Study of 182 Repositories Finds AI-Written Code Needs More Cleanup Than Human Code

A new longitudinal study tracking code contributions across 182 software repositories has produced a sobering data point for teams leaning heavily on AI coding agents: merged code written by these agents requires substantially more corrective work down the line than code written by human developers.

The research, submitted on July 10, 2026, followed post-merge behavior over time rather than taking a single snapshot, which lets the authors observe how agentic and human contributions age differently once they enter a codebase. The core finding is that agentic contributions demand a significantly higher rate of follow-up maintenance, meaning bugs, patches, and fixes that trace back to code an AI system originally wrote. The same contributions were also found to introduce more security weaknesses and dependency vulnerabilities than their human-authored counterparts.

Review Practices Matter More Than Expected

One of the more actionable findings ties maintenance burden directly to how carefully code gets reviewed before merging. The study found that for every 10 percentage-point rise in a project's no-review rate (the share of changes merged without a human review step) agentic maintenance burden climbs by roughly 6% on average. That correlation suggests the problem isn't just that AI agents write flawed code sometimes, it's that the flaws compound when review discipline erodes, which is precisely the scenario many teams create when they treat AI-generated pull requests as trustworthy enough to fast-track.

That's a notable wrinkle for engineering organizations that have embraced AI coding agents partly to speed up review cycles. If skipping review is itself a multiplier on the very defects agents are more prone to introduce, then the productivity gains promised by agentic coding tools may be partially offset, or even erased, by the hidden cost of later cleanup.

Why This Matters for Engineering Leaders

The paper doesn't attribute agentic weaknesses to any single cause, but the pattern it documents lines up with a growing concern in the developer tools space: AI agents can generate plausible-looking code quickly, yet plausibility isn't the same as correctness or security. Security weaknesses and dependency vulnerabilities are exactly the kind of defect that tends to surface only after code has been running in production for a while, which is consistent with a study designed to track behavior over time rather than at the moment of merge.

For CTOs and engineering managers rolling out AI coding assistants at scale, the findings offer a concrete argument for maintaining, or even tightening, human review requirements specifically on agent-generated changes. The data suggests that the cost of skipping review isn't evenly distributed between human and AI contributions, it disproportionately penalizes the latter. As more organizations integrate coding agents into their pipelines, this kind of empirical accounting of the maintenance debt they leave behind is likely to shape how much autonomy those agents are actually given.