Liu et al. — Debt Behind the AI Boom
TL;DR
The study that follows AI-generated code after it lands. Prior work showed AI code has quality problems under controlled conditions; this asks whether those problems get fixed or accumulate.
Method — and the method is the contribution. A dataset of 302.6k verified AI-authored commits from 6,299 GitHub repositories, covering five widely used AI coding assistants. For each commit: run static analysis before and after the change, to attribute precisely which code smells, correctness issues and security issues the AI introduced. Then track each introduced issue from its introducing commit to the latest repository revision to study its lifecycle. The before/after differencing is what makes the attribution credible rather than correlational.
Results:
| Distinct issues identified | 484,366 |
| Share that are code smells (maintainability) | 89.3% |
| Commits introducing ≥1 issue, per assistant | >15% for every assistant (rates vary by tool) |
| AI-introduced issues still alive at the latest revision | 22.7% |
The 22.7% is the finding. Roughly one in five defects that AI introduces is never fixed. Not “found late” — still present when the researchers looked. This is what makes the paper about technical debt rather than about code quality: a defect that gets fixed next sprint is a cost; a defect that survives indefinitely is a liability sitting on the balance sheet, and it compounds with every subsequent change to the same code.
The 89.3% code-smell share cuts both ways. Reassuring: most of what AI introduces is maintainability, not security or correctness. Unreassuring: maintainability debt is precisely the category with no forcing function — nothing breaks, no test fails, no incident fires, so nothing makes anyone fix it. That is a plausible explanation for the 22.7% survival rate, and it means the debt is concentrated in the category least likely to be paid down voluntarily.
Where this sits in the corpus. Cui et al. measure +26.08% completed tasks. Abujadallah et al. measure 46.41% of agent fixes rejected before merge. This paper measures what happens to what does merge. Reading the three together: a large fraction of agent output is discarded at review, and a meaningful fraction of what survives review carries defects that are never repaired. The throughput number is real; so is everything downstream of it, and only the first is usually counted.
Two sources bracket this one. Veracode measures what AI writes under test conditions — 45% of samples introducing OWASP Top 10 flaws, flat across model size and vintage — and this study measures what survives after those changes merge. DORA observes the consequence at survey scale: AI adoption’s relationship with delivery stability stayed negative even as throughput turned positive. This paper names what is accumulating inside that instability.
Dynamic-capabilities reading
contextual/internal-barriers— accumulating unfixed maintainability debt is a compounding barrier to future change velocity, and it is invisible to the metrics that justified adopting the tooling.digital-transforming/improving-digital-maturity— the paper’s closing call for “stronger quality assurance in AI-assisted development” is a maturity prescription, and the before/after static-analysis method is itself an adoptable maturity practice.
Linked entities and concepts
- Entities: GitHub
- Concepts: ai-generated-code-quality, agentic-pull-requests, ai-coding-productivity-evidence, agentic-engineering
- Dangling (single-source mention, deferred): Yue Liu, Ratnadira Widyasari, Yanjie Zhao, Ivana Clairine Irsan, Junkai Chen, David Lo
Scope and reliability
Abstract only — the per-tool breakdown, the issue-severity distribution, and the survival curve shape were not read. The per-tool rates in particular are worth recovering, since “>15% for every assistant, rates vary” is doing a lot of work without disclosing the range. Two methodological limits to hold: static analysis defines what counts as an issue, so the 484,366 figure is “issues a static analyser flags,” which over-counts style and under-counts logic; and “verified AI-authored” depends on commit attribution, which will miss AI-assisted code a human committed under their own name — biasing toward the most visibly agentic work. Survival is measured against the latest revision at study time, so an issue in a recent commit has had less opportunity to be fixed than one in an old commit; whether the analysis adjusts for exposure time is not visible from the abstract.