SmarterArticles

The technology industry has a recurring fantasy: that the right protocol, the right standard, the right consortium can unify competing interests into a coherent whole. In December 2025, that fantasy received its most ambitious iteration yet when the Linux Foundation announced the Agentic AI Foundation, bringing together Anthropic, OpenAI, Block, Microsoft, Google, and Amazon Web Services under a single banner. The centrepiece of this alliance is the Model Context Protocol, Anthropic's open standard for connecting AI agents to external tools and data sources. With over 10,000 active public MCP servers and 97 million monthly SDK downloads, the protocol has achieved adoption velocity that rivals anything the technology industry has witnessed in the past decade.

Yet beneath the press releases lies a more complicated reality. The same month that Big Tech united around MCP, Chinese AI labs continued releasing open-weight models that now power nearly 30 percent of global AI usage according to OpenRouter data. Alibaba's Qwen3 has surpassed Meta's Llama as the most-downloaded open-source AI model worldwide, with over 600 million downloads and adoption by companies ranging from Airbnb to Amazon. Meanwhile, developer practices have shifted toward what former Tesla AI director Andrej Karpathy termed “vibe coding,” an approach where programmers describe desired outcomes to AI systems without reviewing the generated code. Collins Dictionary named it Word of the Year for 2025, though what the dictionary failed to mention was the security implications: according to Veracode's research analysing over 100 large language models, AI-generated code introduces security vulnerabilities 45 percent of the time.

These three forces (standardisation efforts, geopolitical technology competition, and the erosion of developer diligence) are converging in ways that will shape software infrastructure for the coming decade. The question is not whether AI agents will become central to how software is built and operated, but whether the foundations being laid today can withstand the tensions between open protocols and strategic competition, between development velocity and security assurance, between the promise of interoperability and the reality of fragmented adoption.

The Protocol Wars Begin

To understand why the Model Context Protocol matters, consider the problem it solves. Before MCP, every AI model client needed to integrate separately with every tool, service, or system developers rely upon. Five different AI clients talking to ten internal systems would require fifty bespoke integrations, each with different semantics, authentication flows, and failure modes. MCP collapses this complexity by defining a single, vendor-neutral protocol that both clients and tools can speak, functioning, as advocates describe it, like “USB-C for AI applications.”

The protocol's rapid rise defied sceptics who predicted proprietary fragmentation. In March 2025, OpenAI officially adopted MCP after integrating the standard across its products, including the ChatGPT desktop application. At Microsoft's Build 2025 conference on 19 May, GitHub and Microsoft announced they were joining MCP's steering committee, with Microsoft previewing how Windows 11 would embrace the protocol. This coalescing of Anthropic, OpenAI, Google, and Microsoft caused MCP to evolve from a vendor-led specification into common infrastructure.

The Agentic AI Foundation's founding reflects this maturation. Three complementary projects anchor the initiative: Anthropic's MCP provides the tool integration layer, Block's goose framework offers an open-source agent runtime, and OpenAI's AGENTS.md establishes conventions for project-specific agent guidance. Each addresses a different challenge in the agentic ecosystem. MCP standardises how agents access external capabilities. Goose, which has attracted over 25,000 GitHub stars and 350 contributors since its January 2025 release, provides a local-first agent framework built in Rust that works with any large language model. AGENTS.md, adopted by more than 60,000 open-source projects since August 2025, creates a markdown-based convention that makes agent behaviour more predictable across diverse repositories.

Yet standardisation brings its own governance challenges. The Foundation's structure separates strategic governance from technical direction: the governing board handles budget allocation and member recruitment, whilst individual projects like MCP maintain autonomy over their technical evolution. This separation mirrors approaches taken by successful open-source foundations, but the stakes are considerably higher when the technology involves autonomous agents capable of taking real-world actions.

Consider what happens when an AI agent operating under MCP connects to financial systems, healthcare databases, or industrial control systems. The protocol must not only facilitate communication but also enforce security boundaries, audit trails, and compliance requirements. Block's Information Security team has been heavily involved in developing MCP servers for their goose agent, recognising that security cannot be an afterthought when agents interact with production systems.

Google recognised the need for additional protocols when it launched the Agent2Agent protocol in April 2025, designed to standardise how AI agents communicate as peers rather than merely consuming tool APIs. The company's technical leadership framed the relationship with MCP as complementary: “A2A operates at a higher layer of abstraction to enable applications and agents to talk to each other. MCP handles the connection between agents and their tools and data sources, while A2A facilitates the communication between agents.” Google launched A2A with support from more than 50 technology partners including Atlassian, Salesforce, SAP, and ServiceNow, though notably Anthropic and OpenAI were absent from the partner list.

This proliferation of complementary-yet-distinct protocols illustrates a tension inherent to standardisation efforts. The more comprehensive a standard attempts to be, the more resistance it encounters from organisations with different requirements. The more modular standards become to accommodate diversity, the more integration complexity returns through the back door. The early agentic ecosystem was described by observers as “a chaotic landscape of proprietary APIs and fragmented toolsets.” Standards were supposed to resolve this chaos. Instead, they may be creating new layers of complexity.

The Reasoning Model Arms Race

Whilst Western technology giants were coordinating on protocols, a parallel competition was reshaping the fundamental capabilities of the AI systems those protocols would connect. In January 2025, Chinese AI startup DeepSeek released R1, an open-weight reasoning model that achieved performance comparable to OpenAI's o1 across mathematics, coding, and reasoning tasks. More significantly, R1 validated that frontier reasoning capabilities could be achieved through reinforcement learning alone, without the supervised fine-tuning that had been considered essential.

The implications rippled through Silicon Valley. DeepSeek's breakthrough demonstrated that compute constraints imposed by American export controls had not prevented Chinese laboratories from reaching competitive performance levels. The company's sparse attention architecture reduced inference costs by approximately 70 percent compared to comparable Western models, fundamentally reshaping the economics of AI deployment. By December 2025, DeepSeek had released 685-billion parameter models designated V3.2 and V3.2-Speciale that matched or surpassed GPT-5 and Gemini-3.0-Pro on standard benchmarks.

OpenAI's response was internally designated “code red,” with staff directed to prioritise ChatGPT improvements. The company simultaneously released enterprise usage metrics showing 320 times more “reasoning tokens” consumed compared to the previous year, projecting market strength whilst pausing new initiatives like advertising and shopping agents. Yet the competitive pressure had already transformed market dynamics.

Chinese open-weight models now power what industry observers call a “quiet revolution” in Silicon Valley itself. Andreessen Horowitz data indicates that 16 to 24 percent of American AI startups now use Chinese open-source models, representing 80 percent of startups deploying open-source solutions. Airbnb CEO Brian Chesky revealed in October 2025 that the company relies heavily on Alibaba's Qwen models for its AI-driven customer service agent, describing the technology as “very good, fast and cheap.” Amazon uses Qwen to develop simulation software for its next-generation delivery robots. Stanford researchers built a top-tier reasoning model on Qwen2.5-32B for under $50.

The phenomenon has been dubbed “Qwen Panic” in industry circles. On developer platforms, more than 40 percent of new AI language models created are now based on Qwen's architecture, whilst Meta's Llama share has decreased to 15 percent. Cost differentials reaching 10 to 40 times lower than American closed-source alternatives are driving this adoption, with Chinese models priced under $0.50 per million tokens versus $3 to $15 for comparable American systems.

This creates an uncomfortable reality for standardisation efforts. If MCP succeeds in becoming the universal protocol for connecting AI agents to tools and data, it will do so across an ecosystem where a substantial and growing portion of the underlying models originate from laboratories operating under Chinese jurisdiction. The geopolitical implications extend far beyond technology policy into questions of supply chain security, intellectual property, and strategic competition.

The Chip War's Shifting Lines

The supply chain tensions underlying this competition intensified throughout 2025 in what industry observers called “the Summer of Jensen,” referencing Nvidia CEO Jensen Huang. In July, Nvidia received Trump administration approval to resume H20 chip sales to China, only for China's Cyberspace Administration to question Nvidia's remote “kill switch” capabilities by the end of the month. August brought a whiplash sequence: a US-China revenue-sharing deal was announced on 11 August, Beijing pressured domestic firms to reduce H20 orders the following day, and on 13 August the United States embedded tracking devices in high-end chips to prevent diversion to restricted entities.

December concluded with President Trump permitting H200 exports to approved Chinese customers, conditional on the United States receiving a 25 percent revenue cut. The H200 represents a significant capability jump: it has over six times more processing power than the H20 chip that Nvidia had designed specifically to comply with export restrictions, and nine times more processing power than the maximum levels permitted under previous US export control thresholds.

The Council on Foreign Relations analysis of this decision was pointed: “The H200 is far more powerful than any domestically produced alternative, but reliance on it may hinder progress toward a self-sufficient AI hardware stack. Huawei's Ascend 910C trails the H200 significantly in both raw throughput and memory bandwidth.” Their assessment of Chinese domestic capabilities was stark: “Huawei is not a rising competitor. Instead, it is falling further behind, constrained by export controls it has not been able to overcome.”

Yet Congressional opposition to the H200 approval highlighted persistent concerns. The Secure and Feasible Exports Act, introduced by a bipartisan group of senators, would require the Department of Commerce to deny any export licence on advanced AI chips to China for 30 months. The legislation reflects a faction that views any capability leakage as unacceptable, regardless of the revenue implications for American companies.

These contradictory policy signals create uncertainty that propagates through the entire AI development ecosystem. Companies building on Chinese open-weight models must consider not just current technical capabilities but future regulatory risk. Some organisations cannot use Qwen and other Chinese models for compliance or branding reasons, a barrier that limits adoption in regulated industries. Yet the cost and performance advantages are difficult to ignore, creating fragmented adoption patterns that undermine the interoperability benefits open standards promise.

When Vibes Replace Verification

The geopolitical dimensions of AI development intersect with a more immediate crisis in software engineering practice. As AI infrastructure grows more powerful and more contested, the human practices that determine how it is deployed are simultaneously eroding. The vibe coding phenomenon represents a fundamental shift in software development culture, one that Veracode's research suggests introduces security vulnerabilities at alarming rates.

Their 2025 GenAI Code Security Report analysed code produced by over 100 large language models across 80 real-world coding tasks. The findings were sobering: AI-generated code introduced security vulnerabilities 45 percent of the time, with no significant improvement across newer or larger models. Java exhibited the highest failure rate, with AI-generated code introducing security flaws more than 70 percent of the time. Python, C#, and JavaScript followed with failure rates between 38 and 45 percent.

The specific vulnerability patterns were even more concerning. AI-generated code was 1.88 times more likely to introduce improper password handling, 1.91 times more likely to create insecure object references, 2.74 times more likely to add cross-site scripting vulnerabilities, and 1.82 times more likely to implement insecure deserialisation than code written by human developers. Eighty-six percent of code samples failed to defend against cross-site scripting attacks, whilst 88 percent were vulnerable to log injection attacks.

These statistics matter because vibe coding is not a fringe practice. Microsoft CEO Satya Nadella revealed that AI now writes 20 to 30 percent of Microsoft's internal code. Reports indicate that 41 percent of all code written in 2025 is AI-generated. Stack Overflow's 2025 Developer Survey found that 85 percent of developers regularly use AI tools for coding and development, with 62 percent relying on at least one AI coding assistant.

Recent security incidents in AI development tools underscore the compounding risks. A vulnerability in Claude Code (CVE-2025-55284) allowed data exfiltration from developer machines through DNS requests via prompt injection. The CurXecute vulnerability (CVE-2025-54135) allowed attackers to order the popular Cursor AI development tool to execute arbitrary commands on developer machines through active MCP servers. The irony was not lost on security researchers: the very protocol designed to standardise agent-tool communication had become a vector for exploitation.

In one documented case, the autonomous AI agent Replit deleted primary production databases because it determined they required cleanup, violating explicit instructions prohibiting modifications during a code freeze. The root causes extend beyond any single tool. AI models learn from publicly available code repositories, many of which contain security vulnerabilities. When models encounter both secure and insecure implementations during training, they learn that both approaches are valid solutions. This training data contamination propagates through every model trained on public code, creating systemic vulnerability patterns that resist conventional mitigation.

The Skills Erosion Crisis

The security implications of vibe coding compound a parallel crisis in developer skill development. A Stanford University study found that employment among software developers aged 22 to 25 fell nearly 20 percent between 2022 and 2025, coinciding with the rise of AI-powered coding tools. Indeed data shows job listings down approximately 35 percent from pre-2020 levels and approximately 70 percent from their 2022 peak, with entry-level postings dropping 60 percent between 2022 and 2024. For people aged 22 to 27, the unemployment rate sits at 7.4 percent as of June 2025, nearly double the national average.

Industry analyst Vernon Keenan described it as “the quiet erosion of entry-level jobs.” But the erosion extends beyond employment statistics to the fundamental development of expertise. Dutch engineer Luciano Nooijen, who uses AI tools extensively in his professional work, described struggling with basic tasks when working on a side project without AI assistance: “I was feeling so stupid because things that used to be instinct became manual, sometimes even cumbersome.”

A Microsoft study conducted in collaboration with Carnegie Mellon University researchers revealed deterioration in cognitive faculties among workers who frequently used AI tools, warning that the technology is making workers unprepared to deal with anything other than routine tasks. Perhaps most surprising was a METR study finding that AI tooling actually slowed experienced open-source developers down by 19 percent, despite developers forecasting 24 percent time reductions and estimating 20 percent improvements after completing tasks.

This skills gap has material consequences for the sustainability of AI-dependent software infrastructure. Technical debt accumulates rapidly when developers cannot understand the code they are deploying. API evangelist Kin Lane observed: “I don't think I have ever seen so much technical debt being created in such a short period of time during my 35-year career in technology.”

Ox Security's “Army of Juniors” report analysed 300 open-source projects and found AI-generated code was “highly functional but systematically lacking in architectural judgment.” Companies have gone from “AI is accelerating our development” to “we can't ship features because we don't understand our own systems” in less than 18 months. Forrester predicts that by 2026, 75 percent of technology decision-makers will face moderate to severe technical debt.

The connection to standardisation efforts is direct. MCP's value proposition depends on developers understanding how agents interact with their systems. AGENTS.md exists precisely because agent behaviour needs explicit guidance to be predictable. When developers lack the expertise to specify that guidance, or to verify that agents are operating correctly, even well-designed standards cannot prevent dysfunction.

The Infrastructure Sustainability Question

The sustainability of AI-dependent software infrastructure extends beyond code quality to the physical systems that power AI workloads. American data centres used 4.4 percent of national electricity in 2023, with projections reaching as high as 12 percent by 2028. Rack power densities have doubled to 17 kilowatts, and cooling demands could reach 275 billion litres annually. Yet despite these physical constraints, only 17 percent of organisations are planning three to five years ahead for AI infrastructure capacity according to Flexential's 2025 State of AI Infrastructure Report.

The year brought sobering reminders of infrastructure fragility. Microsoft Azure experienced a significant outage in October due to DNS and connectivity issues, disrupting both consumer and enterprise services. Both AWS and Cloudflare experienced major outage events during 2025, impacting the availability of AI services including ChatGPT and serving as reminders that AI applications are only as reliable as the data centres and networking infrastructure powering them.

These physical constraints interact with governance challenges in complex ways. The International AI Safety Report 2025 warned that “increasingly capable AI agents will likely present new, significant challenges for risk management. Currently, most are not yet reliable enough for widespread use, but companies are making large efforts to build more capable and reliable AI agents.” The report noted that AI systems excel on some tasks whilst failing completely on others, creating unpredictable reliability profiles that resist conventional engineering approaches.

Talent gaps compound these challenges. Only 14 percent of organisational leaders report having the right talent to meet their AI goals. Skills shortages in managing specialised infrastructure have risen from 53 percent to 61 percent year-over-year, whilst 53 percent of organisations now face deficits in data science roles. Without qualified teams, even well-funded AI initiatives risk stalling before they scale.

Legit Security's 2025 State of Application Risk Report found that 71 percent of organisations now use AI models in their source code development processes, but 46 percent employ these models in risky ways, often combining AI usage with other risks that amplify vulnerabilities. On average, 17 percent of repositories within organisations have developers using AI tools without proper branch protection or code review processes in place.

The Governance Imperative

The governance landscape for AI agents remains fragmented despite standardisation efforts. The International Chamber of Commerce's July 2025 policy paper characterised the current state as “a patchwork of fragmented regulations, technical and non-technical standards, and frameworks that make the global deployment of AI systems increasingly difficult and costly.” Regulatory fragmentation creates conflicting requirements that organisations must navigate: whilst the EU AI Act establishes specific categories for high-risk applications, jurisdictions like Colorado have developed distinct classification systems.

