The Maintainability Gap Has a Dollar Sign
AI now writes a serious share of production code, and the 2026 numbers on what that code does to a codebase are in. Nobody's business model depends on cleaning it up. Ours does.
Every codebase now has a second author. It works nights and weekends, it never argues in review, and it ships more code per day than the rest of the team combined. It also never comes back to delete anything, and no one is accountable for what it wrote.
That would be a manageable cultural problem if the output were fine. The 2026 numbers say it is not fine, and they say it with unusual consistency across independent measurements.
GitClear’s 2026 report on code quality, built from longitudinal commit data, found copy-pasted code rose from 9.4 percent of new code in 2022 to 15.7 percent in the first half of 2026. Over the same stretch, moved and refactored code, the signature of someone actually maintaining a system, collapsed from 21 percent to 3.8 percent. Codebases are gaining weight and losing exercise at the same time.
A CodeRabbit analysis of open-source pull requests found AI-authored changes produced 1.7 times the issues of human-only changes, and the security breakdown is worse than the average: AI-generated code was 2.7 times more likely to introduce cross-site scripting and roughly 1.9 times more likely to mishandle passwords or object references. An arXiv study that traced 302,600 verified AI-authored commits across 6,299 repositories watched the unresolved technical debt those commits introduced grow from a few hundred surviving issues in early 2025 to over one hundred thousand by February 2026.
None of these teams was doing anything wrong by current standards. They were doing exactly what the tools are built for. That is the point.
Here is the structural fact underneath the statistics, and it matters more than any individual number: every tool in the generation economy is paid for code added. The subscription renews because the assistant produced. The usage meter runs when tokens flow. No vendor’s revenue depends on code deleted, on duplication driven down, on the pull request that removes four hundred lines and adds sixty. The market has built an enormous machine with no reverse gear, and the debt data is what a machine with no reverse gear produces.
We spend our days on the other side of this. Production systems, agent fleets, pipelines that have to survive real users. And the discipline that keeps our own estate alive turns out to be exactly what the debt problem needs, because it was never a generation discipline. It is a verification discipline.
The rules are short. A finding is not real until it traces to a file and a line and reproduces on command. A metric nobody re-measures is a guess wearing a number’s clothes; our own public stats are recounted on a schedule precisely because a stale receipt is worse than none. A claim of “fixed” earns nothing until the gate runs and the output is read, because builders, human and machine alike, will report success under deadline pressure whether or not the tests ran. We wrote about that discipline when it caught our own audit overstating itself. It applies without modification to a codebase carrying eighteen months of unreviewed machine-written commits.
And the dollar sign matters. Duplication percentages do not move budgets. What moves a budget is the maintenance figure: what this repo costs per month in slowed features, re-fixed bugs, and the security findings accruing at machine speed, and what the paydown costs against that. Put the two numbers next to each other with receipts under both, and the decision stops being philosophical.
So we productized the thing we already do. The AI Codebase Debt Audit is a fixed-price scan of a repo AI helped write: duplication, CWE-class vulnerabilities, dead code, architectural drift, every finding traceable and reproducible, totaled into a ledger with a dollar figure and a ranked paydown plan. The fee credits against the fix if we do the work, which is the same mechanic as our rescue work, because the incentive should point the same direction the engagement does.
The generation boom is real and we use the tools daily; this is not a lament. But the industry has spent two years shipping code faster than anyone can be accountable for it, and accountability is not a feature the generation vendors can add, because their economics run the other way. It has to come from someone whose economics run toward deletion, measurement, and being on the hook.
That is the gap. It has a dollar sign on it now.