Written by: Mark Hull, Co-Founder and CEO, Exceeds AI
Key Takeaways
- AI-generated code produces 1.7× more issues per PR than human-written code, with security vulnerabilities up to 2.74× higher across multiple vulnerability categories.
- Readability, maintainability, and complexity issues spike significantly in AI contributions, with readability problems appearing more than 3× as often as in human code.
- Rework and code churn patterns vary sharply by team maturity, with heavy AI users generating 9× more churn but also 4–10× more durable code in some cases.
- 30-day incident tracking remains under-instrumented, leaving most organizations without the longitudinal data needed to connect AI-touched code to production outcomes.
- Exceeds AI helps engineering teams measure and close these specific quality gaps. See how your AI-generated code compares to these benchmarks.
Research Sources and Constraints
This report draws on five primary sources published between late 2025 and mid-2026. CodeRabbit’s State of AI vs Human Code Generation Report analyzed open-source GitHub pull requests using Poisson rate ratios normalized to issues per 100 PRs. SonarSource’s 2026 State of Code Developer Survey collected responses from over 1,100 professional developers on perceived quality and review effort. DX’s longitudinal analysis tracked outcomes across companies using same-engineer pre/post methodology. Georgia Tech’s Vibe Security Radar, developed by SSLab researcher Hanqing Zhao, scanned over 43,000 security advisories to identify confirmed CVEs attributable to AI-generated code. GitClear’s 2025 AI Copilot Code Quality report examined 211 million lines of code across 2020–2024.
Limitations apply across all sources, and these constraints shape how to interpret the findings. The CodeRabbit dataset is limited to open-source repositories, which may not reflect enterprise codebases with stricter review gates, so production environments may see even larger gaps. SonarSource data is self-reported and subject to perception bias, meaning the review effort figures capture developer sentiment rather than measured time. DX longitudinal data controls for engineer tenure but cannot fully separate AI tool effects from concurrent process changes, which introduces uncertainty about causation. Georgia Tech CVE tracking is acknowledged by the researchers to capture only a fraction of actual AI-introduced vulnerabilities, suggesting the real security impact is higher. GitClear’s churn metrics measure code movement patterns as proxies for rework rather than direct defect attribution, so they highlight symptoms of quality issues rather than the root causes.
Key Findings Summary
Across all five sources, several patterns appear consistently. AI-generated code produces more issues per PR than human-written code, with the gap most pronounced in security findings and readability. Security vulnerability rates in AI-generated code are materially higher by multiple measures. Rework and code churn patterns diverge sharply depending on team maturity and AI usage intensity. Long-term incident tracking remains the least instrumented dimension, with most organizations lacking the longitudinal code-level data required to connect AI-touched PRs to production outcomes 30 or more days post-merge. Quality outcomes are not uniform: some teams improved defect rates after AI adoption while others saw significant degradation, making aggregate benchmarks a starting point rather than a verdict. The next sections walk through each quality dimension in detail, beginning with issues per pull request.
Metric-by-Metric Analysis
Issues per PR
The 1.7× gap in issues per PR comes directly from CodeRabbit’s analysis. AI-authored PRs produced 10.83 issues per PR versus 6.45 issues per PR for human-only PRs. AI pull requests contained more issues at higher percentiles. Critical and major severity findings appeared approximately 1.4 to 1.7× more frequently in AI PRs. 38% of developers surveyed by SonarSource in 2026 reported that reviewing AI-generated code requires more effort than reviewing human-written code, while only 27% said it requires less, which aligns with the higher issue counts.
Security Findings
Security gaps represent the sharpest quality difference. Security issues in AI-generated PRs ranged from 1.82× to 2.74× higher than human-written code depending on vulnerability type, with XSS representing the highest multiplier. Specific vulnerability patterns show: AI-generated code was 2.74× more likely to introduce XSS vulnerabilities, 1.91× more likely to create insecure direct object references, 1.88× more likely to introduce improper password handling, and 1.82× more likely to implement insecure deserialization. At scale, AI-generated code introduces 2.74 times more security vulnerabilities per pull request than human-authored code. Georgia Tech’s Vibe Security Radar documented 74 confirmed CVEs attributable to AI-generated code after scanning over 43,000 security advisories, including 14 critical and 25 high-risk issues such as command injection, authentication bypass, and server-side request forgery. The trajectory is accelerating. Georgia Tech’s Vibe Security Radar tracked 35 new CVE entries directly caused by AI-generated code in March 2026 alone, up from 6 in January and 15 in February, signaling a rapidly growing risk surface.
