Code Smells and Verification Gaps

AI is conquering coding. Google, for instance, said in late 2024 that about 25% of its new code was generated by AI. A year later, it reported that the share had doubled to 50%. Then in April 2026, Google said that 75% of its new code was written by AI. Looking forward, Microsoft’s CTO Kevin Scott predicted that 95% of programming code will be AI-generated in the next few years. Yet a growing body of research suggests AI-generated code is creating issues. It is less reliable, harder to maintain, has more security vulnerabilities than human-generated code, and its sheer volume is overwhelming security teams. More Error-Prone than Human Code Recent research from CodeRabbit, an AI-based code-reviewing platform, showed AI-generated code is less reliable than code written by humans. David Loker, director of AI at CodeRabbit, said CodeRabbit is in numerous repositories and open-source systems, so it was a straightforward process to analyze how many bugs were being found by Code Rabbit in pull requests (PRs) authored by humans versus those written by AI systems. In its analysis of 470 pull requests, CodeRabbit found AI code produced an average of 10.83 issues per request, while human-authored code produced 6.45—indicating AI code generated 1.7 times more issues than human code. “Over the past six months, the number of PRs generated per month has increased by over 40%,” Loker noted. “Most PRs we observed are larger, not because AI inherently generates more code, but because it enables faster development. This acceleration means more code is being reviewed and pushed, but it also raises questions about the balance between speed and quality.” Organizations are eager to maximize productivity, but if increased speed leads to more issues, the net benefit is questionable. The ability to quickly build and complete features is often tempered by the reality of fixing bugs, reverting PRs, and managing the resulting complications, Loker said. “Developers may accept AI-generated code without fully understanding why the system made certain implementation choices,” he said, adding it can create long-term maintenance problems. If something breaks later, the original developer may not understand the code well enough to diagnose the issue quickly. Maintenance Issues and Verification Gaps Sonar, an automated code verification platform, published The Coding Personalities of LLMs, which found the single most dominant problem across every large language model it tested is “code smells,“ or hard-to-pinpoint flaws that do not break the code immediately but create serious long-term maintenance headaches. Over 90% of issues found in every AI model fell into this category. “We consider code smells to be maintainability issues, by and large,” said Anirban Chaterjee, Director of Product Marketing at Sonar. He added these are things that would not necessarily cause an outage or a data leak, but they make code more difficult to read and maintain. If too many of these issues pile up over time, the code becomes harder to maintain and manage, and more challenging for downstream developers to understand. “In an AI context, where an AI system is trying to jump into a new codebase and understand what is happening, existing maintainability issues can make it more likely that the AI misunderstands the nature of the code,” Chaterjee said. Jeremy Katz, Sonar’s VP of Code Security, cited the company’s developer survey that found AI tools now account for 42% of all committed code, a figure developers expect to rise to 65% by 2027. The survey also reported 96% of developers do not fully trust AI-generated code to be functionally correct, but alarmingly, less than half say they always check the code before committing. “You have a high volume of AI-generated code being pushed into production without being checked, creating a verification gap,” Katz said, noting developers have limited bandwidth to review all of that code before it gets merged. They are under deadline pressure, reviewing lots of pull requests, and the team size has not necessarily grown. “Code may be pushed through without deep review or verification,” he said, possibly exacerbating maintainability issues and security vulnerabilities as well. Rethinking Security Testing There is an emerging gap between the speed and amount of code generated by AI and security capacity, according to research from ProjectDiscovery, a security testing platform. “Every security practitioner we surveyed told us engineering is shipping faster than it used to, and about half attributed that directly to AI assistance. It’s the new baseline,” said Rishiraj Sharma, CEO of ProjectDiscovery. Sharma observed AI did not just make individual developers quicker; it changed the ratio of how much code gets produced and how much a person can realistically review. “The volume reaching production went up sharply, while the number of people responsible for securing it did not,” Sharma said. “Only about a third of the security teams we surveyed feel they’re comfortably keeping up, and that gap widens every quarter.” The report also found two-thirds of security practitioners spend more than half their week validating findings, rather than fixing issues. “That’s the best kept secret of modern security work,” Sharma said. ”The most skilled people on the team are spending most of their time proving a problem is real before anyone will act on it. The tools meant to save time are often the ones creating the work.” Practitioners who were asked what would make them trust AI in the development loop didn’t say higher accuracy, Sharma said. They want clear reproduction steps, a plain statement of the real-world impact, and enough clarity in how a vulnerability is demonstrated that any team member could follow and reach the same conclusion. Being able to audit exactly what the system found, and why, is the transparency that will inspire trust. Sharma is skeptical AI will be able to replace the security tester, as some have suggested. “I don’t buy it. AI changes what the tester does,” Sharma said. “The future isn’t fully autonomous AI; it’s human-augmented AI, where the machine handles coverage and speed and the human brings business context and judgment.” Sharma said he is optimistic that the same forces creating problems, namely speed, scale, and automation, are the forces that will solve it. “Trust in AI will be earned the way trust always is, which is by being able to accurately check the work,” Sharma concluded. John Delaney is a freelance technology writer based in Hurley, NY, USA. Join the Discussion (0) Become a Member or Sign In to Post a Comment