In 2025, AI coding tools already wrote a big share of new code. The gains in speed were real. Developers shipped faster. Pull requests flew through review at record rates.

But speed and quality are not the same thing.

New research from 2025 and 2026 now proves what many developers feared. AI coding assistants make devs faster. But the code is buggier, less secure, and harder to maintain.

The Numbers Are Hard to Ignore

CodeRabbit looked at 470 real open-source pull requests. It found that AI code has about 1.7 times more issues than human code. AI pull requests averaged 10.83 issues each. Human ones averaged 6.45. The defects hit every major quality area: logic, maintainability, security, and performance. Logic and correctness errors rose by 75% in machine-generated code.

Secure Code Warrior tested 1,760 full codebases from 16 frontier models. The models came from OpenAI, Anthropic, Google, and others. Machine-generated code had 15 confirmed vulnerabilities per codebase on average. That includes 4.3 critical or high-severity flaws. Across all codebases, researchers found more than 27,000 vulnerabilities.

Nearly one-third of machine-generated code samples were fully exploitable. IOActive's May 2026 analysis confirmed this. No model produced 100% secure code. Even the best setup still gave 90 vulnerabilities.

The Software Improvement Group looked at 30,000 enterprise systems. Machine-generated code had roughly twice as many security-risk violations as human code. More than half of machine-generated codebases contained vulnerabilities. SIG found that 86% of code in its benchmark falls below recommended maintainability. 71% scored low on security controls.

The pattern is the same everywhere. The gap is measurable. And it keeps growing.

The Productivity Trap

The gap is clearest when you compare what AI tools can do versus what they actually do.

A Checkmarx study tested four leading models. They tested Claude Opus 4.8, GPT-5.5, Gemini 3.1 Pro, and Gemini 3.5 Flash. The models solved 200 coding tasks. Newer models scored 83% to 95% correct. Older models scored 44% to 61%. Coding performance had jumped sharply.

But security did not keep up. Only 24% to 36% of answers were both functional and free of the target security flaw. Two-thirds to three-quarters of working outputs still had the exact weakness they should have dodged.

The study also found that knowing about known flaws did not stop models from repeating them. This happened even when the flaws were public before the models trained. Models could pick the right fix when asked directly. But they failed to apply it when writing the final code. In several cases, a model wrote the exact defense needed in its planning notes. Then it generated a broken version anyway.

Eran Kinsbruner, VP at Checkmarx, said: "The most striking thing here is not that AI models make security mistakes. It's that they often know better and do it anyway. That is not a knowledge gap. It is an execution gap."

The Maintenance Nightmare

The quality problem is not just about security. It also hits long-term maintainability. The numbers are just as grim.

A large-scale study found that machine-generated code is simpler and more repetitive. It also has more unused code and hardcoded debugging. Code duplication rose 4x compared to 2021 baselines. Code churn doubled.

The same study found a "Verification Bottleneck." Senior devs now spend more time checking and fixing AI logic. The speed gains can vanish once a codebase gets big enough. Large language models struggle with complex software architecture.

SIG found that autonomous AI agents built a system in one week. The code was "nearly unmaintainable." It also cost a lot in tokens. SIG estimates that reducing code-level debt can save 870,000 euros per system per year. The hidden costs are huge.

In one case, fixing the machine-generated code cost more than rewriting it from scratch.

The Production Crisis

These problems do not stay in development. They show up in production.

New Relic's 2026 State of AI Coding report found that 82% of firms had at least one production failure tied to machine-generated code in the past six months. Only 19% had no code issues at all.

One analysis found that critical issues rose from 240 per 100 PRs in human code to 341 in machine-generated code. That is a 40% jump. Major issues rose from 257 to 447. That is a 70% increase.

GitClear's 2025 research looked at 211 million lines of code. Code churn — broken code thrown away within two weeks — is rising fast. The churn rate may double. This creates big risks for DevOps teams deploying to production.

The Human Cost

There is another side to this crisis. The numbers do not fully capture it.

A controlled study found that devs who used AI scored lower on a follow-up test. They understood less than devs who did the same tasks without AI. Those who fully delegated coding to AI showed the worst skill loss.

This has a name: "cognitive surrender." Devs are getting worse at understanding the code their AI tools write. They ship faster. But they learn less. And the debt will be paid by someone else.

What This Means

The AI coding industry sold a story about productivity. The data shows a more messy reality. Devs write more code, faster. But the code has more bugs and security holes. It is harder to maintain. And the people writing it understand it less.

The speed gains are real. But they come with hidden costs. Those costs include security flaws, technical debt, production crashes, and a generation of devs who outsource their learning to machines.

The question is not whether AI tools are useful. They are. The question is whether the industry will face the costs. And whether it will build the review and quality practices needed to manage them.

As SIG CEO Luc Brandts put it: "Nothing here is an argument against AI. The productivity gains are real. Firms that ignore it risk falling behind. But you cannot manage what you do not measure. And you cannot sustain speed on a foundation you do not understand."

The code quality crisis is real. The data is clear. The only question is whether the industry will pay attention before the debt becomes too large.

Sources

  1. CodeRabbit "State of AI vs Human Code Generation" Report (December 2025)
  2. Secure Code Warrior AI Trust Index (July 2026)
  3. IOActive "The Security Gap in Machine-Generated Code" (May 2026)
  4. Checkmarx/The Weather Report coding security study (July 2026)
  5. Software Improvement Group State of Software 2026 report (June 2026)
  6. Zenodo "The Productivity-Quality Paradox" study (January 2026)
  7. New Relic State of AI Coding 2026 report (June 2026)
  8. GitClear AI Code Quality Research (2025)
  9. arXiv study (November 2025)

Disclaimer: The analysis above is based on publicly available data as of July 27, 2026. All benchmark scores, pricing, and performance claims are sourced from the respective companies' published materials. I am not affiliated with any of the companies mentioned unless explicitly stated. For the most current information, please visit the official sources linked throughout this article.