Evidence tension

Does AI-assisted development make code quality worse?

Businesses increasingly inherit code produced through a mixture of human and AI-assisted development. A binary assumption that AI provenance determines quality is not supported by the current evidence.

Evidence confidence: Moderate

What the evidence shows

AI-generated code can exhibit meaningful quality and security weaknesses
A large comparison found different defect profiles between human-written and AI-generated code, including more high-risk security vulnerabilities in the AI-generated samples studied.
EVD-0018
The evidence does not support a single 'AI code is worse' verdict
A large real-world GitHub analysis found detectable CWE-mapped weaknesses, while 87.9% of analysed AI-attributed files had no qualifying CWE finding under the study's CodeQL methodology.
EVD-0024

"Code quality" is multidimensional. Security, correctness, maintainability, complexity and operational reliability are not interchangeable.

How the evidence compares

What can be compared

Both sources demonstrate that AI-assisted code can contain meaningful technical weaknesses and that those weaknesses vary by quality dimension and context.

What cannot be directly compared

Static-analysis findings, maintainability characteristics, vulnerabilities and complete production-system quality are different outcomes and must not be collapsed into one quality score.

Reasons for the difference

Programming language
Model or tool
Quality dimension
Static-analysis methodology
Dataset construction
Code context

Lornets interpretation

Current evidence does not support treating AI assistance as a single quality multiplier. Code provenance is a context signal, not a technical verdict. The resulting system should be verified against the quality and security properties relevant to its operating context.

Remaining uncertainty

Direct longitudinal comparisons of equivalent human- and AI-assisted production systems remain limited, and static-analysis findings do not map one-to-one to operational defects or exploitable vulnerabilities.

Evidence needed

Longitudinal production studies comparing equivalent systems, with quality followed through maintenance, incidents, security outcomes and operational change.