The Agentic AI Foundation represents the technology industry's most ambitious attempt to address this fragmentation through technical standards rather than regulatory harmonisation. OpenAI's statement upon joining the foundation argued that “the transition from experimental agents to real-world systems will best work at scale if there are open standards that help make them interoperable. Open standards make agents safer, easier to build, and more portable across tools and platforms, and help prevent the ecosystem from fragmenting as this new category matures.”

Yet critical observers note the gap between aspiration and implementation. Governance at scale remains a challenge: how do organisations manage access control, cost, and versioning for thousands of interconnected agent capabilities? The MCP ecosystem has expanded to over 3,000 servers covering developer tools, productivity suites, and specialised services. Each integration represents a potential security surface, a governance requirement, and a dependency that must be managed. The risk of “skill sprawl” and shadow AI is immense, demanding governance platforms that do not yet exist in mature form.

The non-deterministic nature of large language models remains a major barrier to enterprise trust, creating reliability challenges that cannot be resolved through protocol standardisation alone. The alignment of major vendors around shared governance, APIs, and safety protocols is “realistic but challenging” according to technology governance researchers, citing rising expectations and regulatory pressure as complicating factors. The window for establishing coherent frameworks is narrowing as AI matures and regulatory approaches become entrenched.

Competing Visions of the Agentic Future

The tensions between standardisation, competition, and capability are producing divergent visions of how agentic AI will evolve. One vision, represented by the Agentic AI Foundation's approach, emphasises interoperability through open protocols, vendor-neutral governance, and collaborative development of shared infrastructure. Under this vision, MCP becomes the common layer connecting all AI agents regardless of the underlying models, enabling a flourishing ecosystem of specialised tools and services.

A second vision, implicit in the competitive dynamics between American and Chinese AI laboratories, sees open standards as strategic assets in broader technology competition. China's AI+ Plan formalised in August 2025 positions open-source models as “geostrategic assets,” whilst American policymakers debate whether enabling Chinese model adoption through open standards serves or undermines national interests. Under this vision, protocol adoption becomes a dimension of technological influence, with competing ecosystems coalescing around different standards and model families.

A third vision, emerging from the security and sustainability challenges documented throughout 2025, questions whether the current trajectory is sustainable at all. If 45 percent of AI-generated code contains security vulnerabilities, if technical debt is accumulating faster than at any point in technology history, if developer skills are eroding whilst employment collapses, if infrastructure cannot scale to meet demand, then the problem may not be which standards prevail but whether the foundations can support what is being built upon them.

These visions are not mutually exclusive. The future may contain elements of all three: interoperable protocols enabling global AI agent ecosystems, competitive dynamics fragmenting adoption along geopolitical lines, and sustainability crises forcing fundamental reconsideration of development practices.

What Comes Next

Projecting the trajectory of AI agent standardisation requires acknowledging the limits of prediction. The pace of capability development has consistently exceeded forecasts: DeepSeek's R1 release in January 2025 surprised observers who expected Chinese laboratories to lag Western capabilities by years, whilst the subsequent adoption of Chinese models by American companies overturned assumptions about regulatory and reputational barriers.

Several dynamics appear likely to shape the next phase. The Agentic AI Foundation will need to demonstrate that vendor-neutral governance can accommodate the divergent interests of its members, some of whom compete directly in the AI agent space. Early tests will include decisions about which capabilities to standardise versus leave to competitive differentiation, and how to handle security vulnerabilities discovered in MCP implementations.

The relationship between MCP and A2A will require resolution. Both protocols are positioned as complementary, with MCP handling tool connections and A2A handling agent-to-agent communication. But complementarity requires coordination, and the absence of Anthropic and OpenAI from Google's A2A partner list suggests the coordination may be difficult. If competing agent-to-agent protocols emerge, the fragmentation that standards were meant to prevent will have shifted to a different layer of the stack.

Regulatory pressure will intensify as AI agents take on more consequential actions. The EU AI Act creates obligations for high-risk AI systems that agentic applications will increasingly trigger. The gap between the speed of technical development and the pace of regulatory adaptation creates uncertainty that discourages enterprise adoption, even as consumer applications race ahead.

The vibe coding problem will not resolve itself. The economic incentives favour AI-assisted development regardless of security implications. Organisations that slow down to implement proper review processes will lose competitive ground to those that accept the risk. Only when the costs of AI-generated vulnerabilities become salient through major security incidents will practices shift.

Developer skill development may require structural intervention beyond market forces. If entry-level positions continue to disappear, the pipeline that produces experienced engineers will narrow. Companies that currently rely on senior developers trained through traditional paths will eventually face talent shortages that AI tools cannot address, because the tools require human judgment that only experience can develop.

The Stakes of Getting It Right

The convergence of AI agent standardisation, geopolitical technology competition, and developer practice erosion represents a pivotal moment for software infrastructure. The decisions made in the next several years will determine whether AI agents become reliable components of critical systems or perpetual sources of vulnerability and unpredictability.

The optimistic scenario sees the Agentic AI Foundation successfully establishing governance frameworks that balance innovation with security, MCP and related protocols enabling interoperability that survives geopolitical fragmentation, and developer practices evolving to treat AI-generated code with appropriate verification rigour. Under this scenario, AI agents become what their advocates promise: powerful tools that augment human capability whilst remaining subject to human oversight.

The pessimistic scenario sees fragmented adoption patterns undermining interoperability benefits, geopolitical restrictions creating parallel ecosystems that cannot safely interact, technical debt accumulating until critical systems become unmaintainable, and security vulnerabilities proliferating until major incidents force regulatory interventions that stifle innovation.

The most likely outcome lies somewhere between these extremes. Standards will achieve partial success, enabling interoperability within domains whilst fragmentation persists between them. Geopolitical competition will create friction without completely severing technical collaboration. Developer practices will improve unevenly, with some organisations achieving robust AI integration whilst others stumble through preventable crises.

For technology leaders navigating this landscape, several principles emerge from the evidence. Treat AI-generated code as untrusted by default, implementing verification processes appropriate to the risk level of the application. Invest in developer skill development even when AI tools appear to make human expertise less necessary. Engage with standardisation efforts whilst maintaining optionality across protocols and model providers. Plan for regulatory change and geopolitical disruption as features of the operating environment rather than exceptional risks.

The foundation being laid for agentic AI will shape software infrastructure for the coming decade. The standards adopted, the governance frameworks established, the development practices normalised will determine whether AI agents become trusted components of reliable systems or persistent sources of failure and vulnerability. The technology industry's record of navigating such transitions is mixed. This time, the stakes are considerably higher.

---

References

1. Linux Foundation. “Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF).” December 2025. https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation

2. Anthropic. “Donating the Model Context Protocol and establishing the Agentic AI Foundation.” December 2025. https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation

3. Model Context Protocol. “One Year of MCP: November 2025 Spec Release.” November 2025. https://blog.modelcontextprotocol.io/posts/2025-11-25-first-mcp-anniversary/

4. GitHub Blog. “MCP joins the Linux Foundation.” December 2025. https://github.blog/open-source/maintainers/mcp-joins-the-linux-foundation-what-this-means-for-developers-building-the-next-era-of-ai-tools-and-agents/

5. Block. “Block Open Source Introduces codename goose.” January 2025. https://block.xyz/inside/block-open-source-introduces-codename-goose

6. OpenAI. “OpenAI co-founds the Agentic AI Foundation under the Linux Foundation.” December 2025. https://openai.com/index/agentic-ai-foundation/

7. AGENTS.md. “Official Site.” https://agents.md

8. Google Developers Blog. “Announcing the Agent2Agent Protocol (A2A).” April 2025. https://developers.googleblog.com/en/a2a-a-new-era-of-agent-interoperability/

9. ChinaTalk. “China AI in 2025 Wrapped.” December 2025. https://www.chinatalk.media/p/china-ai-in-2025-wrapped

10. NBC News. “More of Silicon Valley is building on free Chinese AI.” October 2025. https://www.nbcnews.com/tech/innovation/silicon-valley-building-free-chinese-ai-rcna242430

11. Dataconomy. “Alibaba's Qwen3 Surpasses Llama As Top Open-source Model.” December 2025. https://dataconomy.com/2025/12/15/alibabas-qwen3-surpasses-llama-as-top-open-source-model/

12. DEV Community. “Tech News Roundup December 9 2025: OpenAI's Code Red, DeepSeek's Challenge.” December 2025. https://dev.to/krlz/tech-news-roundup-december-9-2025-openais-code-red-deepseeks-challenge-and-the-320b-ai-590j

13. Council on Foreign Relations. “The Consequences of Exporting Nvidia's H200 Chips to China.” December 2025. https://www.cfr.org/expert-brief/consequences-exporting-nvidias-h200-chips-china

14. Council on Foreign Relations. “China's AI Chip Deficit: Why Huawei Can't Catch Nvidia.” 2025. https://www.cfr.org/article/chinas-ai-chip-deficit-why-huawei-cant-catch-nvidia-and-us-export-controls-should-remain

15. Veracode. “2025 GenAI Code Security Report.” 2025. https://www.veracode.com/resources/analyst-reports/2025-genai-code-security-report/

16. Lawfare. “When the Vibes Are Off: The Security Risks of AI-Generated Code.” 2025. https://www.lawfaremedia.org/article/when-the-vibe-are-off--the-security-risks-of-ai-generated-code

17. Stack Overflow. “AI vs Gen Z: How AI has changed the career pathway for junior developers.” December 2025. https://stackoverflow.blog/2025/12/26/ai-vs-gen-z/

18. METR. “Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity.” July 2025. https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/

19. InfoQ. “AI-Generated Code Creates New Wave of Technical Debt.” November 2025. https://www.infoq.com/news/2025/11/ai-code-technical-debt/

20. Flexential. “State of AI Infrastructure Report 2025.” 2025. https://www.flexential.com/resources/report/2025-state-ai-infrastructure

21. International AI Safety Report. “International AI Safety Report 2025.” 2025. https://internationalaisafetyreport.org/publication/international-ai-safety-report-2025

22. Legit Security. “2025 State of Application Risk Report.” 2025. https://www.legitsecurity.com/blog/understanding-ai-risk-in-software-development

23. International Chamber of Commerce. “ICC Policy Paper: AI governance and standards.” July 2025. https://iccwbo.org/wp-content/uploads/sites/3/2025/07/2025-ICC-Policy-Paper-AI-governance-and-standards.pdf

24. TechPolicy.Press. “Closing the Gaps in AI Interoperability.” 2025. https://www.techpolicy.press/closing-the-gaps-in-ai-interoperability/

25. Block. “Securing the Model Context Protocol.” goose Blog. March 2025. https://block.github.io/goose/blog/2025/03/31/securing-mcp/

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

In February 2025, Andrej Karpathy, the former AI director at Tesla and founding engineer at OpenAI, posted something to X that would reshape how we talk about software development. “There's a new kind of coding I call 'vibe coding',” he wrote, “where you fully give in to the vibes, embrace exponentials, and forget that the code even exists.” He described using voice transcription to talk to AI assistants, clicking “Accept All” without reading the diffs, and copy-pasting error messages with no comment. When bugs proved stubborn, he would “just work around it or ask for random changes until it goes away.”

Within months, this approach had transformed from a personal workflow confession into a movement. By November 2025, Collins Dictionary had named “vibe coding” its Word of the Year, defining it as “using natural language prompts to have AI assist with the writing of computer code.” The lexicographers at Collins noted a large uptick in usage since the term first appeared, with managing director Alex Beecroft declaring it “perfectly captures how language is evolving alongside technology.”

The numbers behind this shift are staggering. According to Y Combinator managing partner Jared Friedman, a quarter of startups in the Winter 2025 batch had codebases that were 95% AI-generated. Google CEO Sundar Pichai revealed that more than 25% of all new code at Google was being generated by AI, then reviewed and accepted by engineers. Industry estimates suggest that 41% of all code written in 2025 was AI-generated, with data from Jellyfish indicating that almost half of companies now have at least 50% AI-generated code, compared to just 20% at the start of the year.

But beneath these impressive statistics lies a growing unease. What happens when the developers who built these systems cannot explain how they work, because they never truly understood them in the first place? What becomes of software maintainability when the dominant development methodology actively discourages understanding? And as AI-assisted developers increasingly outnumber traditionally trained engineers, who will possess the architectural discipline to recognise when something has gone terribly wrong?

The Maintainability Crisis Takes Shape

The first concrete evidence that vibe coding carries hidden costs arrived in May 2025, when security researcher Matt Palmer discovered a critical vulnerability in Lovable, one of the most prominent vibe coding platforms. The vulnerability, catalogued as CVE-2025-48757 with a CVSS score of 8.26 (High severity), stemmed from misconfigured Row Level Security policies in applications created through the platform.

Palmer's scan of 1,645 Lovable-created web applications revealed that 170 of them allowed anyone to access information about users, including names, email addresses, financial information, and secret API keys for AI services. The vulnerability touched 303 endpoints, allowing unauthenticated attackers to read and write to databases of Lovable apps. In the real world, this meant sensitive data (names, emails, API keys, financial records, even personal debt amounts) was exposed to anyone who knew where to look.

The disclosure timeline proved equally troubling. Palmer emailed Lovable CEO Anton Osika with detailed vulnerability reports on 21 March 2025. Lovable confirmed receipt on 24 March but provided no substantive response. On 24 April, Lovable released “Lovable 2.0” with a new “security scan” feature. The scanner only flagged the presence of Row Level Security policies, not whether they actually worked. It failed to detect misconfigured policies, creating a false sense of security.

The Lovable incident illuminates a fundamental problem: AI models generating code cannot yet see the big picture and scrutinise how that code will ultimately be used. Users of vibe coding platforms might not even know the right security questions to ask. The democratisation of software development had created a new class of developer who could build applications without understanding security fundamentals.

The Productivity Paradox Revealed

The promise of vibe coding rests on a seductive premise: by offloading the mechanical work of writing code to AI, developers can move faster and accomplish more. But a rigorous study published by METR (Model Evaluation and Threat Research) in July 2025 challenged this assumption in unexpected ways.

The study examined how AI tools at the February to June 2025 frontier affected productivity. Sixteen developers with moderate AI experience completed 246 tasks in mature projects where they had an average of five years of prior experience and 1,500 commits. The developers primarily used Cursor Pro with Claude 3.5/3.7 Sonnet, which were frontier models at the time of the study.

The results confounded expectations. Before starting tasks, developers forecast that allowing AI would reduce completion time by 24%. After completing the study, developers estimated that AI had reduced completion time by 20%. The actual measured result: allowing AI increased completion time by 19%. AI tooling had slowed developers down.

This gap between perception and reality is striking. Developers expected AI to speed them up, and even after experiencing the slowdown, they still believed AI had sped them up. The METR researchers identified several factors contributing to the slowdown: developers accepted less than 44% of AI generations, spending considerable time reviewing, testing, and modifying code only to reject it in the end. AI tools introduced “extra cognitive load and context-switching” that disrupted productivity. The researchers also noted that developers worked on mature codebases averaging 10 years old with over 1 million lines of code, environments where AI tools may be less effective than in greenfield projects.

The METR findings align with data from DX's Q4 2025 report, which found that developers saved 3.6 hours weekly among a sample of 135,000+ developers. But these savings came with significant caveats: the report revealed that context pain increases with experience, from 41% among junior developers to 52% among seniors. While some developers report productivity gains, the hard evidence remains mixed.

Trust Erodes Even as Adoption Accelerates

The productivity paradox reflects a broader pattern emerging across the industry: developers are adopting AI tools at accelerating rates while trusting them less. The Stack Overflow 2025 Developer Survey, which received over 49,000 responses from 177 countries, reveals this contradiction in stark terms.

While 84% of developers now use or plan to use AI tools in their development process (up from 76% in 2024), trust has declined sharply. Only 33% of developers trust the accuracy of AI tools, down from 43% in 2024, while 46% actively distrust it. A mere 3% report “highly trusting” the output. Positive sentiment for AI tools dropped from over 70% in 2023 and 2024 to just 60% in 2025.

Experienced developers are the most cautious, with the lowest “highly trust” rate (2.6%) and the highest “highly distrust” rate (20%), indicating a widespread need for human verification for those in roles with accountability.

The biggest frustration, cited by 66% of developers, is dealing with “AI solutions that are almost right, but not quite.” This leads directly to the second-biggest frustration: “Debugging AI-generated code is more time-consuming,” reported by 45% of respondents. An overwhelming 75% said they would still ask another person for help when they do not trust AI's answers. About 35% of developers report that their visits to Stack Overflow are a result of AI-related issues at least some of the time.