Complexity, Readability, and Maintainability
AI-generated code tends to be harder to read and maintain. Readability issues spiked more than 3× in AI contributions versus human-only PRs, and code-quality and maintainability issues increased by 1.64× in AI-generated code, which tended to be more complex than necessary, less consistent with surrounding code patterns, and structured in ways that increase future modification difficulty. AI-generated code omitted null checks, guardrails, and exception handling nearly 2× more often than human-written code, patterns directly tied to downstream outages. Excessive I/O operations were approximately 8× more common in AI-authored PRs, which signals efficiency and complexity regressions that compound over time.
Rework Rates and Code Churn
Rework patterns show a churn paradox. GitClear’s 2025 AI Copilot Code Quality report found that copy-pasted or duplicated code increased, with 4× growth in clones, a structural shift consistent with AI-generated code that satisfies immediate requirements without integrating into existing architecture. Heavy AI users generated 9× more code churn than non-AI users, while the same cohort also produced 4 to 10× more durable code, which indicates high variance by usage pattern. Some teams shipped more defects since AI adoption, with Change Failure Rate identified as the clearest quality benchmark at an industry baseline of 4%.
30-Day Incident Rates
Longitudinal incident tracking is the least mature dimension in current research. No published dataset as of mid-2026 provides a statistically controlled comparison of 30-day production incident rates for AI-touched versus human-only code at scale. The available evidence is directional. A SmartBear survey of 273 software leaders released in March 2026 found 70% said application quality had already degraded as AI accelerated development, and 60% reported quality issues because code creation outpaced testing capacity. High technical debt increases production incidents and slows delivery, and the maintainability patterns documented above are established precursors to incident accumulation. Organizations that track AI-touched PRs longitudinally at the commit level are positioned to generate this data internally before industry-wide benchmarks mature.
Start tracking AI-touched commits and incident rates in your codebase
How Outcomes Vary by Team, Tooling, and Language
Quality outcomes from AI-generated code are not uniform across teams. DX’s analysis found that some organizations saw increased defect rates after AI adoption. This variance follows recognizable patterns. In one major financial services company, engineers using AI tools showed increased PR throughput compared to non-adopters, which suggests that teams with established review discipline can absorb AI-generated volume without quality degradation. Developers surveyed by SonarSource in 2026 reported varying impact from AI-generated code on defect rates, while 61% agreed AI often produces code that looks correct but is not reliable, a perception gap that influences how thoroughly reviewers inspect AI output.
Tool-level data also shows variation. At the tool level, Georgia Tech’s CVE tracking shows multiple AI tools including Claude Code, GitHub Copilot, Devin, Aether and Cursor contributing to confirmed vulnerabilities. These figures reflect confirmed CVEs in scanned advisories and are not normalized for usage share, so they should not be read as a direct tool-quality ranking. A Tilburg University study of GitHub Copilot adoption in open-source projects found that core developers reviewed more code after introduction and experienced a drop in their own original output, which indicates that tool introduction changes reviewer behavior in ways that affect quality outcomes independently of the AI code itself.
Practical Evaluation Criteria for Engineering Leaders
Engineering leaders can translate these benchmarks into a concrete internal measurement plan. The distinction between commit and PR-level code analysis and metadata-only approaches has real operational impact. Metadata platforms can report that PR cycle time dropped 15%, yet they cannot determine whether AI-touched lines in those PRs are accumulating maintainability debt or driving incident rates 45 days later. Code-level analysis is required to answer that question with confidence.
Leaders building an internal measurement framework should establish baselines before expanding AI tool access, then track several related metrics over a minimum of 30 days per cohort. Start with issues per PR segmented by AI-touched versus human-only changes to see whether AI is introducing more defects at creation time. Add security finding rates by severity, since research shows the largest quality gaps in this dimension. Track code churn on AI-assisted commits to surface rework patterns that hint at maintainability problems before they become incidents. Monitor Change Failure Rate for deployments containing AI-generated code, because this metric shows whether AI-touched code is production-ready. Finally, measure post-merge incident rates linked to AI-touched modules to connect code creation with operational outcomes. DX identifies same-engineer longitudinal tracking against pre-AI baselines as the clearest productivity and ROI signal, which removes confounding variables like tenure and team composition that make cross-team comparisons unreliable.
Several operational questions help evaluate any measurement platform. Leaders should ask whether the platform identifies which specific lines are AI-generated versus human-authored, or whether it relies on commit message tagging alone. They should confirm that it can track outcomes for those lines 30 or more days post-merge. Coverage across all AI tools in use matters, not just the one with native telemetry. The platform also needs to distinguish between a PR that merged quickly because it was high quality and one that merged quickly because reviewers under-scrutinized AI output.
