In May 2026, the UK's National Cyber Security Centre issued a warning that had less to do with hackers than with history.
Ollie Whitehouse, the NCSC's Chief Technology Officer, wrote that AI, "when used by sufficiently-skilled and knowledgeable individuals, is showing the ability to exploit this technical debt at scale and at pace across the technology ecosystem." The result, he predicted, would be a "forced correction" — a patch wave that would arrive across open source, commercial, proprietary, and software-as-a-service systems all at once.
The warning reframed a problem the software industry has spent decades treating as a slow-moving cost of doing business. Technical debt — the accumulated shortcuts, outdated dependencies, and unrefactored code that every large codebase carries — was always assumed to be manageable. You pay it down gradually. You live with some of it indefinitely. You prioritize the parts that hurt the most.
AI changes the timeline. The NCSC's concern was not that AI is creating new debt. It is that AI is excavating old debt — decades of buried flaws that human security researchers never had the bandwidth to find — and surfacing them faster than the industry's patching infrastructure was built to handle.
That is the first crisis. A second one is less visible, and arguably more consequential.
What the Numbers Show
The data describing AI's effect on code quality has become impossible to ignore.
GitClear and GitKraken analyzed 623 million real-world code changes from 2023 to 2026. The findings were consistent across eight maintainability metrics. Code duplication rose 81 percent. Code reuse fell 70 percent. Legacy refactoring — changes to code last touched more than twelve months ago — dropped 74 percent since 2023. Functional connectivity, a measure of how often new code calls into existing functions, fell 35 percent.
"What AI is doing is creating a new package every time you want something," said Bill Harding, CEO of GitClear. "That general approach to building has all sorts of consequences."
The consequence he described is a shift in how codebases grow. Instead of accumulating shared libraries and reusable components, AI-assisted development produces parallel implementations of the same logic — five slightly different versions of the same function, none of them aware of the others. "In the long term it starts to get painful," Harding said, "when you realize you have five different implementations of the same thing that are similar yet different."
A separate study published on arXiv in June 2026 analyzed AI-generated code "in the wild" and identified 484,366 distinct issues, with code smells accounting for 89.3 percent of all problems. The Software Improvement Group, which benchmarks enterprise codebases, found that AI-generated code showed roughly twice as many security-risk violations as human-written code, while more than half contained vulnerabilities.
AI writes code that passes tests, compiles cleanly, and looks correct — while quietly eroding the structural properties that make large systems maintainable.
The Debt That Has No Scanner
A second category of debt is harder to measure, and it worries engineers more.
In May 2026, developer and YouTuber Theo Browne published a video analyzing an essay by Lars Fay. Fay had introduced a distinction that resonated across Hacker News and developer communities: the difference between technical debt and cognitive debt.
Technical debt is a measurable property of code. You can scan for it. Cognitive debt is a property of people. You cannot scan for it, and it does not appear on any dashboard.
The distinction matters because AI is remarkably good at paying down technical debt and remarkably bad at preventing cognitive debt. Need to migrate 8,000 TypeScript files after a breaking change? AI can handle it. Need to refactor a tangled dependency graph into something clean? AI can help. The work that used to consume weeks of developer time — the tedious, mechanical parts of maintaining a large codebase — is exactly the work that AI accelerates most effectively.
But the developer who uses AI to refactor 8,000 files does not learn how those files connect. The developer who uses AI to generate a new service does not internalize why the service is structured the way it is. The code gets cleaner. The person responsible for it becomes less capable of understanding it.
Fay called this the "paradox of supervision": using AI coding agents requires the critical thinking skills that AI coding agents erode. To supervise AI effectively, you need to understand the code it produces. But the more you rely on AI to produce code, the less you understand it.
Theo put it differently: AI "disincentivizes you from learning about the pieces." It turns coding into a slot machine — pull the lever, get an answer — rather than a practice that builds understanding through repetition and struggle.
What China Measures That America Doesn't
The American response to AI technical debt has focused on measurement. GitClear tracks duplication and churn. New Relic surveys leaders who believe AI code is better while incidents climb. CodeScene measures code health degradation. The tools exist, the dashboards exist, and the reports keep coming.
The Chinese software industry has taken a different approach, shaped by a different institutional context.
In August 2026, the Chinese developer platform InfoQ published an analysis of what it called "comprehension debt" — the gap between code that works and code that the team understands. The article cited a Sonar survey from Q2 2026: 88 percent of developers reported that AI-generated code produced negative outcomes, and 53 percent said AI code "looks correct but is unreliable" — the direct expression of comprehension debt.
The numbers describing the same phenomenon in China are nearly identical to the American data. But the response is different.
Where American engineering culture tends toward visibility and voluntary adoption — build the metrics, publish the dashboards, let teams decide — Chinese tooling and standards have leaned toward enforcement and gating. The SITS2026 standard, released in October 2025 and mandatory since March 2026, brings AI-assisted coding tools into a mandatory security audit framework for high-risk sectors including finance, healthcare, and critical infrastructure.
Chinese enterprise code scanning tools like CodeGuardian and Alibaba Cloud's Agentic Code Security are designed to block code at the CI/CD pipeline, not just report on it. If the code fails a quality or security threshold, it does not merge. The assumption is that only enforcement changes behavior — not visibility alone.