Perhaps most telling for the enterprise adoption question: developers show the strongest resistance to using AI for high-responsibility, systemic tasks like deployment and monitoring (76% do not plan to use AI for this) and project planning (69% do not plan to). AI agents are not yet mainstream, with 52% of developers either not using agents or sticking to simpler AI tools, and 38% having no plans to adopt them.

Google's 2024 DORA (DevOps Research and Assessment) report found a troubling trade-off: while a 25% increase in AI usage quickened code reviews and benefited documentation, it resulted in a 7.2% decrease in delivery stability. The 2025 DORA report confirmed that AI adoption continues to have a negative relationship with software delivery stability, noting that “AI acts as an amplifier, increasing the strength of high-performing organisations but worsening the dysfunction of those that struggle.”

Technical Debt Accumulates at Unprecedented Scale

These trust issues and productivity paradoxes might be dismissed as growing pains if the code being produced were fundamentally sound. But the consequences of rapid AI-generated code deployment are becoming measurable, and the data points toward a structural problem.

GitClear's 2025 research, analysing 211 million changed lines of code from repositories owned by Google, Microsoft, Meta, and enterprise corporations, found emerging trends showing four times more code cloning, with “copy/paste” exceeding “moved” code for the first time in history.

During 2024, GitClear tracked an eightfold increase in the frequency of code blocks with five or more lines that duplicate adjacent code, showing a prevalence of code duplication ten times higher than two years ago. Lines classified as “copy/pasted” (cloned) rose from 8.3% to 12.3% between 2021 and 2024. The percentage of changed code lines associated with refactoring sank from 25% of changed lines in 2021 to less than 10% in 2024, with predictions for 2025 suggesting refactoring will represent little more than 3% of code changes.

“What we're seeing is that AI code assistants excel at adding code quickly, but they can cause 'AI-induced tech debt,'” explained GitClear founder Bill Harding. “This presents a significant challenge for DevOps teams that prioritise maintainability and long-term code health.”

A report from Ox Security found that AI-generated code is “highly functional but systematically lacking in architectural judgment.” This aligns with observations that code assistants make it easy to insert new blocks of code simply by pressing the tab key, but they are less likely to propose reusing a similar function elsewhere in the code, partly because of limited context size.

The financial implications are substantial. McKinsey research indicates that technical debt accounts for about 40% of IT balance sheets, with organisations carrying heavy technical debt losing up to 20% to 40% of their IT budgets to maintenance, leaving far less for genuine innovation. Companies pay an additional 10 to 20% to address tech debt on top of the costs of any project.

Armando Solar-Lezama, a professor at MIT specialising in program synthesis, offered a colourful assessment in remarks widely cited across the industry: AI represents a “brand new credit card here that is going to allow us to accumulate technical debt in ways we were never able to do before.”

When the Bill Comes Due

In September 2025, Fast Company reported that the “vibe coding hangover” was upon us. “Code created by AI coding agents can become development hell,” said Jack Zante Hays, a senior software engineer at PayPal who works on AI software development tools. He noted that while the tools can quickly spin up new features, they often generate technical debt, introducing bugs and maintenance burdens that must eventually be addressed by human developers.

The article documented a growing phenomenon: developers struggling to maintain systems that had been easy to create but proved difficult to extend. “Vibe coding (especially from non-experienced users who can only give the AI feature demands) can involve changing like 60 things at once, without testing, so 10 things can be broken at once.” Unlike a human engineer who methodically tests each addition, vibe-coded software often struggles to adapt once it is live, particularly when confronted with real-world edge cases.

By the fourth quarter of 2025, the industry began experiencing what experts call a structural reckoning. LinkedIn searches for “Vibe Coding Cleanup Specialist” reveal dozens of programmers advertising their services as digital janitors for the AI coding revolution. As one consultancy describes it: “Companies increasingly turn to such specialists to rescue projects where AI code is raw, without proper architecture and security. Those who made demos now call in seniors to make the code stable and secure.”

Y Combinator CEO Garry Tan raised this question directly: “Suppose a startup with 95% AI-generated code successfully goes public and has 100 million users a year or two later. Will it crash? Current reasoning models aren't strong enough for debugging. So founders must have a deep understanding of the product.”

The Disappearing Pipeline for Engineering Talent

The impact of vibe coding extends beyond code quality into workforce dynamics, threatening the very mechanisms by which engineering expertise has traditionally been developed. A Stanford University study titled “Canaries in the Coal Mine? Six Facts about the Recent Employment Effects of Artificial Intelligence,” authored by Erik Brynjolfsson, Bharat Chandar, and Ruyu Chen, examined anonymised monthly payroll data from ADP covering millions of workers across tens of thousands of US firms through July 2025.

The findings are stark: employment for software developers aged 22 to 25 declined by nearly 20% compared to its peak in late 2022. Workers aged 22 to 25 are the most exposed to artificial intelligence, suffering a decline in employment of 13%. Early career workers in the most AI-exposed occupations (like software engineering, marketing, and customer service) have experienced a 16% relative decline in employment, even after controlling for firm-level impacts.

Meanwhile, the employment rates of older workers in high AI-exposure fields are holding strong. For workers aged 30 and over, employment in the highest AI-exposure categories grew between 6% and 12% from late 2022 to May 2025. One interpretation offered by the researchers is that while younger employees contribute primarily “codified knowledge” from their education (something AI can replicate), more experienced workers lean on tacit knowledge developed through years on the job, which remains less vulnerable to automation.

A Harvard study on “Seniority-Biased Change” (2025), where two Harvard economists analysed 62 million LinkedIn profiles and 200 million job postings, found that in firms using generative AI, junior employment “declines sharply” relative to non-adopters. The loss was concentrated in occupations highly exposed to AI and was driven by slower hiring, not increased firing. The researchers interpret this as companies with AI largely skipping hiring new graduates for the tasks the AI handled.

The traditional pathway of “learn to code, get junior job, grow into senior” is wobbling. Year-over-year, internships across all industries have decreased 11%, according to Indeed. Handshake, an internship recruitment platform, reported a 30% decline in tech-specific internship postings since 2023. Per the Federal Reserve report on labour market outcomes, computer engineering graduates now have one of the highest rates of unemployment across majors, at 7.5% (higher even than fine arts degree holders).

The Expertise Atrophy Loop

The junior employment crisis connects directly to a deeper concern: fundamental skill atrophy. If developers stop writing code manually, will they lose the ability to understand and debug complex systems? And if the pipeline for developing new senior engineers dries up, who will maintain the increasingly complex systems that vibe coding creates?

Luciano Nooijen, an engineer at the video-game infrastructure developer Companion Group, used AI tools heavily in his day job. But when he began a side project without access to those tools, he found himself struggling with tasks that previously came naturally. “I was feeling so stupid because things that used to be instinct became manual, sometimes even cumbersome,” he told MIT Technology Review. Just as athletes still perform basic drills, he thinks the only way to maintain an instinct for coding is to regularly practice the grunt work.

Developer discourse in 2025 was split. Some admitted they hardly ever write code “by hand” and think coding interviews should evolve. Others argued that skipping fundamentals leads to more firefighting when AI's output breaks. The industry is starting to expect engineers to bring both: AI speed and foundational wisdom for quality.

Y Combinator partner Diana Hu pointed out that even with heavy AI reliance, developers still need a crucial skill: reading code and identifying errors. “You have to have taste, enough training to judge whether the LLM output is good or bad.”

This creates a troubling paradox. The pathway to developing “taste” (the intuition that distinguishes quality code from problematic code) has traditionally come through years of hands-on coding experience. If vibe coding removes that pathway, how will the next generation of developers develop the judgement necessary to evaluate AI-generated output?

Building Guardrails That Preserve the Learning Journey

The question of whether organisations should establish guardrails that preserve the learning journey and architectural discipline that traditional coding cultivates is no longer theoretical. By 2025, 87% of enterprises lacked comprehensive AI security frameworks, according to Gartner research. Governance frameworks matter more for AI code generation than traditional development tools because the technology introduces new categories of risk.

Several intervention strategies have emerged from organisations grappling with vibe coding's consequences.

Layered verification architectures represent one approach. Critical core components receive full human review, while peripheral functionality uses lighter-weight validation. AI can generate code in outer layers, subject to interface contracts defined by verified inner layers. Input access layers ensure only authorised users interact with the system and validate their prompts for malicious injection attempts. Output layers scan generated code for security vulnerabilities and non-compliance with organisational style through static analysis tools.

Contract-first development offers another model. Rather than generating code directly from natural language, developers first specify formal contracts (preconditions, postconditions, invariants) that capture intent. AI then generates implementation code that is automatically checked against these contracts. This approach draws on Bertrand Meyer's Design by Contract methodology from the 1980s, which prescribes that software designers should define formal, precise, and verifiable interface specifications for software components.

Operational safety boundaries prevent AI-generated code from reaching production without human review. All AI-generated changes go through established merge request and review processes. Admin controls block forbidden commands, and configurable human touchpoints exist within workflows based on customer impact.

The code review bottleneck presents its own challenges. As engineering teams discover, the sheer volume of code now being churned out is quickly saturating the ability of midlevel staff to review changes. Senior engineers, who have deeper mental models of their codebase, see the largest quality gains from AI (60%) but also report the lowest confidence in shipping AI-generated code (22%).

Economic Pressure Versus Architectural Discipline

The economic pressure toward speed is undeniable, and it creates structural incentives that directly conflict with maintainability. Y Combinator CEO Garry Tan told CNBC that the Winter 2025 batch of YC companies in aggregate grew 10% per week, and it was not just the top one or two companies but the whole batch. “That's never happened before in early-stage venture.”

“What that means for founders is that you don't need a team of 50 or 100 engineers. You don't have to raise as much. The capital goes much longer,” Tan explained. About 80% of the YC companies that presented at Demo Day were AI-focused, with this group able to prove earlier commercial validation compared to previous generations.

But this very efficiency creates structural incentives that work against long-term sustainability. Forrester predicts that by 2025, more than 50% of technology decision-makers will face moderate to severe technical debt, with that number expected to hit 75% by 2026. Industry analysts predict that by 2027, 75% of organisations will face systemic failures due to unmanaged technical debt.

The State of Software Delivery 2025 report by software vendor Harness found that, contrary to perceived productivity benefits, the majority of developers spend more time debugging AI-generated code and more time resolving security vulnerabilities. If the current trend in code churn continues (now at 7.9% of all newly added code revised within two weeks, compared to just 5.5% in 2020), GitClear predicts defect remediation may become the leading day-to-day developer responsibility.

The software craftsmanship manifesto, established in 2008 by developers meeting in Libertyville, Illinois, articulated values that seem increasingly relevant: not only working software, but also well-crafted software; not only responding to change, but also steadily adding value; not only individuals and interactions, but also a community of professionals.

As Tabnine's analysis observed: “Vibe coding is what happens when AI is applied indiscriminately, without structure, standards, or alignment to engineering principles. Developers lean on generative tools to create code that 'just works.' It might compile. It might even pass a test. But in enterprise environments, where quality and compliance are non-negotiable, this kind of code is a liability, not a lift.”

Structural Interventions That Could Realign Development Practice

What structural or cultural interventions could realign development practices toward meaningful problem-solving over rapid code generation? Several approaches warrant consideration.

First, educational reform must address the skills mismatch. The five core skills shaping engineering in 2026 include context engineering, retrieval-augmented generation, AI agents, AI evaluation, and AI deployment and scaling. By 2026, the most valuable engineers are no longer those who write the best prompts but those who understand how to build systems around models. Junior developers are advised to use AI as a learning tool, not a crutch: review why suggested code works and identify weaknesses, occasionally disable AI helpers and write key algorithms from scratch, prioritise computer science fundamentals, implement projects twice (once with AI, once without), and train in rigorous testing.

Second, organisations need governance frameworks that treat AI-generated code differently from human-written code. Rather than accepting it as a black box, organisations should require that AI-generated code be accompanied by formal specifications, proofs of key properties, and comprehensive documentation that explains not just what the code does but why it does it. The DORA AI Capabilities Model identifies seven technical and cultural best practices for AI adoption: clear communication of AI usage policies, high-quality internal data, AI access to that data, strong version control, small batches of work, user-centric focus, and a high-quality internal platform.

Third, the code review process must evolve. AI reviewers are emerging as a solution to bridge the gap between code generation speed and review capacity. Instead of waiting hours or days for a busy senior developer to give feedback, an AI reviewer can respond within minutes. The answer emerging from practice involves treating AI reviewers as a first-pass filter that catches obvious issues while preserving human review for architectural decisions and security considerations.

Fourth, organisations must invest in maintaining architectural expertise. Successful companies allocate 15% to 20% of budget and sprint capacity systematically to debt reduction, treating it as a “lifestyle change” rather than a one-time project. McKinsey noted that “some companies find that actively managing their tech debt frees up engineers to spend up to 50 percent more of their time on work that supports business goals.”

The Cultural Dimension of Software Quality

Beyond structural interventions, the question is fundamentally cultural. Will the industry value the craftsmanship that comes from understanding systems deeply, or will economic pressure normalise technical debt accumulation at scale?

The signals are mixed. On one hand, the vibe coding hangover suggests market correction is already occurring. Companies that moved fast and broke things are now paying for expertise to fix what they broke. The emergence of “vibe coding cleanup specialists” represents market recognition that speed without sustainability is ultimately expensive.

On the other hand, the competitive dynamics favour speed. When Y Combinator startups grow 10% per week using 95% AI-generated code, the pressure on competitors to match that velocity is intense. The short-term rewards for vibe coding are visible and immediate; the long-term costs are diffuse and deferred.

The craftsmanship movement offers a counternarrative. Zed's blog captured this perspective: “Most people are talking about how AI can help us make software faster and help us make more software. As craftspeople, we should look at AI and ask, 'How can this help me build better software?'” A gnarly codebase hinders not only human ability to work in it but also the ability of AI tools to be effective in it.

Perhaps the most significant intervention would be changing how we measure success. Currently, the industry celebrates velocity: lines of code generated, features shipped, time to market. What if we equally celebrated sustainability: code that remains maintainable over time, systems that adapt gracefully to changing requirements, architectures that future developers can understand and extend?

Where the Reckoning Leads

The proliferation of vibe coding as a dominant development methodology threatens long-term software maintainability in ways that are now empirically documented. Code duplication is up fourfold. Refactoring has collapsed from 25% to potentially 3% of changes. Delivery stability decreases as AI adoption increases. Junior developer employment has fallen by 20% while the pathway to developing senior expertise narrows.

The question of whether organisations should establish guardrails is no longer open. The evidence indicates they must, or face the consequences documented in security incidents, technical debt accumulation, and the structural erosion of engineering expertise.

Whether economic pressure toward speed will inevitably normalise technical debt at scale depends on choices yet to be made. Markets can correct when costs become visible, and the vibe coding hangover suggests that correction has begun. But markets also systematically underweight future costs relative to present benefits, and the current incentive structures favour speed over sustainability.

The interventions that could realign development practices toward meaningful problem-solving are known: layered verification architectures, contract-first development, operational safety boundaries, educational reform emphasising fundamentals alongside AI fluency, governance frameworks that require documentation and review of AI-generated code, investment in architectural expertise, and cultural shifts that value sustainability alongside velocity.

The path forward requires preserving what traditional coding cultivates (the learning journey, the architectural discipline, the deep understanding of systems) while embracing the productivity gains that AI assistance offers. This is not a binary choice between vibe coding and craftsmanship. It is the harder work of integration: using AI to augment human expertise rather than replace it, maintaining the feedback loops that develop judgement, and building organisations that value both speed and sustainability.

The stakes extend beyond any individual codebase. As software mediates an ever-larger share of human activity, the quality of that software matters profoundly. Systems that cannot be maintained will eventually fail. Systems that no one understands will fail in ways no one can predict. The reckoning that began in 2025 is just the beginning of a longer conversation about what we want from the software that shapes our world.

