The Hidden Cost of AI-Generated Code

AI coding tools have a speed problem, and oddly enough it's that they're too fast. Code that takes seconds to generate can take hours to review, days to debug and months to maintain, so the productivity gains that look great in a sprint demo can quietly reverse themselves over a product's lifetime.

Three major independent studies published in 2025, from GitClear, METR and Google's DORA programme, all reach the same conclusion: AI-generated code brings measurable costs that most engineering organisations aren't tracking. The speed is real and so is the maintenance burden, so the question for CTOs and engineering managers is whether the trade-off is worth it, and how to tip the balance.

The Speed Illusion

The headline numbers look good. GitHub reports that developers complete tasks 55% faster with Copilot, and Google's internal study found a 21% speed improvement on standardised coding tasks. Every vendor survey tells the same story, that AI makes developers faster.

But writing code faster doesn't mean delivering working software faster. Writing code is perhaps 20% of what software engineers actually do, and the rest of their time goes on understanding requirements, designing solutions, reviewing changes, debugging failures and maintaining systems. That's exactly the part where AI-generated code is making things harder.

The 2025 Stack Overflow developer survey, covering nearly 49,000 respondents, found that 66% of developers spend more time fixing "almost-right" AI-generated code than they would writing it from scratch. The number one frustration, cited by 45% of developers, is AI solutions that are close enough to look correct but different enough to need careful debugging. That gap between producing code and actually delivering it is where the hidden costs build up.

What the Research Shows

GitClear: The Duplication Problem

GitClear's 2025 code quality research, analysing 211 million lines of code changes across thousands of repositories from 2020 to 2024, documented a big shift in how code is being written.

Code duplication increased eightfold in 2024 compared to pre-AI baselines. Copy-pasted code, meaning blocks of code copied from one place to another without abstraction, rose from below 10% to nearly 15% of all changes. At the same time, refactoring activity fell from 24.1% of code changes in 2020 to just 9.5% in 2024.

For the first time in the study's history, the introduction of duplicated code exceeded refactoring activity, so more duplication was being added than was being cleaned up and the debt in the codebase was growing.

This happens because when you prompt an AI to solve a problem, it generates a solution from patterns in its training data, and it doesn't check whether your codebase already has a utility function that does the same thing or know about your shared component library. So it writes new code that solves the immediate problem while duplicating logic that already exists elsewhere. Multiply that across thousands of prompts per month across a development team, and the duplication builds up quickly.

Six months later, you can have the same business logic written in four slightly different ways across your codebase. When that logic needs to change, you have to find and update all four, assuming you know they all exist.

METR: The Productivity Paradox

The METR study came up with one of the most surprising findings in software engineering research. In a randomised controlled trial, 16 experienced open-source developers working on their own repositories, codebases they had maintained for years, averaging over 22,000 GitHub stars, were 19% slower when using AI tools compared to working without them.

The gap between what the developers thought and what actually happened made it even more striking. Before the study, they predicted AI would speed them up by 24%, and after completing the tasks they still believed AI had made them 20% faster, when the measurements showed the opposite.

The time went on the review cycle rather than on obviously broken code: generating code, checking whether it matched the existing codebase's patterns, spotting small mismatches, correcting the agent's assumptions and making sure the changes worked properly in context. On codebases the developers knew really well, supervising the AI took more time than the faster code generation saved.

A separate study by Xu and colleagues at arXiv (2510.10165) found a similar pattern when looking at Copilot's impact on GitHub repositories. Experienced core developers reviewed 6.5% more code after Copilot's introduction but showed a 19% drop in their own original code productivity. The productivity increase came almost entirely from less-experienced peripheral contributors, who increased their commit activity by 43.5%. But that surge came with 2.4% more code rework, which suggests the extra contributions needed more maintenance work to bring them up to the repository's standards.

For engineering managers that's an awkward result, because the developers who gain most from AI tools are the ones who need the most review, and the developers doing the reviewing are made less productive by the tools they're reviewing.

