agentwar.lol

Research · Coding agents · August 2026

What breaks in
coding agents

Coding agents are the most deployed and the most measured, which means the complaints here come with unusually hard numbers. The pattern across every study: the work does not disappear, it moves — from writing to reviewing, and from now to later.

01

The work moves to whoever reviews it

20–35% more senior review time

The productivity gain is real and it is not free. When junior engineers lean on AI assistants, the reviewing load lands on senior engineers, who report spending substantially longer on code review than before.

This is the cost that never appears in the ROI slide, because it shows up in a different team's calendar than the one that bought the tool. Output rises, throughput often doesn't.

If you're building one: Anything that reduces review burden — diff explanations, risk flags, test generation — sells better than raw generation speed. You are competing for the reviewer's time, not the writer's.

Innovative Group — AI-generated code and technical debt, 2026 data ↗
02

The debt lands within six months

1.7× more issues per PR · 30–41% more debt

Pull requests containing AI-assisted code carry roughly 1.7 times the issues of human-written code, and organisations report technical debt climbing 30–41% within six months of adopting AI tools broadly.

The lag is what makes this dangerous. Adoption looks like a clean win for a quarter or two, and the bill arrives after the tool has been rolled out everywhere and is hard to walk back.

If you're building one: Six months is your real evaluation window, not the trial. Teams that got burned once now ask what happens at month six — have an answer.

arXiv — Debt behind the AI boom, a large-scale empirical study ↗
03

Nearly half of generated code shipped a vulnerability

45% of cases · >70% for Java

Veracode's research found AI-generated code introduced security vulnerabilities in 45% of cases, with failure rates above 70% in Java specifically.

This is the single number most likely to end a procurement conversation, and it is the one least often addressed on vendor pages. Language-specific variance matters too: a tool safe in one stack may not be in another.

If you're building one: Publish your own security numbers per language before a buyer finds someone else's. Silence here is read as a bad result.

Innovative Group — AI code and technical debt ↗
04

The defects are the kind review does not catch

41,374 broad exception handlers · 28,272 unused variables

The most common AI-introduced defects are code smells, not crashes. Broad exception handling, unused variables and arguments, shadowed outer variables, protected-member access — counted in the tens of thousands across a 302,000-commit corpus.

None of these break the build. They read as plausible, they pass review, and they accumulate silently. That is precisely why they survive to become the debt in finding 02.

If you're building one: Catching smells that humans wave through is a sharper wedge than catching bugs. Linters already find bugs; nobody has made reviewers care about the quiet stuff.

Codex Knowledge Base — silent technical debt across 302,000 commits ↗
05

It writes new code instead of finding yours

More duplication, measurably less reuse

Agents produce more redundant code than human developers — duplicated logic rather than reuse of what already exists in the repository.

It is a retrieval failure wearing a generation costume. The agent cannot find the helper that already exists, so it writes a second one, and the codebase grows a parallel implementation nobody knows about.

If you're building one: Show that you searched the codebase before generating. Demonstrable reuse is a differentiator, and it directly attacks the duplication complaint.

arXiv — More code, less reuse: AI-generated pull requests ↗

Method

Other categories