Neither approach has solved the problem. The 623-million-change GitClear dataset comes from American repositories. The Sonar survey that found 88 percent negative outcomes was global. The comprehension debt that InfoQ described is accumulating in Chinese codebases just as it is in American ones.
The difference in response reveals something about the two systems. American engineering culture trusts measurement to drive improvement. Chinese engineering culture trusts gates. One assumes that visibility changes behavior. The other assumes it doesn't.
The Debt That Arrives All at Once
The NCSC's patch wave warning is the clearest expression of what AI technical debt means in practice.
Technical debt is usually a slow leak. You fix the most urgent problems. You defer the rest. The system keeps running. The debt accumulates, but it accumulates gradually enough that no single decision seems catastrophic.
AI changes the math. When AI can find a 27-year-old bug in OpenBSD in hours, and when a single model can surface over 2,000 previously unknown flaws across major operating systems, the debt that accumulated over decades becomes visible in weeks. The NCSC's phrase — "arriving all at once" — is not rhetorical. It describes a scheduling problem. The vulnerabilities were always there. AI just moved the discovery timeline from "eventually" to "now."
The organizations that fare best in that scenario are not the ones with the cleanest codebases. They are the ones with the fastest patching infrastructure and the clearest prioritization frameworks. The NCSC's guidance is explicit: reduce attack surface, prioritize perimeter systems, enable automatic patching where possible, and use risk-based categorization when automation isn't available.
What the guidance does not say — because it cannot — is what to do about the cognitive debt. The code will get patched. The people who wrote it, or supervised its writing, will not necessarily understand it any better afterward.
The Real Question
The technical debt conversation has always been about code. AI has made it about something else.
The code is getting worse in measurable ways. Duplication is up. Reuse is down. Legacy refactoring has collapsed. Security violations have doubled. These are real problems, and they are accumulating faster than they did before AI.
But the deeper problem is that the people managing the code are learning less. The developer who spends a week refactoring a service by hand understands that service in a way that the developer who spent an afternoon prompting an AI never will. The comprehension debt compounds alongside the technical debt, and it is harder to pay down.
The NCSC has warned of a patch wave. GitClear has quantified the maintainability gap. Sonar has documented the comprehension gap. The tools to measure the problem exist. The frameworks to address it exist. What remains unclear is whether the industry will treat cognitive debt as a problem worth solving — or whether it will keep building faster than it can understand.
Sources: NCSC "Prepare for vulnerability patch wave" (May 2026); NCSC "The Vibe Coding Spectrum" (June 18, 2026); LeadDev "AI code is creating a new kind of technical debt" (July 22, 2026); GitClear 2026 AI Code Quality Research via LeadDev; arXiv:2606.xxxxx "Debt Behind the AI Boom" (June 2026); InfoQ CN (August 2026); Sonar Q2 2026 survey; SITS2026 standard documentation; The Software Improvement Group State of Software 2026 report.
Disclaimer
The information provided in this article is for general informational and educational purposes only. It does not constitute legal, financial, or professional advice. The author and publisher are not responsible for any actions taken based on the content of this article. Readers should consult qualified professionals for advice specific to their situation. All trademarks and references to third-party products, services, or organizations are the property of their respective owners. The performance data and benchmarks discussed are based on specific research studies and may not generalize to all use cases or environments. As of the publication date, the AI landscape continues to evolve rapidly, and readers should verify current information independently.
Limitations
This analysis is based on reporting and public data available as of the article date; figures may be revised as sources update.
Forecasts from third-party analysts can change with market conditions.
Cost and pricing examples are point-in-time estimates; actual rates vary.
Country and company comparisons rely on public reporting, not operational data.
This sector moves fast; timelines and deal terms may be updated later.
Company deals and regulatory rulings may evolve; verify current status.
AI infrastructure is changing quickly; claims can become outdated soon.
Sources
- NCSC "Prepare for vulnerability patch wave" (May 2026)
- NCSC "The Vibe Coding Spectrum" (June 18, 2026)
- LeadDev "AI code is creating a new kind of technical debt" (July 22, 2026)
- GitClear 2026 AI Code Quality Research via LeadDev
- arXiv:2606.xxxxx "Debt Behind the AI Boom" (June 2026)
- InfoQ CN (August 2026)
- Sonar Q2 2026 survey
- SITS2026 standard documentation
- The Software Improvement Group State of Software 2026 report.
The information provided in this article is for general informational and educational purposes only. It does not constitute legal, financial, or professional advice. The author and publisher are not responsible for any actions taken based on the content of this article. Readers should consult qualified professionals for advice specific to their situation. All trademarks and references to third-party products, services, or organizations are the property of their respective owners. The performance data and benchmarks discussed are based on specific research studies and may not generalize to all use cases or environments. As of the publication date, the AI landscape continues to evolve rapidly, and readers should verify current information independently.
Limitations: This analysis is based on reporting and public data available as of the article date; figures may be revised as sources update.; Forecasts from third-party analysts can change with market conditions.; Cost and pricing examples are point-in-time estimates; actual rates vary.; Country and company comparisons rely on public reporting, not operational data.; This sector moves fast; timelines and deal terms may be updated later.; Company deals and regulatory rulings may evolve; verify current status.; AI infrastructure is changing quickly; claims can become outdated soon.