AI now accounts for roughly 42% of committed code and is expected to reach 65% by 2027. An independent study of more than 300,000 AI-authored commits found that nearly a quarter of the problems AI introduces remain in the repository in their latest versions. The productivity is booked immediately. The maintenance is not.
Every engineering organization I talk to can tell me how much faster they ship now. Almost none of them can tell me what it costs to keep what they shipped.
That is not a criticism of anyone's judgment. Velocity is easy to measure and easy to celebrate. Maintenance burden is diffuse, arrives later, and shows up in the budget as "the team seems slower than it used to be" rather than as a line item. But research published over the past eight months has begun to quantify the second half of the equation, and the numbers are specific enough to plan around.
Start with the volume. Sonar's State of Code survey, fielded in October 2025 across more than 1,100 developers and published in January 2026, found that AI accounts for 42% of all committed code today, with respondents expecting that to reach 65% by 2027. In the same survey, 96% said they do not fully trust AI-generated code to be functionally correct, and only 48% said they always review AI-assisted code before committing it.
Hold those two findings next to each other. Nearly everyone doubts the output. Barely half consistently check it. The gap between those figures is where the cleanup bill accumulates.
Is AI-Generated Code Actually Creating Technical Debt?
Yes, and the effect is now measurable in repositories rather than only in surveys. An independent study of 302,600 verified AI-authored commits across 6,299 GitHub repositories, published in March 2026, identified 484,366 distinct issues. More than 15% of commits from each assistant studied introduced at least one issue, and 22.7% of those issues persisted in the repository's latest version. The debt is real, and most of it is not being paid down.
That study, from a team at Singapore Management University and collaborators, matters because it is not vendor research. It ran static analysis before and after each AI-authored change, then tracked those issues throughout the repository's life. Of the issues found, 89.3% were classified as code smells rather than outright defects, which is precisely the profile of technical debt: not code that fails today, but code that makes tomorrow's change more expensive.
The persistence figure is the one I would put in front of a board. Nearly a quarter of everything AI introduced is still there. Teams are not quietly cleaning up behind the tools. They are accumulating.
A second independent study, published around May 2026 and using the AIDev dataset of more than 456,000 pull requests across roughly 61,000 repositories, adds the operational punchline. In a matched comparison of 508 AI-generated and 508 human-written files across 100 repositories, researchers found that 83.21% of the commits maintaining AI-generated files were made by humans, and only 16.79% by AI agents.
That is the structural problem in one statistic. The tools that generate code at machine speed are not the ones that maintain it. People are. And headcount did not grow by 42%.
In fairness, the same paper found that bug fixes accounted for 11.73% of changes in AI-generated files, compared with 16.76% in human-written files, and that AI files saw roughly half the commit volume in their first month. AI-written code is not uniformly worse on every dimension, and any leader who tells you the research says otherwise has not read it. The problem is narrower and more specific than "AI writes bad code."
Why Does AI-Generated Code Accumulate Debt Differently?
Because the tools are extraordinarily good at producing code and structurally uninterested in reorganizing it. GitClear's analysis of 623 million analyzed code changes from 2022 through 2026 found that block-level duplication rose 81%, and copy-pasted lines climbed from 9.4% of changes in 2022 to 15.7% by 2026.
The more revealing metric in that same data set is what happened to refactoring. Moved code, which GitClear uses as a proxy for the reorganizing work that keeps a codebase coherent, fell from 21% of changes in 2022 to 13% in 2023 and 3.8% by 2026. Cross-file function connectivity dropped 35% since 2023. Error-masking constructs, defensive patterns that suppress failure rather than fix it, rose by 47%.
Read those together, and a picture emerges that matches what engineering leaders describe anecdotally. When a developer needs functionality that already exists somewhere in the codebase, the historical path was to find it, extract it, and reuse it. The current path is to ask a model to produce a working local implementation in seconds, without knowing or caring that a similar function exists three directories over. The local decision is rational every single time. The aggregate result is a codebase with more duplication, less structure, and fewer people who understand how the parts relate to one another.
Sonar's survey captures the human cost of that. Fifty-three percent of respondents attributed a negative technical-debt impact to AI producing code that looked correct but was not reliable, and 38% said reviewing AI-generated code requires more effort than reviewing human-written code. Review was already the bottleneck in most organizations. AI generation widened the pipe feeding into it without widening the pipe itself.
Security follows the same pattern. Veracode's 2026 GenAI Code Security Report, published in July 2026, found that roughly 44% of AI code generation tasks introduced a risky security vulnerability, with an overall pass rate of 56%, essentially unchanged from the prior year. Notably, the models perform well on some categories and badly on others: SQL injection passed 83% of the time and cryptographic implementation 87%, while cross-site scripting passed just 15% and log injection 12%. The models learned syntax. They did not learn threat modeling. We covered the testing implications of this in our piece on how to test software when AI writes half of it.
