Ordinary technical debt is owed by someone who can read the code. Agent quality debt is owed by someone who cannot, and eventually by nobody, once the builder who could say what it was for moves teams.

The mechanism

Start at toy scale, because the shape is identical higher up. Ethan Mollick built a small game by prompt in March 2025, hit a bug on the fourth prompt, and could not fix it: he did not know which language it was written in. Roughly $8 of API spend later it worked, against about $5 to build the thing, so debugging cost 1.6 times the build. That is a sophisticated user on 2025-vintage tooling, and the ceiling he drew holds, since he was far less confident about a large codebase.

That is not a personal failing, it is the structure of the role. A citizen developer in a 30-interview study, asked whether his configuration would hurt platform performance, said “I don’t know. I can’t tell.” Another described maintaining items whose authorship nobody knows. What distinguishes citizen quality debt from professional quality debt is the missing backstop: professionals build bad things too, but there are usually other professionals around to catch it.

The debt is architectural rather than stylistic, so linting it doesn’t help. Low-code platforms encourage new branches added directly to the artifact instead of abstracted into something reusable, so redundancy compounds and maintenance cost grows with every addition. The delayed-detonation version has a name from the same literature: phantom couplings, meaning undocumented dependencies between a citizen-built system and an enterprise system, which surface only when the enterprise system changes. (The term is that paper’s coinage rather than established vocabulary; attribute it when borrowing it.)

The measured code-quality delta points the same way. Apiiro compared AI-generated and human-written code across repositories affiliated with Fortune 50 enterprises and reported 322% more privilege-escalation paths and 153% more design flaws, alongside 3–4× more code and roughly 10× more security findings, while syntax errors fell 76% and logic bugs 60%. Read the shape, not the percentages: the model fixes what scanners catch and worsens what they don’t. This is vendor research with no independent replication and an unspecified comparison window, so cite it as Apiiro’s, September 2025.

In the wild, Escape.tech scanned 5,600 vibe-coded production applications in October 2025 and found over 2,000 vulnerabilities, 400+ exposed secrets and 175 PII exposures, dominated by exposed auth tokens, misconfigured Supabase row-level security, and unauthorized API access. Note what that study does not say: the circulated claims that zero of those apps had CSRF protection or security headers, and that every one had SSRF, come from a separate controlled analysis of 15 applications. The trade press blends three studies into one sentence, and a figure quoted from that blend will fail the first question asked about it.

Georgia Tech’s Vibe Security Radar, tracking CVEs attributable to AI-generated code since May 2025, logged 6 in January 2026, 15 in February and 35 in March, more in one quarter than in all of 2025. Those are lower bounds from one automated detector whose attribution fails when AI markers are stripped, and the team estimates true prevalence at five to ten times what it detects. Some of the rise is deployment growth and researcher attention, which leaves the trend and the method citable while the counts stay indicative at best.

Then provenance. What is usually missing is the export, the dependency inventory, and the record of which model and which prompt produced the artifact, rather than the source code itself; the largest platform in that scan population offers two-way GitHub sync on every plan. Write the concern as nobody retrieved the code, not no code exists to patch: weaker, and true. The remediation problem is unchanged, since re-prompting yields an artifact whose security properties are as unknown as the original’s.

Cost is the part nobody budgets. Traditional IT run costs typically land at 10–20% of build cost; McKinsey’s assessment is that gen AI solutions at scale can incur recurring costs exceeding the build investment. That “can exceed” is unquantified, with no dataset behind it, so it should not be treated as a multiplier; the inversion is what matters, and it makes an agent built in an afternoon a standing liability.

And unmaintained agents decay rather than sitting still: model updates arrive on a months-long cadence, dependencies move, and an agent nobody tends becomes outdated or inaccurate. Engineers are noticing. In a matched cohort surveyed six months apart, maintainability rose from 3% to 19% as their primary concern about AI-assisted code (the only statistically significant ranking change, n=89, p=0.003), while quality fell from 44% to 36% and stayed top. That measures perceived concern, not defect rates, on pre-agentic tooling. The authors’ reading is the compact version: AI optimises for works now rather than maintains later.

“Gray IT” is the 2023 name for the endpoint: dependence on citizen-developed systems known to only a few employees or whose developers left long ago, plus the cost of reworking them when they break.

What to do

Make the code leave the platform on day one, ahead of everything else on this list. Require every agent or app to sync to firm-managed version control at creation, not at promotion. On most prompt-to-app platforms this is a configuration toggle nobody turned on, and it converts the whole provenance problem into an ordinary one.

Record the generating prompt and the model version as build metadata in the registry. When the artifact needs changing, the prompt is the source and the code is the compiled output; a registry without the prompt has recorded the wrong thing; see agent inventory.

Scan for the classes that actually appear rather than running generic SAST: exposed secrets and API tokens, misconfigured row-level security, unauthenticated endpoints. That is where the measured findings cluster; secrets management covers the first.

Budget run cost at design time. Ask what this costs per year before it ships, not after finance notices. Cost controls has the instrumentation.

Name a maintainer, who need not be the builder, and re-confirm the assignment on a schedule. The orphan is created the day someone changes teams, not the day the agent breaks; see offboarding.

Attach the heavier requirements to criticality, not to everything. Documentation, tests and review earn their cost at the top tier and are pure friction at the bottom; promotion gates is where that boundary belongs.

How you’d know it’s working

Every registered agent has a source artifact that can be diffed against last quarter’s. No diff means no incident response either.

A secrets scan across the agent estate returns zero. Exposed credentials are the single most common finding in every scan of this population, so a zero here is a real signal rather than a vanity metric.

Someone other than the original builder has successfully modified each tier-1 agent in the last year. That is the only direct test of whether the thing is maintainable, as opposed to merely documented.

What this doesn’t solve

The evidence base is thinner than the confidence around it. The strongest quality-delta number is unreplicated vendor research, the strongest field scan comes from a vendor selling the remedy, and the citizen-development literature supplying the mechanisms is pre-agent low-code work from 2022 to 2024; any transposition to agents has to be deliberate and declared as a transposition.

There is a real counter-position. The same 30-interview study supplying the sharpest quotes here also records an expert at a different firm arguing citizen-built apps carry no special risk, and Microsoft — which runs 50 sanctioned departmental BI groups, each with its own data lake and metrics — reports that competing versions of the truth have not yet caused severe problems. Quality debt is a real cost and a manageable one, and nothing in the sources supports treating it as an emergency.

The “95% of AI projects fail” number is misused constantly and measures something else. It traces to a 2025 study finding that 95% of organizations got zero measurable return from generative AI, not that 95% of agent proofs-of-concept fail to reach production. Gartner’s separate June 2025 prediction that over 40% of agentic AI projects will be canceled by end-2027 names escalating cost, unclear value and inadequate risk controls together, and neither source attributes any of it to quality debt.

Finally, none of this addresses adversaries. A well-owned, version-controlled, fully documented agent is exactly as vulnerable to prompt injection as a sloppy one. This is the reliability axis, and it overlaps with the security axis far less than the shared word “vulnerability” suggests.

See also

• Agent sprawl — quality debt at population scale, and where orphans get counted.
• Unreliable output acting on your systems — the runtime face of quality failure.
• Promotion gates — where documentation and review requirements attach to criticality.
• Offboarding agents and owners — the process that prevents orphans instead of discovering them.
• Recordkeeping and compliance gaps — why an agent that silently rewrote a documented procedure is an examination problem.
• Citizen developer roles — who owns what, made explicit and re-confirmed.