DORA 2025: AI as Amplifier

Google's DORA programme, the most comprehensive ongoing study of software delivery performance, gave its 2025 report over to AI's impact on engineering organisations. Its central finding was that AI acts as an amplifier, making an organisation's existing strengths and weaknesses bigger.

A 90% increase in AI adoption was associated with a 91% increase in code review time, a 154% increase in pull request size and a 9% climb in bug rates. For high-performing organisations with solid engineering foundations, AI adoption still correlated with improved delivery performance, but for organisations without those foundations, it correlated with decreased team performance, increased friction and greater instability.

The report introduced the DORA AI Capabilities Model, which sets out seven foundational capabilities that decide whether AI helps or harms:

1. Clear and communicated AI stance: explicit policies about when and how AI tools should be used
2. Healthy data ecosystems: high-quality, accessible internal data
3. AI-accessible internal data: connecting AI to repositories, documentation and decision logs
4. Strong version control practices: disciplined branching, merging and commit history
5. Working in small batches: breaking work into reviewable, testable increments
6. User-centric focus: keeping the focus on user outcomes rather than code output
7. Quality internal platforms: automated, secure deployment pathways

The "working in small batches" capability is especially relevant to maintenance. The DORA researchers found that AI can easily generate huge blocks of code that are hard to review and test, and sticking to small batches counters this risk, so the extra speed turns into better product performance rather than instability. If your organisation lacks these capabilities and adopts AI tools anyway, the research suggests things will actually get worse.

CodeRabbit: Issue Density

CodeRabbit's analysis of 470 open-source pull requests gave detailed data on the quality gap between AI-generated and human-written code. AI-generated pull requests averaged 10.83 issues each, compared to 6.45 for human-written PRs, approximately 1.7 times more issues overall.

The breakdown by category:

• Logic and correctness errors: 1.75 times higher
• Code quality and maintainability: 1.64 times higher
• Security findings: 1.57 times higher
• Performance issues: 1.42 times higher

Specific security vulnerabilities showed even wider gaps. AI-generated code was 2.74 times more likely to introduce cross-site scripting vulnerabilities, 1.91 times more likely to create insecure object references and 1.88 times more likely to implement improper password handling.

Each of these issues is future maintenance work. A logic error turns into a bug report, a maintainability issue turns into a refactoring task and a security finding turns into an urgent patch, so code that was quick to write keeps costing time long after it's merged.

Code Churn: What AI-Generated Code Looks Like Six Months Later

Thoughtworks placed "complacency with AI-generated code" in the Hold ring of their Technology Radar, their strongest caution category, noting that Microsoft's own research on knowledge workers shows that AI-driven confidence often comes at the expense of critical thinking. The pattern gets stronger with coding agents, which generate larger change sets that are harder to review.

The churn pattern for AI-generated code tends to follow the same cycle:

1. Generation: code is produced quickly, passes initial tests, gets merged
2. Discovery: a bug turns up, or a new requirement shows an assumption the AI got wrong
3. Investigation: a developer spends time understanding what the AI wrote and why it doesn't work
4. Rework: the developer either patches the AI's code or rewrites it
5. Repeat: the next AI-generated change interacts with the patch, creating new inconsistencies

GitClear's data backs this cycle up with numbers. Code churn, the percentage of code revised within two weeks of initial commit, nearly doubled from 3.1% in 2020 to 5.7% in 2024. Code that was fast to produce is being changed or thrown away at higher rates than code that took longer to write in the first place.

Practical Mitigation

The research doesn't argue against using AI coding tools, only against using them without guardrails. The organisations seeing genuine maintenance reductions treat AI-generated code with the same care they'd give code from a new hire, which means more review rather than less.

Automated Quality Gates

Pre-commit hooks that enforce formatting, linting and basic security scanning catch the easy issues before they get into the codebase. In an AI-assisted workflow you need them as part of the basic setup.