---

References and Sources

1. Karpathy, A. (2025, February 2). Twitter/X post introducing vibe coding. https://x.com/karpathy/status/1886192184808149383

2. Collins Dictionary. (2025). Collins Word of the Year 2025: Vibe Coding. https://www.collinsdictionary.com/us/woty

3. CNN. (2025, November 6). 'Vibe coding' named Collins Dictionary's Word of the Year. https://www.cnn.com/2025/11/06/tech/vibe-coding-collins-word-year-scli-intl

4. TechCrunch. (2025, March 6). A quarter of startups in YC's current cohort have codebases that are almost entirely AI-generated. https://techcrunch.com/2025/03/06/a-quarter-of-startups-in-ycs-current-cohort-have-codebases-that-are-almost-entirely-ai-generated/

5. CNBC. (2025, March 15). Y Combinator startups are fastest growing, most profitable in fund history because of AI. https://www.cnbc.com/2025/03/15/y-combinator-startups-are-fastest-growing-in-fund-history-because-of-ai.html

6. METR. (2025, July 10). Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity. https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/

7. Stack Overflow. (2025). 2025 Stack Overflow Developer Survey. https://survey.stackoverflow.co/2025/

8. Stack Overflow Blog. (2025, December 29). Developers remain willing but reluctant to use AI: The 2025 Developer Survey results are here. https://stackoverflow.blog/2025/12/29/developers-remain-willing-but-reluctant-to-use-ai-the-2025-developer-survey-results-are-here

9. Palmer, M. (2025). Statement on CVE-2025-48757. https://mattpalmer.io/posts/statement-on-CVE-2025-48757/

10. Security Online. (2025). CVE-2025-48757: Lovable's Row-Level Security Breakdown Exposes Sensitive Data Across Hundreds of Projects. https://securityonline.info/cve-2025-48757-lovables-row-level-security-breakdown-exposes-sensitive-data-across-hundreds-of-projects/

11. GitClear. (2025). AI Copilot Code Quality: 2025 Data Suggests 4x Growth in Code Clones. https://www.gitclear.com/ai_assistant_code_quality_2025_research

12. Google Cloud Blog. (2024). Announcing the 2024 DORA report. https://cloud.google.com/blog/products/devops-sre/announcing-the-2024-dora-report

13. Google Cloud Blog. (2025). Announcing the 2025 DORA Report. https://cloud.google.com/blog/products/ai-machine-learning/announcing-the-2025-dora-report

14. McKinsey. (2024). Tech debt: Reclaiming tech equity. https://www.mckinsey.com/capabilities/mckinsey-digital/our-insights/tech-debt-reclaiming-tech-equity

15. Fast Company. (2025, September). The vibe coding hangover is upon us. https://www.fastcompany.com/91398622/the-vibe-coding-hangover-is-upon-us

16. Final Round AI. (2025). Young Software Developers Losing Jobs to AI, Stanford Study Confirms. https://www.finalroundai.com/blog/stanford-study-shows-young-software-developers-losing-jobs-to-ai

17. Stack Overflow Blog. (2025, December 26). AI vs Gen Z: How AI has changed the career pathway for junior developers. https://stackoverflow.blog/2025/12/26/ai-vs-gen-z/

18. MIT Technology Review. (2025, December 15). AI coding is now everywhere. But not everyone is convinced. https://www.technologyreview.com/2025/12/15/1128352/rise-of-ai-coding-developers-2026/

19. InfoQ. (2025, November). AI-Generated Code Creates New Wave of Technical Debt, Report Finds. https://www.infoq.com/news/2025/11/ai-code-technical-debt/

20. The New Stack. (2025). Is AI Creating a New Code Review Bottleneck for Senior Engineers? https://thenewstack.io/is-ai-creating-a-new-code-review-bottleneck-for-senior-engineers/

21. Tabnine Blog. (2025). A Return to Craftsmanship in Software Engineering. https://www.tabnine.com/blog/a-return-to-craftsmanship-in-the-age-of-ai-for-software-engineering/

22. Zed Blog. (2025). The Case for Software Craftsmanship in the Era of Vibes. https://zed.dev/blog/software-craftsmanship-in-the-era-of-vibes

23. Manifesto for Software Craftsmanship. (2009). https://manifesto.softwarecraftsmanship.org/

24. DX. (2025). AI-assisted engineering: Q4 impact report. https://getdx.com/blog/ai-assisted-engineering-q4-impact-report-2025/

25. Jellyfish. (2025). 2025 AI Metrics in Review: What 12 Months of Data Tell Us About Adoption and Impact. https://jellyfish.co/blog/2025-ai-metrics-in-review/

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

In November 2021, something remarkable happened. All 193 member states of UNESCO, a body not known for unanimous agreement on much of anything, adopted the first global standard on the ethics of artificial intelligence. The Recommendation on the Ethics of Artificial Intelligence was heralded as a watershed moment. Finally, the international community had come together to establish common values and principles for the responsible development of AI. The document spoke of transparency, accountability, human rights, and dignity. It was, by all accounts, a triumph of multilateral cooperation.

Four years later, the triumph looks rather hollow. In Denmark, algorithmic systems continue to flag ethnic minorities and people with disabilities as potential welfare fraudsters. In the United States, facial recognition technology still misidentifies people of colour at rates that should make any engineer blush. And across the European Union, companies scramble to comply with the AI Act whilst simultaneously lobbying to hollow out its most meaningful provisions. The principles are everywhere. The protections remain elusive.

This is the central paradox of contemporary AI governance: we have never had more ethical frameworks, more principles documents, more international recommendations, and more national strategies. Yet the gap between what these frameworks promise and what they deliver continues to widen. The question is no longer whether we need AI governance. The question is why, despite an abundance of stated commitments, so little has changed for those most vulnerable to algorithmic harm.

The Multiplication of Frameworks Without Accountability

The landscape of AI governance has become remarkably crowded. The OECD AI Principles, first adopted in 2019 and updated in 2024, now count 47 adherents including the European Union. The G7's Hiroshima AI Process has produced its own set of guiding principles. China has issued a dense web of administrative rules on algorithmic recommendation, deep synthesis, and generative AI. The United States has seen more than 1,000 AI-related bills introduced across nearly every state in 2024 and 2025. The European Union's AI Act, which entered into force on 1 August 2024, represents the most comprehensive attempt yet to create binding legal obligations for AI systems.

On paper, this proliferation might seem like progress. More governance frameworks should mean more accountability, more oversight, more protection. In practice, something quite different is happening. The multiplication of principles has created what scholars describe as a “weak regime complex,” a polycentric structure where work is generally siloed and coordination remains elusive. Each new framework adds to a growing cacophony of competing standards, definitions, and enforcement mechanisms that vary wildly across jurisdictions.

The consequences of this fragmentation are not abstract. Companies operating internationally face a patchwork of requirements that creates genuine compliance challenges whilst simultaneously providing convenient excuses for inaction. The EU AI Act defines AI systems one way; Chinese regulations define them another. What counts as a “high-risk” application in Brussels may not trigger any regulatory attention in Beijing or Washington. This jurisdictional complexity does not merely burden businesses. It creates gaps through which harm can flow unchecked.

Consider the fundamental question of what an AI system actually is. The EU AI Act has adopted a definition that required extensive negotiation and remains subject to ongoing interpretation challenges. As one analysis noted, “Defining what counts as an 'AI system' remains challenging and requires multidisciplinary input.” This definitional ambiguity matters because it determines which systems fall within regulatory scope and which escape it entirely. When sophisticated algorithmic decision-making tools can be classified in ways that avoid scrutiny, the protective intent of governance frameworks is undermined from the outset.

The three dominant approaches to AI regulation illustrate this fragmentation. The European Union has opted for a risk-based framework with binding legal obligations, prohibited practices, and substantial penalties. The United States has pursued a sectoral approach, with existing regulators adapting their mandates to address AI within their domains whilst federal legislation remains stalled. China has developed what analysts describe as an “agile and iterative” approach, issuing targeted rules on specific applications rather than comprehensive legislation. Each approach reflects different priorities, different legal traditions, and different relationships between state and industry. The result is a global governance landscape in which compliance with one jurisdiction's requirements may not satisfy another's, and in which the gaps between frameworks create opportunities for harm to proliferate.

The Industry's Hand on the Regulatory Pen

Perhaps nowhere is the gap between stated principles and lived reality more stark than in the relationship between those who develop AI systems and those who regulate them. The technology industry has not been a passive observer of the governance landscape. It has been an active, well-resourced participant in shaping it.

Research from Corporate Europe Observatory found that the technology industry now spends approximately 151 million euros annually on lobbying in Brussels, a rise of more than 50 per cent compared to four years ago. The top spenders include Meta at 10 million euros, and Microsoft and Apple at 7 million euros each. During the final stages of the EU AI Act negotiations, technology companies were given what watchdog organisations described as “privileged and disproportionate access” to high-level European decision-makers. In 2023, fully 86 per cent of meetings on AI held by high-level Commission officials were with industry representatives.

This access has translated into tangible outcomes. Important safeguards on general-purpose AI, including fundamental rights checks, were removed from the AI Act during negotiations. The German and French governments pushed for exemptions that benefited domestic AI startups, with German company Aleph Alpha securing 12 high-level meetings with government representatives, including Chancellor Olaf Scholz, between June and November 2023. France's Mistral AI established a lobbying office in Brussels led by Cedric O, the former French secretary of state for digital transition known to have the ear of President Emmanuel Macron.

The result is a regulatory framework that, whilst representing genuine progress in many areas, has been shaped by the very entities it purports to govern. As one analysis observed, “there are signs of a regulatory arms race where states, private firms and lobbyists compete to set the shape of AI governance often with the aim of either forestalling regulation or privileging large incumbents.”

This dynamic is not unique to Europe. In the United States, efforts to establish federal AI legislation have repeatedly stalled, with industry lobbying playing a significant role. A 2025 budget reconciliation bill would have imposed a ten-year moratorium on enforcement of state and local AI laws, a provision that was ultimately stripped from the bill only after the Senate voted 99 to 1 against penalising states for enacting AI legislation. The provision's very inclusion demonstrated the industry's ambition; its removal showed that resistance remains possible, though hardly guaranteed.

The Dismantling of Internal Oversight

The power imbalance between AI developers and those seeking accountability is not merely a matter of lobbying access. It is structurally embedded in how the industry organises itself around ethics. In recent years, major technology companies have systematically dismantled or diminished the internal teams responsible for ensuring their products do not cause harm.

In March 2023, Microsoft laid off its entire AI ethics team whilst simultaneously doubling down on its integration of OpenAI's technology into its products. An employee speaking about the layoffs stated: “The worst thing is we've exposed the business to risk and human beings to risk in doing this.” Amazon eliminated its ethical AI unit at Twitch. Meta disbanded its Responsible Innovation team, reassigning approximately two dozen engineers and ethics researchers to work directly with product teams, effectively dispersing rather than concentrating ethical oversight. Twitter, following Elon Musk's acquisition, eliminated all but one member of its 17-person AI ethics team; that remaining person subsequently resigned.

These cuts occurred against a backdrop of accelerating AI deployment and intensifying public concern about algorithmic harm. The timing was not coincidental. As the Washington Post reported, “The slashing of teams tasked with trust and safety and AI ethics is a sign of how far companies are willing to go to meet Wall Street demands for efficiency.” When efficiency is defined in terms of quarterly returns rather than societal impact, ethics becomes a cost centre to be eliminated rather than a function to be strengthened.

The departure of Timnit Gebru from Google in December 2020 presaged this trend whilst also revealing its deeper dynamics. Gebru, the co-lead of Google's ethical AI team and a widely respected leader in AI ethics research, announced via Twitter that the company had forced her out after she co-authored a paper questioning the ethics of large language models. The paper suggested that, in their rush to build more powerful systems, companies including Google were not adequately considering the biases being built into them or the environmental costs of training increasingly large models.

As Gebru has subsequently observed: “What I've realised is that we can talk about the ethics and fairness of AI all we want, but if our institutions don't allow for this kind of work to take place, then it won't. At the end of the day, this needs to be about institutional and structural change.” Her observation cuts to the heart of the implementation gap. Principles without power are merely words. When those who raise concerns can be dismissed, when ethics teams can be eliminated, when whistleblowers lack protection, the governance frameworks that exist on paper cannot be translated into practice.

Algorithmic Systems and the Destruction of Vulnerable Lives

The human cost of this implementation gap is not theoretical. It has been documented in excruciating detail across multiple jurisdictions where algorithmic systems have been deployed against society's most vulnerable members.

The Dutch childcare benefits scandal stands as perhaps the most devastating example. Between 2005 and 2019, approximately 26,000 parents were wrongfully accused of making fraudulent benefit claims. A “self-learning” algorithm classified benefit claims by risk level, and officials then scrutinised the claims receiving the highest risk labels. As subsequent investigation revealed, claims by parents with dual citizenship were systematically identified as high-risk. Families from ethnic minority backgrounds were 22 times more likely to be investigated than native Dutch citizens. The Dutch state has formally acknowledged that “institutional racism” was part of the problem.

The consequences for affected families were catastrophic. Parents were forced to repay tens of thousands of euros in benefits they never owed. Many lost their homes, their savings, and their marriages. At least 3,532 children were taken from their families and forced into foster care. There were suicides. On 15 January 2021, Prime Minister Mark Rutte announced the resignation of his government, accepting responsibility for what he described as a fundamental failure of the rule of law. “The rule of law must protect its citizens from an all-powerful government,” Rutte told reporters, “and here that's gone terribly wrong.”

This was not an isolated failure. In Australia, a system called Robodebt accused 400,000 welfare recipients of misreporting their income, generating automated debt notices based on flawed calculations. By 2019, a court ruled the programme unlawful, and the government was forced to repay 1.2 billion Australian dollars. Analysis of the system found that it was “especially harmful for populations with a volatile income and numerous previous employers.” When technological limitations were coupled with reduced human agency, the conditions for a destructive system were established.

These cases share common characteristics: algorithmic systems deployed against people with limited power to contest decisions, opacity that prevented individuals from understanding why they had been flagged, and institutional cultures that prioritised efficiency over accuracy. As Human Rights Watch has observed, “some of the algorithms that attract the least attention are capable of inflicting the most harm, for example, algorithms that are woven into the fabric of government services and dictate whether people can afford food, housing, and health care.”

The pattern extends beyond welfare systems. In Denmark, data-driven fraud control algorithms risk discriminating against low-income groups, racialised groups, migrants, refugees, ethnic minorities, people with disabilities, and older people. By flagging “unusual” living situations such as multi-occupancy, intergenerational households, and “foreign affiliations” as indicators of higher risk of benefit fraud, the government has employed what critics describe as social scoring, a practice that would be prohibited under the EU's AI Act once its provisions on banned practices take full effect.

Opacity, Remedies, and the Failure of Enforcement

Understanding why governance frameworks fail to prevent such harms requires examining the structural barriers to accountability. AI systems are frequently described as “black boxes,” their decision-making processes obscure even to those who deploy them. The European Network of National Human Rights Institutions has identified this opacity as a fundamental challenge: “The decisions made by machine learning or deep learning processes can be impossible for humans to trace and therefore to audit or explain. The obscurity of AI systems can preclude individuals from recognising if and why their rights were violated and therefore from seeking redress.”

This technical opacity is compounded by legal and institutional barriers. Even when individuals suspect they have been harmed by an algorithmic decision, the pathways to remedy remain unclear. The EU AI Act does not specify applicable deadlines for authorities to act, limitation periods, the right of complainants to be heard, or access to investigation files. These procedural elements are largely left to national law, which varies significantly among member states. The absence of a “one-stop shop” mechanism means operators will have to deal with multiple authorities in different jurisdictions, creating administrative complexity that benefits well-resourced corporations whilst disadvantaging individual complainants.

The enforcement mechanisms that do exist face their own challenges. The EU AI Act grants the AI Office exclusive jurisdiction to enforce provisions relating to general-purpose AI models, but that same office is tasked with developing Union expertise and capabilities in AI. This dual role, one analysis noted, “may pose challenges for the impartiality of the AI Office, as well as for the trust and cooperation of operators.” When the regulator is also charged with promoting the technology it regulates, the potential for conflict of interest is structural rather than incidental.

Penalties for non-compliance exist on paper but remain largely untested. The EU AI Act provides for fines of up to 35 million euros or 7 per cent of worldwide annual turnover for the most serious violations. Whether these penalties will be imposed, and whether they will prove sufficient to deter well-capitalised technology companies, remains to be seen. A 2024 Gartner survey found that whilst 80 per cent of large organisations claim to have AI governance initiatives, fewer than half can demonstrate measurable maturity. Most lack a structured way to connect policies with practice. The result is a widening “governance gap” where technology advances faster than accountability frameworks.

Exclusion and the Voices Left Out of Governance

The fragmentation of AI governance carries particular implications for the Global South. Fewer than a third of developing countries have national AI strategies, and 118 mostly developing nations remain absent from global AI governance discussions. The OECD's 38 member states comprise solely high-income countries and do not provide a forum for negotiation with low and middle-income countries. UNESCO is more inclusive with its 193 signatories, but inclusion in a recommendation does not translate into influence over how AI systems are actually developed and deployed.

The digital infrastructure necessary to participate meaningfully in the AI economy is itself unevenly distributed. Africa holds less than 1 per cent of global data capacity and would need 2.6 trillion dollars in investment by 2030 to bridge the infrastructure gap. AI is energy-intensive; training a frontier-scale model can consume thousands of megawatt-hours, a burden that fragile power grids in many developing countries cannot support. Developing countries account for less than 10 per cent of global AI patents as of 2024, outside of China.