It is worth saying plainly that Sonar, GitClear, and Veracode all sell products that address the problems their research identifies. That does not make the findings wrong, and the two independent academic studies point in the same direction, but the framing deserves the skepticism you would apply to any vendor-sponsored research.
What Should Engineering Leaders Actually Do?
The answer is not to slow down generation. Sonar's own data found that 93% of respondents also reported positive impacts from AI coding tools, with 57% citing improved documentation, and that is a separate multi-select question rather than a rival camp. Most developers are experiencing both effects at once. The task is to fund the second half of the workflow, not to abandon the first.
Measure duplication and coupling, not just velocity. If your engineering dashboard tracks deployment frequency and cycle time but not duplication, coupling, or code health, you are instrumented to see the benefits but blind to the costs. Add the second set of metrics before the trend line matters, because by the time it shows up in delivery speed, you are paying interest on two years of accumulation.
Treat review capacity as the real constraint. Generation throughput went up sharply. Review throughput did not. When 38% of developers report that reviewing AI code takes more effort and only 48% consistently review it at all, the honest conclusion is that review is under-resourced relative to the volume flowing into it. Either constrain what gets merged without review, or properly fund review capacity.
Reintroduce refactoring as scheduled work, not heroism. A drop in reorganizing work from 21% of changes to 3.8% is not a cultural failure; it is what happens when nobody is assigned to it, and the tools do not volunteer. Some organizations are seeing good results by allocating a fixed share of each sprint to consolidation, with the specific goal of collapsing duplicated implementations that AI generated independently.
Close the shadow-tooling gap. Sonar found that 35% of developers access AI coding tools through personal accounts, meaning a meaningful share of generated code enters the codebase outside whatever governance you believe you have in place. That is the same failure mode we described in our work on AI agent governance and shadow AI, and the fix is the same: make the sanctioned path better than the unsanctioned one rather than trying to police the unsanctioned one.
Get security review to the categories the models fail. Given that AI-generated code passes SQL injection checks 83% of the time and cross-site scripting checks 15% of the time, generic "review the AI code" guidance is a waste of effort. Target the categories with known model weakness, and automate the checks in the pipeline rather than relying on human attention. This is standard DevOps and pipeline engineering work, and it is considerably cheaper than the incident it prevents.
Staff for maintenance, not only for delivery. If 83% of the commits maintaining AI-generated code come from humans, and AI is heading toward 65% of committed code by 2027, the arithmetic on required maintenance capacity is not subtle. Organizations that cut engineering headcount on the assumption that AI will absorb the work are solving only half of a two-part problem. A dedicated engineering team with real ownership of code health is a more defensible structure than a smaller team plus a faster tool, and choosing the right partner for that work is an exercise in itself, which we covered in our guide to selecting an AI development partner.
Common Questions About AI Code and Technical Debt
How much of enterprise code is written by AI now?
Sonar's State of Code survey of more than 1,100 developers, fielded in October 2025, found that AI accounts for approximately 42% of all committed code, with respondents expecting it to reach roughly 65% by 2027. That figure includes both fully generated and AI-assisted code rather than only autonomous output.
Does AI-generated code have more bugs than human-written code?
Not straightforwardly. Research on more than 456,000 pull requests found bug fixes made up 11.73% of changes to AI-generated files versus 16.76% for human-written files. The more consistent finding is structural rather than defect-related: more duplication, less refactoring, weaker cross-file connectivity, and issues that persist rather than getting cleaned up. Debt rather than breakage.
What is the biggest risk from AI-generated code?
Accumulation without cleanup. A study of 302,600 AI-authored commits found 22.7% of the issues AI introduced were still present at the repository's latest version, and 89.3% of the issues were code smells rather than outright defects. That combination describes a codebase that works today and costs progressively more to change.
How do we control AI code quality without slowing developers down?
Automate what can be automated and target human review where models are demonstrably weak. Put duplication, coupling, and code-health checks in the pipeline. Concentrate security review on categories with low model pass rates such as cross-site scripting and log injection. Schedule consolidation work rather than hoping it happens, and ensure sanctioned tooling is robust enough that developers do not route around it.
The organizations that will be in trouble in 2027 are not the ones that aggressively adopted AI coding tools. They are the ones that adopted them aggressively and staffed only for generation. Talk to the Golabs team about instrumenting code health, reviewing resourcing, and building an engineering function sized to handle the maintenance already accruing.