Summary of Evidence
The 2025–2026 research base establishes several consistent patterns. AI-generated code produces more issues per PR than human-written code across logic, security, readability, and maintainability dimensions, with security findings showing the largest gap at up to 2.74× the rate of human-authored code. Rework and churn patterns are elevated on average but vary significantly by team maturity and usage intensity. Quality outcomes diverge sharply across organizations, with some teams improving and others degrading after AI adoption, which makes aggregate benchmarks insufficient for internal decision-making without team-specific longitudinal data. The 30-day incident rate dimension remains under-instrumented industry-wide, representing both a measurement gap and a risk management gap for organizations that lack commit-level tracking of AI-touched code over time. Metadata-only measurement approaches cannot close these gaps. Code-level, longitudinal analysis across the full AI toolchain is the minimum instrumentation required to generate the evidence engineering leaders need.
Get commit-level AI code analysis across your full toolchain
Frequently Asked Questions
How were the 2026 benchmarks collected and normalized?
The benchmarks in this report come from distinct methodologies that are not directly interchangeable. CodeRabbit’s study analyzed open-source GitHub pull requests and normalized findings to issues per 100 PRs using Poisson rate ratios, which allows statistical comparison between AI-coauthored and human-only PRs. SonarSource’s 2026 survey collected self-reported perceptions from over 1,100 professional developers and reflects sentiment rather than measured defect counts. DX’s longitudinal data tracks same-engineer outcomes across companies over time, controlling for tenure and team composition. Georgia Tech’s Vibe Security Radar identifies confirmed CVEs in published security advisories and does not represent total AI-introduced vulnerability volume, and the researchers estimate actual cases are 5 to 10 times what they currently detect. GitClear’s 2025 AI Copilot Code Quality report measures code movement patterns across 211 million lines as proxies for rework. Because each source uses a different unit of measurement and population, the figures in this report should be treated as directional benchmarks rather than a single unified dataset.
What explains higher security findings in AI-generated code?
Several structural factors contribute to the higher security findings. Large language models are trained on code that includes historical vulnerabilities, insecure patterns, and deprecated APIs, and they reproduce those patterns when generating new code. AI tools focus on syntactic correctness and functional plausibility rather than security posture, so they produce code that compiles and passes basic tests while omitting input validation, authentication checks, and secure serialization practices. Reviewers often scrutinize AI-generated code less critically than human-written code because its clean formatting and confident presentation create an impression of quality. An IEEE-ISTAS 2025 peer-reviewed study found that iterative AI self-improvement actually worsens security outcomes: asking a model to refine its own code across 10 rounds increased average vulnerabilities per sample from 2.1 to 6.2, a 37.6% increase in critical vulnerabilities after just five rounds. The combination of training data contamination, optimization misalignment, and reduced reviewer scrutiny produces the elevated security finding rates documented across multiple 2025–2026 studies.
How should teams interpret mixed quality results across different AI tools?
Mixed results across tools reflect real differences in model architecture, training data, and the use cases each tool targets, as well as differences in how teams deploy and review AI-generated output. A tool that performs well for autocomplete in a mature codebase with strong review gates may perform poorly when used for large-scale refactoring without equivalent oversight. Georgia Tech’s CVE data shows variation across tools, but those figures are not normalized for usage share and should not be used as a direct quality ranking. The more actionable interpretation is that tool-level quality outcomes are context-dependent. The same tool can produce high-quality results on one team and elevated rework on another, depending on review maturity, prompt discipline, and the complexity of the subsystem involved. Teams should track outcomes by tool and by use case within their own codebase rather than relying on cross-organization benchmarks to make tool strategy decisions.
What data limitations affect 30-day incident tracking?
Three limitations significantly affect 30-day incident tracking. First, most organizations do not tag production incidents with the specific PRs or commits that introduced the underlying code, which makes causal attribution difficult even when incident data exists. Second, the lag between code merge and incident manifestation means that a 30-day window may be too short for subtle architectural or maintainability issues that surface under load or edge conditions months later. Third, AI tool adoption is still accelerating, so longitudinal datasets that span pre-AI and post-AI periods within the same teams and codebases remain limited in size and may not yet reflect the quality patterns that emerge at higher AI code share percentages. Organizations that instrument their repositories now, tracking which commits and PRs contain AI-generated code and linking those records to incident management systems, will be positioned to generate internally valid 30-day and 90-day incident data within one to two quarters, ahead of industry-wide benchmarks that may take years to mature.