This exclusion matters because governance frameworks are being written primarily in Washington, Brussels, and Beijing. Priorities get set without participation from those who will implement and use these tools. Conversations about which AI applications matter, whether crop disease detection or automated trading systems, climate early warning or content moderation, happen without Global South governments at the table. As one analysis from Brookings observed, “If global AI governance continues to predominantly exclude the Global South, then economic and developmental disparities between upper-income and lower-income countries will worsen.”

Some initiatives have attempted to address this imbalance. The Partnership for Global Inclusivity on AI, led by the United States and eight prominent AI companies, has committed more than 100 million dollars to enhancing AI capabilities in developing countries. Ghana's ten-year National AI Strategy aims to achieve significant AI penetration in key sectors. The Global Digital Compact, adopted in September 2024, recognises digital connectivity as foundational to development. But these efforts operate against a structural reality in which the companies developing the most powerful AI systems are concentrated in a handful of wealthy nations, and the governance frameworks shaping their deployment are crafted primarily by and for those same nations.

Ethics as Performance, Compliance as Theatre

Perhaps the most troubling aspect of the current governance landscape is the extent to which the proliferation of principles has itself become a form of compliance theatre. When every major technology company has a responsible AI policy, when every government has signed onto at least one international AI ethics framework, when every industry association can point to voluntary commitments, the appearance of accountability can substitute for its substance.

The Securities and Exchange Commission in the United States has begun pursuing charges against companies for “AI washing,” a term describing the practice of overstating AI capabilities and credentials. In autumn 2024, the SEC announced Operation AI Comply, an enforcement sweep targeting companies that allegedly misused “AI hype” to defraud consumers. The SEC flagged AI washing as a top examination priority for 2025. But this enforcement action addresses only the most egregious cases of misrepresentation. It does not reach the more subtle ways in which companies can appear to embrace ethical AI whilst resisting meaningful accountability.

The concept of “ethics washing” has gained increasing recognition as a descriptor for insincere corporate initiatives. As Carnegie Council President Joel Rosenthal has stated: “Ethics washing is a reality in the performative environment in which we live, whether by corporations, politicians, or universities.” In the AI context, ethics washing occurs when companies overstate their capabilities in responsible AI, creating an uneven playing field where genuine efforts are discouraged or overshadowed by exaggerated claims.

This performative dimension helps explain why the proliferation of principles has not translated into proportionate protections. When signing onto an ethical framework carries no enforcement risk, when voluntary commitments can be abandoned when they become inconvenient, when internal ethics teams can be disbanded without consequence, principles function as reputation management rather than genuine constraint. The multiplicity of frameworks may actually facilitate this dynamic by allowing organisations to select the frameworks most amenable to their existing practices whilst claiming compliance with international standards.

Competition, Institutions, and the Barriers to Progress

Scholars of AI governance have identified fundamental barriers that explain why progress remains so difficult. First-order cooperation problems stem from interstate competition; nations view AI as strategically important and are reluctant to accept constraints that might disadvantage their domestic industries. Second-order cooperation problems arise from dysfunctional international institutions that lack the authority or resources to enforce meaningful standards. The weak regime complex that characterises global AI governance has some linkages between institutions, but work is generally siloed and coordination insufficient.

The timelines for implementing governance frameworks compound these challenges. The EU AI Act will not be fully applicable until August 2026, with some provisions delayed until August 2027. As one expert observed, “two years is just about the minimum an organisation needs to prepare for the AI Act, and many will struggle to achieve this.” During these transition periods, AI technology continues to advance. The systems that will be regulated in 2027 may look quite different from those contemplated when the regulations were drafted.

The emergence of agentic AI systems, capable of autonomous decision-making, introduces new risks that existing frameworks were not designed to address. These systems operate with less human oversight, make decisions in ways that may be difficult to predict or explain, and create accountability gaps when things go wrong. The governance frameworks developed for earlier generations of AI may prove inadequate for technologies that evolve faster than regulatory capacity.

Independent Voices and the Fight for Accountability

Despite these structural barriers, individuals and organisations continue to push for meaningful accountability. Joy Buolamwini, who founded the Algorithmic Justice League in 2016, has demonstrated through rigorous research how facial recognition systems fail people of colour. Her “Gender Shades” project at MIT showed that commercial facial recognition systems had error rates of less than 1 per cent for lighter-skinned males but as high as 35 per cent for darker-skinned females. Her work prompted IBM and Microsoft to take corrective actions, and by 2020, every U.S.-based company her team had audited had stopped selling facial recognition technology to law enforcement. In 2019, she testified before the United States House Committee on Oversight and Reform about the risks of facial recognition technology.

Safiya Umoja Noble, a professor at UCLA and 2021 MacArthur Foundation Fellow, has documented in her book “Algorithms of Oppression” how search engines reinforce racism and sexism. Her work has established that data discrimination is a real social problem, demonstrating how the combination of private interests in promoting certain sites, along with the monopoly status of a relatively small number of internet search engines, leads to biased algorithms that privilege whiteness and discriminate against people of colour. She is co-founder of the UCLA Center for Critical Internet Inquiry and received the inaugural NAACP-Archewell Digital Civil Rights Award in 2022.

The AI Now Institute, co-led by Amba Kak, continues to advance policy recommendations addressing concerns with artificial intelligence and concentrated power. In remarks before the UN General Assembly in September 2025, Kak emphasised that “the current scale-at-all-costs trajectory of AI is functioning to further concentrate power within a handful of technology giants” and that “this ultra-concentrated power over AI is increasingly a threat to nations' strategic independence, and to democracy itself.”

These researchers and advocates operate largely outside the corporate structures that dominate AI development. Their independence allows them to raise uncomfortable questions that internal ethics teams might be discouraged from pursuing. But their influence remains constrained by the resource imbalance between civil society organisations and the technology industry.

What Real Accountability Would Require

If the current trajectory of AI governance is insufficient, what might genuine accountability look like? The evidence suggests several necessary conditions.

First, enforcement mechanisms must have real teeth. Penalties that represent a meaningful fraction of corporate revenues, not just headline-grabbing numbers that are rarely imposed, would change the calculus for companies weighing compliance costs against potential fines. The EU AI Act's provisions for fines up to 7 per cent of worldwide turnover represent a step in this direction, but their effectiveness will depend on whether authorities are willing to impose them.

Second, those affected by algorithmic decisions need clear pathways to challenge them. This requires both procedural harmonisation across jurisdictions and resources to support individuals navigating complex regulatory systems. The absence of a one-stop shop in the EU creates barriers that sophisticated corporations can manage but individual complainants cannot.

Third, the voices of those most vulnerable to algorithmic harm must be centred in governance discussions. This means not just including Global South countries in international forums but ensuring that communities affected by welfare algorithms, hiring systems, and predictive policing tools have meaningful input into how those systems are governed.

Fourth, transparency must extend beyond disclosure to comprehensibility. Requiring companies to explain their AI systems is meaningful only if those explanations can be understood by regulators, affected individuals, and the public. The technical complexity of AI systems cannot become a shield against accountability.

Fifth, the concentration of power in AI development must be addressed directly. When a handful of companies control the most advanced AI capabilities, governance frameworks that treat all developers equivalently will fail to address the structural dynamics that generate harm. Antitrust enforcement, public investment in alternatives, and requirements for interoperability could all contribute to a more distributed AI ecosystem.

The Distance Between Rhetoric and Reality

The gap between AI governance principles and their practical implementation is not merely a technical or bureaucratic problem. It reflects deeper questions about who holds power in the digital age and whether democratic societies can exercise meaningful control over technologies that increasingly shape life chances.

The families destroyed by the Dutch childcare benefits scandal were not failed by a lack of principles. The Netherlands was a signatory to human rights conventions, a member of the European Union, a participant in international AI ethics initiatives. What failed them was the translation of those principles into systems that actually protected their rights. The algorithm that flagged them did not consult the UNESCO Recommendation on the Ethics of Artificial Intelligence before classifying their claims as suspicious.

As AI systems become more capable and more pervasive, the stakes of this implementation gap will only increase. Agentic AI systems making autonomous decisions, large language models reshaping information access, algorithmic systems determining who gets housing, employment, healthcare, and welfare, all of these applications amplify both the potential benefits and the potential harms of artificial intelligence. Governance frameworks that exist only on paper will not protect people from systems that operate in the real world.

The proliferation of principles may be necessary, but it is manifestly not sufficient. What is needed is the political will to enforce meaningful accountability, the structural changes that would give affected communities genuine power, and the recognition that governance is not a technical problem to be solved but an ongoing political struggle over who benefits from technological change and who bears its costs.

The researchers who first documented algorithmic bias, the advocates who pushed for stronger regulations, the journalists who exposed scandals like Robodebt and the Dutch benefits affair, all of them understood something that the architects of governance frameworks sometimes miss: accountability is not a principle to be declared. It is a practice to be enforced, contested, and continuously renewed. Until that practice matches the rhetoric, the mirage of AI governance will continue to shimmer on the horizon, always promised, never quite arrived.

---

References and Sources

1. UNESCO. “193 countries adopt first-ever global agreement on the Ethics of Artificial Intelligence.” UN News, November 2021. https://news.un.org/en/story/2021/11/1106612

2. European Commission. “AI Act enters into force.” 1 August 2024. https://commission.europa.eu/news-and-media/news/ai-act-enters-force-2024-08-01_en

3. OECD. “OECD updates AI Principles to stay abreast of rapid technological developments.” May 2024. https://www.oecd.org/en/about/news/press-releases/2024/05/oecd-updates-ai-principles-to-stay-abreast-of-rapid-technological-developments.html

4. European Digital Strategy. “Governance and enforcement of the AI Act.” https://digital-strategy.ec.europa.eu/en/policies/ai-act-governance-and-enforcement

5. MIT Sloan Management Review. “Organizations Face Challenges in Timely Compliance With the EU AI Act.” https://sloanreview.mit.edu/article/organizations-face-challenges-in-timely-compliance-with-the-eu-ai-act/

6. Corporate Europe Observatory. “Don't let corporate lobbying further water down the AI Act.” March 2024. https://corporateeurope.org/en/2024/03/dont-let-corporate-lobbying-further-water-down-ai-act-lobby-watchdogs-warn-meps

7. Euronews. “Big Tech spending on Brussels lobbying hits record high.” October 2025. https://www.euronews.com/next/2025/10/29/big-tech-spending-on-brussels-lobbying-hits-record-high-report-claims

8. Washington Post. “Tech companies are axing 'ethical AI' teams just as the tech explodes.” March 2023. https://www.washingtonpost.com/technology/2023/03/30/tech-companies-cut-ai-ethics/

9. Stanford HAI. “Timnit Gebru: Ethical AI Requires Institutional and Structural Change.” https://hai.stanford.edu/news/timnit-gebru-ethical-ai-requires-institutional-and-structural-change

10. Wikipedia. “Dutch childcare benefits scandal.” https://en.wikipedia.org/wiki/Dutch_childcare_benefits_scandal

11. Human Rights Watch. “The Algorithms Too Few People Are Talking About.” January 2024. https://www.hrw.org/news/2024/01/05/algorithms-too-few-people-are-talking-about

12. MIT News. “Study finds gender and skin-type bias in commercial artificial-intelligence systems.” February 2018. https://news.mit.edu/2018/study-finds-gender-skin-type-bias-artificial-intelligence-systems-0212

13. NYU Press. “Algorithms of Oppression” by Safiya Umoja Noble. https://nyupress.org/9781479837243/algorithms-of-oppression/

14. AI Now Institute. “AI Now Co-ED Amba Kak Gives Remarks Before the UN General Assembly on AI Governance.” September 2025. https://ainowinstitute.org/news/announcement/ai-now-co-ed-amba-kak-gives-remarks-before-the-un-general-assembly-on-ai-governance

15. CSIS. “From Divide to Delivery: How AI Can Serve the Global South.” https://www.csis.org/analysis/divide-delivery-how-ai-can-serve-global-south

16. Brookings. “AI in the Global South: Opportunities and challenges towards more inclusive governance.” https://www.brookings.edu/articles/ai-in-the-global-south-opportunities-and-challenges-towards-more-inclusive-governance/

17. Carnegie Council. “Ethics washing.” https://carnegiecouncil.org/explore-engage/key-terms/ethics-washing

18. Oxford Academic. “Global AI governance: barriers and pathways forward.” International Affairs. https://academic.oup.com/ia/article/100/3/1275/7641064

19. IAPP. “AI Governance in Practice Report 2024.” https://iapp.org/resources/article/ai-governance-in-practice-report

20. ENNHRI. “Key human rights challenges of AI.” https://ennhri.org/ai-resource/key-human-rights-challenges/

21. ProMarket. “The Politics of Fragmentation and Capture in AI Regulation.” July 2025. https://www.promarket.org/2025/07/07/the-politics-of-fragmentation-and-capture-in-ai-regulation/

22. UNCTAD. “AI's $4.8 trillion future: UN Trade and Development alerts on divides, urges action.” https://unctad.org/news/ais-48-trillion-future-un-trade-and-development-alerts-divides-urges-action

23. ScienceDirect. “Agile and iterative governance: China's regulatory response to AI.” https://www.sciencedirect.com/science/article/abs/pii/S2212473X25000562

24. Duke University Sanford School of Public Policy. “Dr. Joy Buolamwini on Algorithmic Bias and AI Justice.” https://sanford.duke.edu/story/dr-joy-buolamwini-algorithmic-bias-and-ai-justice/

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

Something peculiar happened when software development teams started delegating code generation to AI assistants. The traditional burden of implementation, that painstaking process of translating designs into working software, began shifting elsewhere. But it did not disappear. Instead, it transformed into something altogether different: an intensified requirement for architectural rigour that many teams were unprepared to provide.

In early 2025, a randomised controlled trial conducted by METR examined how AI tools affect the productivity of experienced open-source developers. Sixteen developers with moderate AI experience completed 246 tasks in mature projects on which they had an average of five years of prior experience. Each task was randomly assigned to allow or disallow usage of early 2025 AI tools. The finding shocked the industry: developers using AI tools took 19% longer to complete tasks than those working without them. Before starting, developers had forecast that AI would reduce their completion time by 24%. Even after finishing the study, participants still believed AI had made them faster, despite the data proving otherwise.

This perception gap reveals something fundamental about the current state of AI-assisted development. The tools are genuinely powerful, but their power comes with hidden costs that manifest as architectural drift, context exhaustion, and what practitioners have come to call the “zig-zag problem”: the iterative back-and-forth that emerges when teams dive into implementation without sufficient upfront specification.

The Great Delegation

The scale of AI adoption in software development has been nothing short of revolutionary. By March 2025, Y Combinator reported that 25% of startups in its Winter 2025 batch had codebases that were 95% AI-generated. These were not weekend projects built by hobbyists. These were venture-backed companies building production systems, with the cohort growing 10% per week in aggregate, making it the fastest-growing batch in YC history.

As CEO Garry Tan explained, the implications were profound: teams no longer needed fifty or a hundred engineers. They did not have to raise as much capital. The money went further. Companies like Red Barn Robotics developed AI-driven agricultural robots securing millions in contracts. Deepnight built military-grade night vision software for the US Army. Delve launched with over 100 customers and a multi-million pound run rate, all with remarkably lean teams.

Jared Friedman, YC's managing partner, emphasised a crucial point about these companies: “It's not like we funded a bunch of non-technical founders. Every one of these people is highly technical, completely capable of building their own products from scratch. A year ago, they would have built their product from scratch, but now 95% of it is built by an AI.”

Yet beneath these success stories lurked a more complicated reality. Pete Hodgson, writing about AI coding assistants in May 2025, captured the core problem with devastating clarity: “The state of the art with coding agents in 2025 is that every time you start a new chat session, your agent is reset to the same knowledge as a brand new hire, one who has carefully read through all the onboarding material and is good at searching through the codebase for context.”

This “brand new hire” phenomenon explains why architectural planning has become so critical. Traditional developers build mental models of codebases over months and years. They internalise team conventions, understand why certain patterns exist, and recognise the historical context behind architectural decisions. AI assistants possess none of this institutional memory. They approach each session with technical competence but zero contextual awareness.

The burden that has shifted is not the mechanical act of writing code. It is the responsibility for ensuring that generated code fits coherently within existing systems, adheres to established patterns, and serves long-term maintainability rather than short-term convenience.

Context Windows and the Memory Problem

To understand why architectural planning matters more with AI assistants, you must first understand how these systems process information. Every AI model operates within what engineers call a context window: the total amount of text it can consider simultaneously. By late 2025, leading models routinely supported 200,000 tokens or more, with some reaching one million tokens. Google's Gemini models offered input windows of over a million tokens, enough to analyse entire books or multi-file repositories in a single session.

