume. GitClear recommends alerts on duplicate blocks and explicit review for error-masking code. Thoughtworks placed “coding throughput as a measure of productivity” in its Caution ring and recommends first-pass acceptance rate and DORA’s rework rate instead.
2. Give agents automated feedback before a human sees the code. Hashimoto calls this harness engineering: every time an agent makes a mistake, add a rule to the project’s AGENTS.md file or a verification script so it never makes that mistake again. Thoughtworks lists the same practice as “feedback sensors for coding agents” and recommends mutation testing to catch AI-written tests that pass without asserting anything.
3. Budget for maintenance. GitClear’s long-term update rate fell 74% in three years. The company recommends allocating explicit time for refactoring and legacy work.
4. Keep verification ahead of generation. Sonar and Veracode both recommend static analysis and security scanning on every AI-assisted change. Faros recommends Git-level line provenance so you can tell rework of recent AI code apart from deliberate refactoring.
5. Protect shared understanding. Storey suggests requiring that at least one person fully understands each AI-generated change before it ships, recording why changes were made rather than only what changed, and treating hesitation to change the system as a warning sign.

How Modularis Helps Teams Build With AI

AI coding can increase development speed, but the data shows that faster code generation does not eliminate the work required to test, review, secure, and maintain that code. Teams need a development process that captures the productivity benefits of AI while keeping those fundamentals in place.

Modularis brings that approach to IoT development with PlatformBuilder, a modular AI code generation platform designed for complex IoT systems. PlatformBuilder helps teams generate and test software before hardware is finalized, giving developers an opportunity to validate software earlier and identify potential problems before they reach deployment.

By combining AI-assisted code generation with a structured development process, PlatformBuilder can help teams move from initial code generation through product development and launch without simply adding more unverified code to an already complex system.

Teams can use PlatformBuilder for applications such as predictive maintenance, connected production lines, asset tracking, and smart factory monitoring.

With more than 500,000 IoT devices supported and over $285 million in exit value created, Modularis helps organizations tackle complex IoT software development across manufacturing, energy, healthcare, and other industries.

Learn more about PlatformBuilder or contact Modularis to schedule a demo.