AI-authored code needs more attention, contains worse bugs

"Generating code using AI increases the number of issues that need to be reviewed and the severity of those issues. CodeRabbit, an AI-based code review platform, made that determination by looking at 470 open source pull requests for its State of AI vs Human Code Generation report. The report finds that AI-generated code contains significantly more defects of logic, maintainability, security, and performance than code created by people."

"On average, AI-generated pull requests (PRs) include about 10.83 issues each, compared with 6.45 issues in human-generated PRs. That's about 1.7x more when AI is involved, meaning longer code reviews and increased risk of defects. Problems caused by AI-generated PRs also tend to be more severe than human-made messes. AI-authored PRs contain 1.4x more critical issues and 1.7x more major issues on average than human-written PRs, the report says."

"The CodeRabbit report found that AI-generated code falls short of meatbag-made code across the major issue categories. The bots created more logic and correctness errors (1.75x), more code quality and maintainability errors (1.64x), more security findings (1.57x), and more performance issues (1.42x). In terms of specific security concerns, AI-generated code was 1.88x more likely to introduce improper password handling, 1.91x more likely to make insecure object references, 2.74x more likely to add XSS vulnerabilities, and 1.82x more likely to implement insecure deserialization than human devs."

Analysis of 470 open-source pull requests shows AI-generated pull requests include about 10.83 issues each, compared with 6.45 issues in human-generated PRs. AI-authored PRs contain about 1.4 times more critical issues and 1.7 times more major issues than human-written PRs. AI-generated code produces more logic and correctness errors (1.75x), more code quality and maintainability errors (1.64x), more security findings (1.57x), and more performance issues (1.42x). Security-specific increases include improper password handling (1.88x), insecure object references (1.91x), XSS vulnerabilities (2.74x), and insecure deserialization (1.82x). These differences increase review workload and raise defect risk.

Read at Theregister