Claude Code hooks, for example, can automatically run Prettier on every file the agent edits, block destructive commands and enforce protected file patterns. Similar automation exists in Cursor, Copilot and every major AI coding tool. Setting it up takes minutes, and it saves hours of maintenance each week.

Mandatory Review for AI-Generated Code

The 2025 DORA report's emphasis on strong version control practices carries straight over to review policy. Every AI-generated change should go through the same pull request process as human-written code, so if your team reviews human code, it should review AI code too. If anything, AI-generated code needs more scrutiny, because the reviewer can't assume the author understood why they wrote it that way.

Some organisations go further and ask for AI-generated PRs to be clearly tagged, so reviewers know to look harder for the patterns the research picks out: duplication, security shortcuts and logic errors.

Test Coverage as a Safety Net

AI tools are good at generating tests, but there's an important catch. GitHub's empirical study found that 45% of Copilot-generated tests pass when an existing test suite provides context. Without an existing test suite, 92% of generated tests are failing, broken or empty.

So it's best to use AI to add to test coverage you already have. Start with a solid baseline of human-written tests for critical paths, then use AI to fill coverage gaps for edge cases, error handling and boundary conditions. The existing tests give the AI the patterns it needs to generate useful new ones.

Duplication Detection

Given the eightfold increase in code duplication documented by GitClear, automated duplication detection is well worth adding. Tools like jscpd, PMD CPD or SonarQube's duplication analysis should be part of your CI pipelines. When duplication goes over a threshold, the build fails, which forces either abstraction or a clear justification.

Architecture Decision Records

AI agents don't understand your architectural decisions because they weren't in the room when those decisions were made. Keeping lightweight Architecture Decision Records (ADRs) that explain why your system is structured the way it is gives both AI tools and human reviewers the context they need to judge whether a change fits where the system is heading.

The Balanced View

The data shows clearly that AI-generated code costs more to maintain in several measurable ways, and it shows just as clearly that AI tools give real value in specific areas.

Where AI reduces maintenance burden:

• Test generation with existing suite context improves coverage without the tedium of writing every assertion by hand
• Documentation generated from code is rarely perfect but gives you a starting point that is faster to edit than to write from scratch
• Boilerplate and repetitive patterns (formatting, logging, error handling templates) are ideal AI tasks because they follow predictable structures
• Dependency updates and syntax migrations across large codebases are mechanical changes that agents handle reliably
• Code exploration and comprehension: asking an agent to explain unfamiliar code is faster than reading it cold

Where AI increases maintenance burden:

• Architecture and design decisions that build up over the product's lifetime
• Security-sensitive code where a small error can be a disaster
• Complex business logic with edge cases that need domain understanding
• Integration points between systems, where assumptions about data formats, timing and error handling are critical
• Any code the team doesn't understand: if no one can explain why the AI wrote something a particular way, no one can maintain it

So how do you keep on top of it? The organisations that handle this well will be the ones that measure honestly. Alongside how fast code gets written, track how often it gets rewritten, and look at bug rates and incident response times as well as deployment frequency. It's also worth counting how many lines of code survive six months without modification, next to how many get produced.

---

LibraBit helps engineering teams set up the review workflows, testing strategies and quality gates that make AI coding tools a net positive for long-term maintenance. Talk to us about building an AI adoption strategy that accounts for the full cost of ownership.

---

References

• AI Copilot Code Quality: 2025 Data Suggests 4x Growth in Code Clones, GitClear
• Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity, METR
• 2025 DORA State of AI-Assisted Software Development, Google DORA
• AI-Assisted Programming Decreases the Productivity of Experienced Developers, Xu et al.
• State of AI vs Human Code Generation Report, CodeRabbit
• Complacency with AI-Generated Code, Thoughtworks Technology Radar
• 2025 Stack Overflow Developer Survey, Stack Overflow