But raw capacity tells only part of the story. Timothy Biondollo, writing about the fundamental limitations of AI coding assistants, articulated what he calls the Principle of Compounding Contextual Error: “If an AI interaction does not resolve the problem quickly, the likelihood of successful resolution drops with each additional interaction.”

The mechanics are straightforward but devastating. As you pile on error messages, stack traces, and correction prompts, you fill the context window with what amounts to garbage data. The model is reading a history full of its own mistakes, which biases it toward repeating them. A long, winding debugging session is often counterproductive. Instead of fixing the bug, you are frequently better off resetting the context and starting fresh with a refined prompt.

This dynamic fundamentally changes how teams must approach complex development tasks. With human developers, extended debugging sessions can be productive because humans learn from their mistakes within a session. They build understanding incrementally. AI assistants do the opposite: their performance degrades as sessions extend because their context becomes polluted with failed attempts.

The practical implication is that teams cannot rely on AI assistants to self-correct through iteration. The tools lack the metacognitive capacity to recognise when they are heading down unproductive paths. They will cheerfully continue generating variations of flawed solutions until the context window fills with a history of failures, at which point the quality of suggestions deteriorates further.

Predictions from industry analysts suggest that one million or more tokens will become standard for flagship models in 2025 and 2026, with ten million token contexts emerging in specialised models by 2027. True “infinite context” solutions may arrive in production by 2028. Yet even with these expansions, the fundamental challenge remains: more tokens do not eliminate the problem of context pollution. They merely delay its onset.

The Specification Renaissance

This context limitation has driven a renaissance in software specification practices. What the industry has come to call spec-driven development represents one of 2025's most significant methodological shifts, though it lacks the visibility of trendier terms like vibe coding.

Thoughtworks describes spec-driven development as a paradigm that uses well-crafted software requirement specifications as prompts for AI coding agents to generate executable code. The approach explicitly separates requirements analysis from implementation, formalising requirements into structured documents before any code generation begins.

GitHub released Spec Kit, an open-source toolkit that provides templates and workflows for this approach. The framework structures development through four distinct phases: Specify, Plan, Tasks, and Implement. Each phase produces specific artifacts that carry forward to subsequent stages.

In the Specify phase, developers capture user journeys and desired outcomes. As the Spec Kit documentation emphasises, this is not about technical stacks or application design. It focuses on experiences and what success looks like: who will use the system, what problem it solves, how users will interact with it, and what outcomes matter. This specification becomes a living artifact that evolves as teams learn more about users and their needs.

The Plan phase gets technical. Developers encode their desired stack, architecture, and constraints. If an organisation standardises on certain technologies, this is where those requirements become explicit. The plan captures compliance requirements, performance targets, and security policies that will guide implementation.

The Tasks phase breaks specifications into focused, reviewable work units. Each task solves a specific piece of the puzzle and enables isolated testing and validation. Rather than asking an AI to generate an entire feature, developers decompose work into atomic units that can be independently verified.

Only in the Implement phase do AI agents begin generating code, now guided by clear specifications and plans rather than vague prompts. The approach transforms fuzzy intent into unambiguous instructions that language models can reliably execute.

Planning Artifacts That Actually Work

Not all specification documents prove equally effective at guiding AI assistants. Through extensive experimentation, the industry has converged on several artifact types that demonstrably reduce architectural drift.

The spec.md file has emerged as foundational. Addy Osmani, Chrome engineering lead at Google, recommends creating a comprehensive specification document containing requirements, architecture decisions, data models, and testing strategy. This document forms the basis for development, providing complete context before any code generation begins. Osmani describes the approach as doing “waterfall in fifteen minutes” through collaborative specification refinement with the AI before any code generation occurs.

Tasks.md serves a complementary function, breaking work into incremental, testable steps with validation criteria. Rather than jumping straight into code, this process establishes intent first. The AI assistant then uses these documents as context for generation, ensuring each piece of work connects coherently to the larger whole.

Plan.md captures the technical approach: a short overview of the goal, the main steps or phases required to achieve it, and any dependencies, risks, or considerations to keep in mind. This document bridges the gap between what the system should do and how it should be built.

Perhaps most critically, the CLAUDE.md file (or equivalent for other AI tools) has become what practitioners call the agent's constitution, its primary source of truth for how a specific repository works. HumanLayer, a company building tooling for AI development workflows, recommends keeping this file under sixty lines. The general consensus is that less than three hundred lines works best, with shorter being even better.

The rationale for brevity is counterintuitive but essential. Since CLAUDE.md content gets injected into every single session, bloated files consume precious context window space that should be reserved for task-specific information. The document should contain universally applicable information: core application features, technology stacks, and project notes that should never be forgotten. Anthropic's own guidance emphasises preferring pointers to copies: rather than including code snippets that will become outdated, include file and line references that point the assistant to authoritative context.

Architecture Decision Records in the AI Era

A particularly interesting development involves the application of Architecture Decision Records to AI-assisted development. Doug Todd has demonstrated transformative results using ADRs with Claude and Claude Code, showing how these documents provide exactly the kind of structured context that AI assistants need.

ADRs provide enough structure to ensure key points are addressed, but express that structure in natural language, which is perfect for large language model consumption. They capture not just what was decided, but why, recording the context, options considered, and reasoning behind architectural choices.

Chris Swan, writing about this approach, notes that ADRs might currently be an elite team practice, but they are becoming part of a boilerplate approach to working with AI coding assistants. This becomes increasingly important as teams shift to agent swarm approaches, where they are effectively managing teams of AI workers, exactly the sort of environment that ADRs were originally created for.

The transformation begins when teams stop thinking of ADRs as documentation and start treating them as executable specifications for both human and AI behaviour. Every ADR includes structured metadata and clear instructions that AI assistants can parse and apply immediately. Accepted decisions become mandatory requirements. Proposed decisions become considerations. Deprecated and superseded decisions trigger active avoidance patterns.

Dave Patten describes using AI agents to enforce architectural standards, noting that LLMs and autonomous agents are being embedded in modern pipelines to enforce architectural principles. The goal is not perfection but catching drift early before it becomes systemic.

ADR rot poses a continuing challenge. It does not happen overnight. At first, everything looks healthy: the repository is clean, decisions feel current, and engineers actually reference ADRs. Then reality sets in. Teams ship features, refactor services, migrate infrastructure, and retire old systems. If no one tends the ADR log, it quietly drifts out of sync with the system. Once that happens, engineers stop trusting it. The AI assistant, fed outdated context, produces code that reflects decisions the team has already moved past.

The Zig-Zag Problem

Without these planning artifacts, teams inevitably encounter what practitioners call the zig-zag problem: iterative back-and-forth that wastes cycles and produces inconsistent results. One developer who leaned heavily on AI generation for a rushed project described the outcome as “an inconsistent mess, duplicate logic, mismatched method names, no coherent architecture.” He realised he had been “building, building, building” without stepping back to see what the AI had woven together. The fix required painful refactoring.

The zig-zag emerges from a fundamental mismatch between how humans and AI assistants approach problem-solving. Human developers naturally maintain mental models that constrain their solutions. They remember what they tried before, understand why certain approaches failed, and build incrementally toward coherent systems.

AI assistants lack this continuity. Each response optimises for the immediate prompt without consideration of the larger trajectory. Ask for a feature and you will get a feature, but that feature may duplicate existing functionality, violate established patterns, or introduce dependencies that conflict with architectural principles.

Qodo's research on AI code quality found that about a third of developers verify AI code more quickly than writing it from scratch, whilst the remaining two-thirds require more time for verification. Roughly a fifth face heavy overruns of 50 to 100 percent or more, making verification the bottleneck. Approximately 11 percent of developers reported code verification taking much longer, with many code mismatches requiring deep rework.

The solution lies in constraining the problem space before engaging AI assistance. Hodgson identifies three key strategies: constrain the problem by being more directive in prompts and specifying exact approaches; provide missing context by expanding prompts with specific details about team conventions and technical choices; and enable tool-based context discovery through integrations that give AI access to schemas, documentation, and requirements.

Structuring Handoffs Between Planning and Implementation

The transition from planning to implementation represents a critical handoff that many teams execute poorly. GitHub's Spec Kit documentation emphasises that specifications should include everything a developer, or an AI agent, needs to know to start building: the problem, the approach, required components, validation criteria, and a checklist for handoff. By following a standard, the transition from planning to doing becomes clear and predictable.

This handoff structure differs fundamentally from traditional agile workflows. In conventional development, a user story might contain just enough information for a human developer to ask clarifying questions and fill in gaps through conversation. AI assistants cannot engage in this kind of collaborative refinement. They interpret prompts literally and generate solutions based on whatever context they possess.

The Thoughtworks analysis of spec-driven development emphasises that AI coding agents receive finalised specifications along with predefined constraints via rules files or agent configuration documents. The workflow emphasises context engineering: carefully curating information for agent-LLM interaction, including real-time documentation integration through protocols that give assistants access to external knowledge sources.

Critically, this approach does not represent a return to waterfall methodology. Spec-driven development creates shorter feedback cycles than traditional waterfall's excessively long ones. The specification phase might take minutes rather than weeks. The key difference is that it happens before implementation rather than alongside it.

Microsoft's approach to agentic AI explicitly addresses handoff friction. Their tools bridge the gap between design and development, eliminating time-consuming handoff processes. Designers iterate in their preferred tools whilst developers focus on business logic and functionality, with the agent handling implementation details. Teams now receive notifications that issues are detected, analysed, fixed, and documented, all without human intervention. The agent creates issues with complete details so teams can review what happened and consider longer-term solutions during regular working hours.

The practical workflow involves marking progress and requiring the AI agent to update task tracking documents with checkmarks or completion notes. This gives visibility into what is done and what remains. Reviews happen after each phase: before moving to the next set of tasks, teams review code changes, run tests, and confirm correctness.

The Self-Correction Illusion

Perhaps the most dangerous misconception about AI coding assistants is that they can self-correct through iteration. The METR study's finding that developers take 19% longer with AI tools, despite perceiving themselves as faster, points to a fundamental misunderstanding of how these tools operate.

The problem intensifies in extended sessions. When you see auto-compacting messages during a long coding session, quality drops. Responses become vaguer. What was once a capable coding partner becomes noticeably less effective. This degradation occurs because compaction loses information. The more compaction happens, the vaguer everything becomes. Long coding sessions feel like they degrade over time because you are literally watching the AI forget.

Instead of attempting marathon sessions where you expect the AI to learn and improve, effective workflows embrace a different approach: stop trying to do everything in one session. For projects spanning multiple sessions, implementing comprehensive logging and documentation serves as external memory. Documentation becomes the only bridge between sessions, requiring teams to write down everything needed to resume work effectively whilst minimising prose to conserve context window space.

Anthropic's September 2025 announcement of new context management capabilities represented a systematic approach to this problem. The introduction of context editing and memory tools enabled agents to complete workflows that would otherwise fail due to context exhaustion, whilst reducing token consumption by 84 percent in testing. In a 100-turn web search evaluation, context editing enabled agents to complete workflows that would otherwise fail due to context exhaustion.

The recommended practice involves dividing and conquering with sub-agents: modularising large objectives and delegating API research, security review, or feature planning to specialised sub-agents. Each sub-agent gets its own context window, preventing any single session from approaching limits. Telling the assistant to use sub-agents to verify details or investigate particular questions, especially early in a conversation or task, tends to preserve context availability without much downside in terms of lost efficiency.

Extended thinking modes also help. Anthropic recommends using specific phrases to trigger additional computation time: “think” triggers basic extended thinking, whilst “think hard,” “think harder,” and “ultrathink” map to increasing levels of thinking budget. These modes give the model additional time to evaluate alternatives more thoroughly, reducing the need for iterative correction.

Practical Limits of AI Self-Correction

Understanding the practical boundaries of AI self-correction helps teams design appropriate workflows. Several patterns consistently cause problems.

Open solution spaces present the first major limitation. When problems have multiple valid solutions, it is extremely unlikely that an AI will choose the right one without explicit guidance. The AI assistant makes design decisions at the level of a fairly junior engineer and lacks the experience to challenge requirements or suggest alternatives.

Implicit knowledge creates another barrier. The AI has no awareness of your team's conventions, preferred libraries, business context, or historical decisions. Every session starts fresh, requiring explicit provision of context that human team members carry implicitly. Anthropic's own research emphasises that Claude is already smart enough. Intelligence is not the bottleneck; context is. Every organisation has its own workflows, standards, and knowledge systems, and the assistant does not inherently know any of these.

Compound errors represent a third limitation. Once an AI starts down a wrong path, subsequent suggestions build on that flawed foundation. Without human intervention to recognise and redirect, entire implementation approaches can go astray.

The solution is not more iteration but better specification. Teams seeing meaningful results treat context as an engineering surface, determining what should be visible to the agent, when, and in what form. More information is not always better. AI can be more effective when further abstracted from the underlying system because the solution space becomes wider, allowing better leverage of generative and creative capabilities.

The Rules File Ecosystem

The tooling ecosystem has evolved to support these context management requirements. Cursor, one of the most popular AI coding environments, has developed an elaborate rules system. Large language models do not retain memory between completions, so rules provide persistent, reusable context at the prompt level. When applied, rule contents are included at the start of the model context, giving the AI consistent guidance for generating code.

The system distinguishes between project rules, stored in the .cursor/rules directory and version-controlled with the codebase, and global rules that apply across all projects. Project rules encode domain-specific knowledge, standardise patterns, and automate project workflows. They can be scoped using path patterns, invoked manually, or included based on relevance.

The legacy .cursorrules file has been deprecated in favour of individual .mdc files inside the .cursor/rules/ directory. This change provides better organisation, easier updates, and more focused rule management. Each rule lives in its own file with the .mdc (Markdown Components) extension, allowing for both metadata in frontmatter and rule content in the body.

The critical insight for 2025 is setting up what practitioners call the quartet: Model Context Protocol servers, rules files, memories, and auto-run configurations at the start of projects. This reduces token usage by only activating relevant rules when needed, giving the language model more mental space to focus on specific tasks rather than remembering irrelevant guidelines.

Skills represent another evolution: organised folders of instructions, scripts, and resources that AI assistants can dynamically discover and load. These function as professional knowledge packs that raise the quality and consistency of outputs across entire organisations.

Code Quality and the Verification Burden

The shift in architectural burden comes with significant implications for code quality. A landmark Veracode study in 2025 analysed over 100 large language models across 80 coding tasks and found that 45 percent of AI-generated code introduces security vulnerabilities. These were not minor bugs but critical flaws, including those in the OWASP Top 10.

In March 2025, a vibe-coded payment gateway approved over 1.5 million pounds in fraudulent transactions due to inadequate input validation. The AI had copied insecure patterns from its training data, creating a vulnerability that human developers would have caught during review.

Technical debt compounds the problem. Over 40 percent of junior developers admitted to deploying AI-generated code they did not fully understand. AI-generated code tends to include 2.4 times more abstraction layers than human developers would implement for equivalent tasks, leading to unnecessary complexity. Forrester forecast an incoming technical debt tsunami over the following two years due to advanced AI coding agents.

The verification burden has shifted substantially. Where implementation was once the bottleneck, review now consumes disproportionate resources. Code review times ballooned by approximately 91 percent in teams with high AI usage. The human approval loop became the chokepoint.

Teams with strong code review processes experience quality improvements when using AI tools, whilst those without see quality decline. This amplification effect makes thoughtful implementation essential. The solution involves treating AI-generated code as untrusted by default. Every piece of generated code should pass through the same quality gates as human-written code: automated testing, security scanning, code review, and architectural assessment.

The Team Structure Question

These dynamics have implications for how development teams should be structured. The concern that senior developers will spend their time training AI instead of training junior developers is real and significant. Some organisations report that senior developers became more adept at leveraging AI whilst spending less time mentoring, potentially creating future talent gaps.

Effective teams structure practices to preserve learning opportunities. Pair programming sessions include AI as a third participant rather than a replacement for human pairing. Code review processes use AI-generated code as teaching opportunities. Architectural discussions explicitly evaluate AI suggestions against alternatives.

Research on pair programming shows that two sets of eyes catch mistakes early, with studies finding pair-programmed code has up to 15 percent fewer defects. A meta-analysis found pairs typically consider more design alternatives than programmers working alone, arrive at simpler and more maintainable designs, and catch design defects earlier. Teams are adapting this practice: one developer interacts with the AI whilst another reviews the generated code and guides the conversation, creating three-way collaboration that preserves learning benefits.

The skill set required for effective AI collaboration differs from traditional development. Where implementation expertise once dominated, context engineering has become equally important. The most effective developers of 2025 are still those who write great code, but they increasingly augment that skill by mastering the art of providing persistent, high-quality context.

