Research #
- “From Technical Debt to Cognitive and Intent Debt: Rethinking Software Health in the Age of AI” (Margaret-Anne Storey, arXiv 2603.22106) — Proposes a “Triple Debt Model” extending beyond code-level technical debt: cognitive debt (erosion of a team’s shared mental model as AI-authored complexity outpaces comprehension) and intent debt (missing/eroded rationale, goals, and constraints that should guide how humans and agents evolve a system). Core claim — “AI generates code faster than teams can understand it” — gives a named theoretical frame for the comprehension-debt data already tracked here (VibeCheck, GitClear, GIST debt), distinguishing team-level understanding loss from individual comprehension and from missing documentation specifically.
Empirical Studies: Maintenance, Testing, and Security #
- To What Extent Does Agent-generated Code Require Maintenance? An Empirical Study (Sawada, Shirai, Kashiwa, Yamaguchi, Iwata, Iida) — Analyzes 1,000+ agent-generated files and ~3,200 subsequent changes across 100 popular repositories (AIDev dataset). Finds agent-generated files receive maintenance less frequently than human-authored code, but when touched, the most common follow-up change is adding new features rather than fixing bugs (the reverse pattern from human-authored code, where bug fixes dominate); human developers perform the large majority of that follow-up maintenance. A direct, dataset-driven answer to “who does the upkeep” that complements GitClear’s structural-metric findings already tracked here.
- Testing with AI Agents: An Empirical Study of Test Generation Frequency, Quality, and Coverage (arXiv 2603.13724) — Empirical study of how often, and how well, coding agents generate tests alongside code changes, measuring frequency and coverage quality rather than assuming test generation happens as a matter of course — complements last cycle’s TDAD/AgentAssay entries with a descriptive baseline rather than a new technique.
- Security Degradation in Iterative AI Code Generation — A Systematic Analysis of the Paradox (Shukla, Joshi, Syed) — Tests 400 code samples across 40 improvement iterations under four prompting strategies and finds a 37.6% increase in critical vulnerabilities after just five iterations of AI-driven refinement — refinement loops degrade security rather than improving it by default. Names the “iterative refinement improves quality” assumption directly and finds it false for security specifically, arguing human validation must sit between iterations.
Quality Beyond Correctness #
- Quality Assurance of LLM-generated Code: Addressing Non-Functional Quality Characteristics (Sun, Ståhl, Sandahl, Kessler) — Surveys the gap between what academics study (security, performance efficiency, maintainability) and what practitioners actually worry about (maintainability and readability, plus technical-debt accumulation), then empirically shows that prompting-based attempts to optimize these non-functional characteristics are unstable in practice — a caution against treating “just ask the model to write better code” as a quality strategy.
Cross-links #
- AI Code Review
"AI code review" best practices again returned near-100% vendor-marketing content (exceeds.ai, CodeAnt ×3, Verdent, Sourcegraph, collinwilkins) — fourth consecutive cycle confirming this keyword’s signal belongs to ai-code-review, not here. Both substantive hits this cycle are already tracked in that topic’s journal (2607.07980 “3100 Opinions…” and 2509.01494 “SWR-Bench”, both from its 2026-07-27 gather) — resurfacing here confirms this journal and ai-code-review are drawing from an overlapping citation pool, not a new finding. - AI Agent Accountability
AI generated code postmortem OR incident again returned near-entirely SRE postmortem-generation tooling (Rootly ×4, Aurora SRE, incident.io, SurePrompts) rather than AI-code-incident content — fourth consecutive cycle with no new substantive hit via this keyword; confirms last cycle’s recommendation was correct not to keep re-flagging it as a gap.
- Keyword suggestion:
Claude Code Python code quality practices produced pure marketplace noise for a second consecutive cycle (mcpmarket.com skill listings, claudecode101.com, claudepluginhub.com) — recommend retiring or narrowing this keyword, similar to the already-flagged "AI code review" best practices. - Emerging pattern: This cycle’s three empirical studies (maintenance frequency, test-generation quality, iterative security degradation) share a method shift from the aggregate-metric approach (GitClear-style) toward fine-grained behavioral studies of what agents and humans actually do with the code afterward — a maturing complement to the large-N structural-metric literature already well represented here.
- Quality signal: The security-degradation paper’s 37.6%-critical-vulnerability-increase-after-five-iterations finding is a specific, falsifiable number from a controlled 400-sample/40-iteration design — stronger evidentiary footing than most of the vendor-stat claims this journal has flagged as unverified (e.g. the still-unresolved CMU SEI 35% figure).
- Gap: No paper found this cycle (or in prior cycles) resolves the “1.7x more issues” statistic’s original source — it now appears attributed inconsistently to CodeRabbit research in some outlets and to unnamed “2026 data” in others; treat as an unverified, widely-recirculated figure rather than a citable finding, same treatment as the CMU SEI stat.