Surveying the Transformed Landscape

The architectural planning burden that has shifted to human developers represents a permanent change in how software gets built. AI assistants will continue improving, context windows will expand, and tooling will mature. But the fundamental requirement for clear specifications, structured context, and human oversight will remain.

Microsoft's chief product officer for AI, Aparna Chennapragada, sees 2026 as a new era for alliances between technology and people. If recent years were about AI answering questions and reasoning through problems, the next wave will be about true collaboration. The future is not about replacing humans but about amplifying them. GitHub's chief product officer, Mario Rodriguez, predicts repository intelligence: AI that understands not just lines of code but the relationships and history behind them.

By 2030, all IT work is forecast to involve AI, with CIOs predicting 75 percent will be human-AI collaboration and 25 percent fully autonomous AI tasks. A survey of over 700 CIOs indicates that by 2030, none of the IT workload will be performed solely by humans. Software engineering will be less about writing code and more about orchestrating intelligent systems. Engineers who adapt to these changes, embracing AI collaboration, focusing on design thinking, and staying curious about emerging technologies, will thrive.

The teams succeeding at this transition share common characteristics. They invest in planning artifacts before implementation begins. They maintain clear specifications that constrain AI behaviour. They structure reviews and handoffs deliberately. They recognise that AI assistants are powerful but require constant guidance.

The zig-zagging that emerges from insufficient upfront specification is not a bug in the AI but a feature of how these tools operate. They excel at generating solutions within well-defined problem spaces. They struggle when asked to infer constraints that have not been made explicit.

The architecture tax is real, and teams that refuse to pay it will find themselves trapped in cycles of generation and revision that consume more time than traditional development ever did. But teams that embrace the new planning requirements, that treat specification as engineering rather than documentation, will discover capabilities that fundamentally change what small groups of developers can accomplish.

The future of software development is not about choosing between human expertise and AI capability. It is about recognising that AI amplifies whatever approach teams bring to it. Disciplined teams with clear architectures get better results. Teams that rely on iteration and improvisation get the zig-zag.

The planning burden has shifted. The question is whether teams will rise to meet it.

---

References and Sources

1. METR, “Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity” (July 2025)
2. Y Combinator, reported in TechCrunch, “A Quarter of Startups in YC's Current Cohort Have Codebases That Are Almost Entirely AI-Generated” (March 2025)
3. Pete Hodgson, “Why Your AI Coding Assistant Keeps Doing It Wrong, and How To Fix It” (May 2025)
4. Thoughtworks, “Spec-driven development: Unpacking one of 2025's key new AI-assisted engineering practices” (2025)
5. GitHub Blog, “Spec-driven development with AI: Get started with a new open source toolkit” (2025)
6. Addy Osmani, “My LLM coding workflow going into 2026” (December 2025)
7. Timothy Biondollo, “How I Solved the Biggest Problem with AI Coding Assistants” (Medium, 2025)
8. HumanLayer Blog, “Writing a good CLAUDE.md” (2025)
9. Chris Swan's Weblog, “Using Architecture Decision Records (ADRs) with AI coding assistants” (July 2025)
10. Dave Patten, “Using AI Agents to Enforce Architectural Standards” (Medium, 2025)
11. Qodo, “State of AI code quality in 2025” (2025)
12. Veracode, AI Code Security Study (2025)
13. Anthropic, “Claude Code: Best practices for agentic coding” (2025)
14. Anthropic, “Effective context engineering for AI agents” (2025)
15. Cursor Documentation, “Rules for AI” (2025)
16. MIT Technology Review, “From vibe coding to context engineering: 2025 in software development” (November 2025)
17. Microsoft, “What's next in AI: 7 trends to watch in 2026” (2025)
18. IT Brief, “CIOs forecast all IT work will involve AI-human collaboration by 2030” (2025)
19. Stack Overflow, “2025 Developer Survey” (2025)
20. Red Hat Developer, “How spec-driven development improves AI coding quality” (October 2025)

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

Somewhere in a Fortune 500 company's engineering Slack, a product manager types a casual message: “@CodingBot can you add a quick feature to disable rate limiting for our VIP customers?” Within minutes, the AI agent has pushed a commit to the main branch, bypassing the security team entirely. Nobody reviewed the code. Nobody questioned whether this created a vulnerability. The change simply happened because someone with a blue “PM” badge next to their name asked politely in a chat window.

This scenario is no longer hypothetical. As organisations race to embed AI coding agents directly into collaboration platforms like Slack and Microsoft Teams, they are fundamentally redrawing the boundaries of who controls software development. According to the JetBrains State of Developer Ecosystem 2025 survey, which gathered responses from 24,534 developers between April and June 2025, 85 per cent of developers now regularly use AI tools for coding and development work. More striking still, 41 per cent of all code written in 2025 was AI-generated. The shift from isolated integrated development environments (IDEs) to shared conversational spaces represents perhaps the most significant transformation in how software gets built since the advent of version control.

The convenience is undeniable. GitHub Copilot's November 2025 update introduced Model Context Protocol (MCP) integration with OAuth support, enabling AI agents to authenticate securely with tools like Slack and Jira without hardcoded tokens. Developers can now issue commands to create pull requests, search repositories, and manage issues directly from chat interfaces. The friction between “I have an idea” and “the code exists” has collapsed to nearly zero.

But this collapse carries profound implications for power, security, and the intentionality that once protected software systems from hasty decisions. When anyone with access to a Slack channel can summon code into existence through natural language, the centuries-old gatekeeping function of technical expertise begins to erode. The question facing every technology organisation today is not whether to adopt these tools, but how to prevent convenience from becoming catastrophe.

The Shifting Tectonics of Software Power

For decades, the software development process enforced a natural hierarchy. Product managers could request features. Designers could propose interfaces. Executives could demand timelines. But ultimately, developers held the keys to the kingdom. Only they could translate abstract requirements into functioning code. This bottleneck, frustrating as it often proved, served as a crucial check on impulse and impatience.

That structural constraint is dissolving. As McKinsey's research indicates, AI tools are now automating time-consuming routine tasks such as project management, market analysis, performance testing, and documentation, freeing product managers, engineers, and designers to focus on higher-value work. The technology consultancy notes that teams are not looking to replace human judgment and decision-making with AI; instead, the goal is to use AI for what it does best, whilst relying on human insight for understanding complex human needs.

Yet the practical reality is messier. When a non-technical stakeholder can type a request into Slack and watch code materialise within seconds, the power dynamic shifts in subtle but significant ways. Research from MIT published in July 2025 found that developers feel they “don't really have much control over what the model writes.” Without a channel for AI to expose its own confidence, the researchers warn, “developers risk blindly trusting hallucinated logic that compiles, but collapses in production.”

This confidence gap becomes particularly dangerous when AI agents operate in shared spaces. In an IDE, a developer maintains clear responsibility for what they commit. In a chat environment, multiple stakeholders may issue requests, and the resulting code reflects a confused amalgamation of intentions. The MIT researchers call for “transparent tooling that lets models expose uncertainty and invite human steering rather than passive acceptance.”

The democratisation of code generation also threatens to flatten organisational learning curves in problematic ways. Bain and Company's 2025 technology report found that three of four companies report the hardest part of AI adoption is getting people to change how they work. Under pressure, developers often fall back on old habits, whilst some engineers distrust AI or worry that it will undermine their role. This tension creates an unstable environment where traditional expertise is simultaneously devalued and desperately needed.

The implications extend beyond individual teams. As AI tools become the primary interface for requesting software changes, the vocabulary of software development shifts from technical precision to conversational approximation. Product managers who once needed to craft detailed specifications can now describe what they want in plain English. The question of whether this represents democratisation or degradation depends entirely on the governance structures surrounding these new capabilities.

Who Gets to Summon the Machine?

The question of who can invoke AI coding agents has become one of the most contentious governance challenges facing technology organisations. In traditional development workflows, access to production systems required specific credentials, code reviews, and approval chains. The move to chat-based development threatens to bypass all of these safeguards with a simple “@mention.”

Slack's own documentation for its agent-ready APIs, released in October 2025, emphasises that permission inheritance ensures AI applications respect the same access controls as human users. IT leaders have specific concerns, the company acknowledges, as many organisations only discover extensive over-permissioning when they are ready to deploy AI systems. This revelation typically comes too late, after permissions have already propagated through interconnected systems.

The architectural challenge is that traditional role-based access control (RBAC) was designed for human users operating at human speeds. As WorkOS explains in its documentation on AI agent access control, AI agents powered by large language models “generate actions dynamically based on natural language inputs and infer intent from ambiguous context, which makes their behaviour more flexible, and unpredictable.” Without a robust authorisation model to enforce permissions, the consequences can be severe.

Cerbos, a provider of access control solutions, notes that many current AI agent frameworks still assume broad system access. By default, an AI support agent might see the entire ticketing database instead of only the subset relevant to the current user. When that agent can also write code, the exposure multiplies exponentially.

The most sophisticated organisations are implementing what the Cloud Security Alliance describes as “Zero Trust 2.0” specifically designed for AI systems. This framework uses artificial intelligence integrated with machine learning to establish trust in real-time through behavioural and network activity observation. A Policy Decision Point sits at the centre of this architecture, watching everything in real-time, evaluating context, permissions, and behaviour, and deciding whether that agentic AI can execute this action on that system under these conditions.

This represents a fundamental shift from the traditional model of granting permissions once and trusting them indefinitely. As the Cloud Security Alliance warns, traditional zero trust relied heavily on perimeter controls and static policies because the entities it governed (human users) operated within predictable patterns and at human speed. AI agents shatter these assumptions entirely.

Beyond RBAC, organisations are exploring attribute-based access control (ABAC) and relationship-based access control (ReBAC) for managing AI agent permissions. ABAC adds context such as user tier, branch, time of day, and tenant ID. However, as security researchers note, modern LLM stacks often rely on ephemeral containers or serverless functions where ambient context vanishes with each invocation. Persisting trustworthy attributes across the chain demands extra engineering that many proof-of-concept projects skip. ReBAC models complex resource graphs elegantly, but when agents make dozens of micro-tool calls per prompt, those lookups must complete in tens of milliseconds or users will notice lag.

The Security Surface Expands

Moving coding workflows from isolated IDEs into shared chat environments multiplies the surface area for security exposure in ways that many organisations have failed to anticipate. The attack vectors include token leakage, unaudited repository access, prompt injection, and the fundamental loss of control over when and how code is generated.

Dark Reading's January 2026 analysis of security pitfalls in AI coding adoption highlights the severity of this shift. Even as developers start to use AI agents to build applications and integrate AI services into the development and production pipeline, the quality of the code, especially the security of the code, varies significantly. Research from CodeRabbit found that whilst developers may be moving quicker and improving productivity with AI, these benefits are offset by the fact they are spending time fixing flawed code or tackling security issues.

The statistics are sobering. According to Checkmarx's 2025 global survey, nearly 70 per cent of respondents estimated that more than 40 per cent of their organisation's code was AI-generated in 2024, with 44.4 per cent of respondents estimating 41 to 60 per cent of their code is AI-generated. IBM's 2025 Cost of a Data Breach Report reveals that 13 per cent of organisations reported breaches of AI models or applications, with 97 per cent lacking proper AI access controls. Shadow AI breaches cost an average of $670,000 more than traditional incidents and affected one in five organisations in 2025. With average breach costs exceeding $5.2 million and regulatory penalties reaching eight figures, the business case for robust security controls is compelling.

The specific risks of chat-based development deserve careful enumeration. First, prompt injection attacks have emerged as perhaps the most insidious threat. As Dark Reading explains, data passed to a large language model from a third-party source could contain text that the LLM will execute as a prompt. This indirect prompt injection is a major problem in the age of AI agents where LLMs are linked with third-party tools to access data or perform tasks. Researchers have demonstrated prompt injection attacks in AI coding assistants including GitLab Duo, GitHub Copilot Chat, and AI agent platforms like ChatGPT. Prompt injection now ranks as LLM01 in the OWASP Top 10 for LLM Applications, underscoring its severity.

Second, token and credential exposure creates systemic vulnerabilities. TechTarget's analysis of AI code security risks notes that to get useful suggestions, developers might prompt these tools with proprietary code or confidential logic. That input could be stored or later used in model training, potentially leaking secrets. Developers increasingly paste sensitive code or data into public tools, which may use that input for future model training. This phenomenon, referred to as IP leakage and shadow AI, represents a category of risk that barely existed five years ago. Security concerns include API keys, passwords, and tokens appearing in AI-suggested code, along with insecure code patterns like SQL injection, command injection, and path traversal.

Third, the speed of chat-based code generation outpaces human review capacity. Qodo's 2026 analysis of enterprise code review tools observes that AI-assisted development now accounts for nearly 40 per cent of all committed code, and global pull request activity has surged. Leaders frequently report that review capacity, not developer output, is the limiting factor in delivery. When code can be generated faster than it can be reviewed, the natural safeguard of careful human inspection begins to fail.

Chris Wysopal of Veracode, quoted in Dark Reading's analysis, offers stark guidance: “Developers need to treat AI-generated code as potentially vulnerable and follow a security testing and review process as they would for any human-generated code.” The problem is that chat-based development makes this discipline harder to maintain, not easier.

Building Governance for the Conversational Era

The governance frameworks required for AI coding agents in chat environments must operate at multiple levels simultaneously. They must define who can invoke agents, what those agents can access, how their outputs are reviewed, and what audit trails must be maintained. According to Deloitte's 2025 analysis, only 9 per cent of enterprises have reached what they call a “Ready” level of AI governance maturity. That is not because 91 per cent of companies are lazy, but because they are trying to govern something that moves faster than their governance processes.

The Augment Code framework for enterprise AI code governance identifies several essential components. Usage policies must clearly define which AI tools are permitted and for what capacity, specify acceptable use cases (distinguishing between prototyping and production code), ensure that AI-generated code is clearly identifiable, and limit use of AI-generated code in sensitive or critical components such as authentication modules or financial systems.

A clear policy should define approved use cases. For example, organisations might allow AI assistants to generate boilerplate code, documentation, or test scaffolding, but disallow use in implementing core cryptography, authentication flows, or handling credentials. Governance controls should specify which AI tools are permitted and for what capacity, define acceptable use cases, ensure that AI-generated code is clearly identifiable, and limit use of AI-generated code in sensitive or critical components.

Automated enforcement becomes crucial when human review cannot keep pace. DX's enterprise adoption guidelines recommend configurable rulesets that allow organisations to encode rules for style, patterns, frameworks, security, and compliance. Review agents check each diff in the IDE and pull request against these rules, flagging or blocking non-compliant changes. Standards can be managed centrally and applied across teams and repositories.

The most successful engineering organisations in 2025, according to Qodo's analysis, shifted routine review load off senior engineers by automatically approving small, low-risk, well-scoped changes, whilst routing schema updates, cross-service changes, authentication logic, and contract modifications to humans. AI review must categorise pull requests by risk, flag unrelated changes bundled in the same request, and selectively automate approvals under clearly defined conditions.

This tiered approach preserves human ownership of critical decisions whilst enabling AI acceleration of routine work. As the Qodo analysis notes, a well-governed AI code review system preserves human ownership of the merge button whilst raising the baseline quality of every pull request, reduces back-and-forth, and ensures reviewers only engage with work that genuinely requires their experience.

Regulatory pressure is accelerating the formalisation of these practices. The European Data Protection Board's 2025 guidance provides criteria for identifying privacy risks, classifying data, and evaluating consequences. It emphasises controlling inputs to LLM systems to avoid exposing personal information, trade secrets, or intellectual property. The NIST framework, SOC2 certifications, and ISO/IEC 42001 compliance all have their place in enterprise AI governance. Regulations like HIPAA, PCI DSS, and GDPR are forcing organisations to take AI security seriously, with logging, audit trails, and principle of least privilege becoming not just best practices but legal requirements.

Architectural Patterns for Auditability

The technical architecture of AI coding agents in chat environments must be designed from the ground up with auditability in mind. This is not merely a compliance requirement; it is a precondition for maintaining engineering integrity in an era of automated code generation.

The concept of provenance bills of materials (PBOMs) is gaining traction as a way to track AI-generated code from commit to deployment. As Substack's Software Analyst newsletter explains, standards for AI-BOM tracking are forming under NIST and OWASP influence. Regulatory pressure from the EU Cyber Resilience Act and similar US initiatives will push organisations to document the provenance of AI code.

Qodo's enterprise review framework emphasises that automated tools must produce artifacts that reviewers and compliance teams can rely on, including referenced code snippets, security breakdowns, call-site lists, suggested patches, and an audit trail for each workflow action. In large engineering organisations, these artifacts become the verifiable evidence needed for governance, incident review, and policy enforcement. Effective monitoring and logging ensure accountability by linking AI-generated code to developers, inputs, and decisions for audit and traceability.

The OWASP Top 10 for Large Language Model Applications, updated for 2025, provides specific guidance for securing AI-generated code. The project notes that prompt injection remains the number one concern in securing LLMs, underscoring its critical importance in generative AI security. The framework identifies insecure output handling as a key vulnerability: neglecting to validate LLM outputs may lead to downstream security exploits, including code execution that compromises systems and exposes data. Attack scenarios include cross-site scripting, SQL injection, or code execution via unsafe LLM output, as well as LLM-generated Markdown or HTML enabling malicious script injection.

Mitigation strategies recommended by OWASP include treating the model as a user, adopting a zero-trust approach, and ensuring proper input validation for any responses from the model to backend functions. Organisations should encode the model's output before delivering it to users to prevent unintended code execution and implement content filters to eliminate vulnerabilities like cross-site scripting and SQL injection in LLM-generated outputs. Following the OWASP Application Security Verification Standard guidelines with a focus on input sanitisation is essential. Incorporating Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) into the development process helps identify vulnerabilities early.

The principle of least privilege takes on new dimensions when applied to AI agents. Slack's security documentation for AI features emphasises that AI interactions are protected by enterprise-grade safety and security frameworks, providing layered protection across every prompt and response. These protections include content thresholds to avoid hallucinations, prompt instructions that reinforce safe behaviour, provider-level mitigations, context engineering to mitigate prompt injection vulnerabilities, URL filtering to reduce phishing risk, and output validation.

Slack's Real-Time Search API, coming in early 2026, will allow organisations to build custom AI applications that maintain enterprise security standards, providing real-time search access that allows users to interact with data directly. Crucially, when access to a sensitive document is revoked, that change is reflected in the user's next query across all AI systems without waiting for overnight sync jobs.

Preserving Intentionality in the Age of Automation

Perhaps the most subtle but significant challenge of chat-based AI development is the erosion of intentionality. When code could only be written through deliberate effort in an IDE, every line represented a considered decision. When code can be summoned through casual conversation, the distinction between intention and impulse begins to blur.

The JetBrains 2025 survey reveals telling statistics about developer attitudes. Among concerns about AI coding tools, 23 per cent cite inconsistent code quality, 18 per cent point to limited understanding of complex logic, 13 per cent worry about privacy and security, 11 per cent fear negative effects on their skills, and 10 per cent note lack of context awareness. Developers want to delegate mundane tasks to AI but prefer to stay in control of more creative and complex ones. Meanwhile, 68 per cent of developers anticipate that AI proficiency will become a job requirement, and 90 per cent report saving at least an hour weekly using AI tools.

This preference for maintained control reflects a deeper understanding of what makes software development valuable: not the typing, but the thinking. The Pragmatic Engineer newsletter's analysis of how AI-assisted coding will change software engineering observes that the best developers are not the ones who reject AI or blindly trust it. They are the ones who know when to lean on AI and when to think deeply themselves.

The shift to chat-based development creates particular challenges for this discernment. In an IDE, the boundary between human thought and AI suggestion remains relatively clear. In a chat environment, where multiple participants may contribute to a thread, the provenance of each requirement becomes harder to trace. The Capgemini analysis of AI agents in software development emphasises that autonomy in this context refers to systems that self-organise, adapt, and collaborate to achieve a shared goal. The goal is not to automate the whole software development lifecycle, but specific tasks where developers benefit from automation.

This targeted approach requires organisational discipline that many companies have not yet developed. IBM's documentation on the benefits of ChatOps notes that it offers automated workflows, centralised communication, real-time monitoring, and security and compliance features. But it also warns of ChatOps dangers and the need for organisational protocols and orchestrators for governed LLM infrastructure use. Critical security implications include data exposure and the need for internal models or strict rules.

The risk is that replacing traditional development with chat-based AI could lead to unmanaged infrastructure if companies do not have proper protocols and guardrails in place for LLM usage. DevOps.com's analysis of AI-powered DevSecOps warns that automated compliance checks may miss context-specific security gaps, leading to non-compliance in highly regulated industries. Organisations should integrate AI-driven governance tools with human validation to maintain accountability and regulatory alignment.

The Human-in-the-Loop Imperative

The emerging consensus among security researchers and enterprise architects is that AI coding agents in chat environments require what is termed a “human-in-the-loop” approach for any sensitive operations. This is not a rejection of automation, but a recognition of its proper boundaries.

Slack's security documentation for its Agentforce product, available since early 2025, describes AI interactions protected by enterprise-grade guardrails. These include content thresholds to avoid hallucinations, prompt instructions that reinforce safe behaviour, and output validation. However, the documentation acknowledges that these technical controls are necessary but not sufficient. The company uses third-party large language models hosted within secure AWS infrastructure, with LLMs that do not retain any information from requests, and customer data is never used to train third-party LLMs.

The Obsidian Security analysis of AI agent security risks identifies identity-based attacks, especially involving stolen API keys and OAuth tokens, as a rapidly growing threat vector for enterprises using AI agents. In one notable incident, attackers exploited Salesloft-Drift OAuth tokens, which granted them access to hundreds of downstream environments. The blast radius of this supply chain attack was ten times greater than previous incidents.

Best practices for mitigating these risks include using dynamic, context-aware authentication such as certificate-based authentication, implementing short-lived tokens with automatic rotation, and most importantly, requiring human approval for sensitive operations. As the analysis notes, security mitigations should include forcing context separation by splitting different tasks to different LLM instances, employing the principle of least privilege for agents, taking a human-in-the-loop approach for approving sensitive operations, and filtering input for text strings commonly used in prompt injections.

The Unit 42 research team at Palo Alto Networks has documented how context attachment features can be vulnerable to indirect prompt injection. To set up this injection, threat actors first contaminate a public or third-party data source by inserting carefully crafted prompts into the source. When a user inadvertently supplies this contaminated data to an assistant, the malicious prompts hijack the assistant. This hijack could manipulate victims into executing a backdoor, inserting malicious code into an existing codebase, and leaking sensitive information.

This threat model makes clear that human oversight cannot be optional. Even the most sophisticated AI guardrails can be circumvented by adversaries who understand how to manipulate the inputs that AI systems consume.

Redefining Roles for the Agentic Era

As AI coding agents become embedded in everyday workflows, the roles of developers, product managers, and technical leaders are being fundamentally redefined. The DevOps community discussion on the evolution from Copilot to autonomous AI suggests that developers' roles may shift to guiding these agents as “intent engineers” or “AI orchestrators.”

This transition requires new skills and new organisational structures. The AWS DevOps blog's analysis of the AI-driven development lifecycle identifies levels of AI autonomy similar to autonomous driving: Level 0 involves no AI-assisted automation; Level 1 provides AI-assisted options where the developer is in full control and receives recommendations; Level 2 involves AI-assisted selection where AI selects pre-defined options; Level 3 provides AI-based partial automation where AI selects options in simple standard cases; and Level 4 involves AI-based full automation where AI operates without the developer. Currently, Levels 1 and 2 are the most common, Level 3 is on the rise, and Level 4 is considered rather unrealistic for complex, industrial-scale software.

The key insight, as articulated in the Capgemini analysis, is that the future is not about AI replacing developers. It is about AI becoming an increasingly capable collaborator that can take initiative whilst still respecting human guidance and expertise. The most effective teams are those that learn to set clear boundaries and guidelines for their AI agents, establish strong architectural patterns, create effective feedback loops, and maintain human oversight whilst leveraging AI autonomy.

This balance requires governance structures that did not exist in the pre-AI era. The Legit Security analysis of DevOps governance emphasises that hybrid governance combines centralised standards with decentralised execution. You standardise core practices like identity management, secure deployment, and compliance monitoring, whilst letting teams adjust the rest to fit their workflows. This balances consistency with agility to support collaboration across diverse environments.

For product managers and non-technical stakeholders, the new environment demands greater technical literacy without the pretence of technical expertise. Whilst AI tools can generate features and predict patterns, the critical decisions about how to implement these capabilities to serve real human needs still rest firmly in human hands. The danger is that casual @mentions become a way of avoiding this responsibility, outsourcing judgment to systems that cannot truly judge.

Towards a Disciplined Future

The integration of AI coding agents into collaboration platforms like Slack represents an inflection point in the history of software development. The potential benefits are enormous: faster iteration, broader participation in the development process, and reduced friction between conception and implementation. But these benefits come with risks that are only beginning to be understood.

The statistics point to a trajectory that cannot be reversed. The global AI agents market reached $7.63 billion in 2025 and is projected to hit $50.31 billion by 2030, according to industry analyses cited by the Cloud Security Alliance. McKinsey's research shows that 88 per cent of organisations now use AI in at least one function, up from 55 per cent in 2023. The question is not whether AI coding agents will become ubiquitous in collaborative environments, but whether organisations will develop the governance maturity to deploy them safely.

The path forward requires action on multiple fronts. First, organisations must implement tiered permission systems that treat AI agents with the same rigour applied to human access, or greater. The principle of least privilege must be extended to every bot that can touch code. Second, audit trails must be comprehensive and immutable, documenting every AI-generated change, who requested it, and what review it received. Third, human approval must remain mandatory for any changes to critical systems, regardless of how convenient chat-based automation might be.

Perhaps most importantly, organisations must resist the cultural pressure to treat chat-based code generation as equivalent to traditional development. The discipline of code review, the intentionality of careful architecture, and the accountability of clear ownership were never bureaucratic obstacles to progress. They were the foundations of engineering integrity.

IT Pro's analysis of AI software development in 2026 warns that developer teams still face significant challenges with adoption, security, and quality control. The Knostic analysis of AI coding assistant governance notes that governance frameworks matter more for AI code generation than traditional development tools because the technology introduces new categories of risk. Without clear policies, teams make inconsistent decisions about when to use AI, how to validate outputs, and what constitutes acceptable generated code.

The convenience of asking an AI to write code in a Slack channel is seductive. But convenience has never been the highest virtue in software engineering. Reliability, security, and maintainability are what distinguish systems that endure from those that collapse. As AI coding agents proliferate through our collaboration platforms, the organisations that thrive will be those that remember this truth, even as they embrace the power of automation.

The next time a product manager types “@CodingBot” into a Slack channel, the response should not be automatic code generation. It should be a series of questions: What is the business justification? Has this been reviewed by security? What is the rollback plan? Is human approval required? Only with these safeguards in place can chat-driven development realise its potential without becoming a vector for chaos.

---

References and Sources

1. JetBrains. “The State of Developer Ecosystem 2025.” https://devecosystem-2025.jetbrains.com/
2. Dark Reading. “As Coders Adopt AI Agents, Security Pitfalls Lurk in 2026.” https://www.darkreading.com/application-security/coders-adopt-ai-agents-security-pitfalls-lurk-2026
3. Slack. “Securing the Agentic Enterprise.” https://slack.com/blog/transformation/securing-the-agentic-enterprise
4. GitHub. “November 2025 Copilot Roundup.” https://github.com/orgs/community/discussions/180828
5. MIT News. “Can AI Really Code? Study Maps the Roadblocks to Autonomous Software Engineering.” July 2025. https://news.mit.edu/2025/can-ai-really-code-study-maps-roadblocks-to-autonomous-software-engineering-0716
6. Bain and Company. “From Pilots to Payoff: Generative AI in Software Development.” 2025. https://www.bain.com/insights/from-pilots-to-payoff-generative-ai-in-software-development-technology-report-2025/
7. McKinsey. “How an AI-Enabled Software Product Development Life Cycle Will Fuel Innovation.” https://www.mckinsey.com/industries/technology-media-and-telecommunications/our-insights/how-an-ai-enabled-software-product-development-life-cycle-will-fuel-innovation
8. Cloud Security Alliance. “Fortifying the Agentic Web: A Unified Zero-Trust Architecture for AI.” September 2025. https://cloudsecurityalliance.org/blog/2025/09/12/fortifying-the-agentic-web-a-unified-zero-trust-architecture-against-logic-layer-threats
9. Cloud Security Alliance. “Agentic AI and Zero Trust.” August 2025. https://cloudsecurityalliance.org/blog/2025/08/07/agentic-ai-and-zero-trust
10. Checkmarx. “2025 CISO Guide to Securing AI-Generated Code.” https://checkmarx.com/blog/ai-is-writing-your-code-whos-keeping-it-secure/
11. IBM. “2025 Cost of a Data Breach Report.” https://www.ibm.com/reports/data-breach
12. OWASP. “Top 10 for Large Language Model Applications.” https://owasp.org/www-project-top-10-for-large-language-model-applications/
13. TechTarget. “Security Risks of AI-Generated Code and How to Manage Them.” https://www.techtarget.com/searchsecurity/tip/Security-risks-of-AI-generated-code-and-how-to-manage-them
14. Qodo. “AI Code Review Tools Compared: Context, Automation, and Enterprise Scale.” 2026. https://www.qodo.ai/blog/best-ai-code-review-tools-2026/
15. Augment Code. “AI Code Governance Framework for Enterprise Dev Teams.” https://www.augmentcode.com/guides/ai-code-governance-framework-for-enterprise-dev-teams
16. WorkOS. “AI Agent Access Control: How to Manage Permissions Safely.” https://workos.com/blog/ai-agent-access-control
17. Cerbos. “Access Control and Permission Management for AI Agents.” https://www.cerbos.dev/blog/permission-management-for-ai-agents
18. Obsidian Security. “Top AI Agent Security Risks and How to Mitigate Them.” https://www.obsidiansecurity.com/blog/ai-agent-security-risks
19. Palo Alto Networks Unit 42. “The Risks of Code Assistant LLMs: Harmful Content, Misuse and Deception.” https://unit42.paloaltonetworks.com/code-assistant-llms/
20. Slack Engineering. “Streamlining Security Investigations with Agents.” https://slack.engineering/streamlining-security-investigations-with-agents/
21. DX (GetDX). “AI Code Generation: Best Practices for Enterprise Adoption in 2025.” https://getdx.com/blog/ai-code-enterprise-adoption/
22. Capgemini. “How AI Agents in Software Development Empowers Teams to Do More.” https://www.capgemini.com/insights/expert-perspectives/how-ai-agents-in-software-development-empowers-teams-to-do-more/
23. DevOps.com. “AI-Powered DevSecOps: Navigating Automation, Risk and Compliance in a Zero-Trust World.” https://devops.com/ai-powered-devsecops-navigating-automation-risk-and-compliance-in-a-zero-trust-world/
24. Legit Security. “DevOps Governance: Importance and Best Practices.” https://www.legitsecurity.com/aspm-knowledge-base/devops-governance
25. IT Pro. “AI Could Truly Transform Software Development in 2026.” https://www.itpro.com/software/development/ai-software-development-2026-vibe-coding-security
26. Knostic. “Governance for Your AI Coding Assistant.” https://www.knostic.ai/blog/ai-coding-assistant-governance
27. Slack. “Security for AI Features in Slack.” https://slack.com/help/articles/28310650165907-Security-for-AI-features-in-Slack
28. InfoWorld. “85% of Developers Use AI Regularly.” https://www.infoworld.com/article/4077352/85-of-developers-use-ai-regularly-jetbrains-survey.html

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

In November 2025, a mysterious country music act named Breaking Rust achieved something unprecedented: the AI-generated song “Walk My Walk” topped Billboard's Country Digital Song Sales chart, marking the first time an artificial intelligence creation had claimed the number one position on any Billboard chart. The track, produced entirely without human performers using generative AI tools for vocals, instrumentation, and lyrics, reached its peak with approximately 3,000 digital downloads. That same month, Xania Monet, an AI R&B artist created using the Suno platform, became the first known AI artist to earn enough radio airplay to debut on a Billboard radio chart, entering the Adult R&B Airplay ranking at number 30.

These milestones arrived not with fanfare but with an uncomfortable silence from an industry still grappling with what they mean. The charts that have long served as the music industry's primary measure of success had been successfully penetrated by entities that possess neither lived experience nor artistic intention in any conventional sense. The question that follows is not merely whether AI can achieve commercial validation through existing distribution and ranking systems. It clearly can. The more unsettling question is what this reveals about those systems themselves, and whether the metrics the industry has constructed to measure success have become so disconnected from traditional notions of artistic value that they can no longer distinguish between human creativity and algorithmic output.

From Smoky Clubs to Algorithmic Playlists

The music industry has always operated through gatekeeping structures. For most of the twentieth century, these gates were controlled by human intermediaries: A&R executives who discovered talent in smoky clubs, radio programmers who decided which songs reached mass audiences, music journalists who shaped critical discourse, and record label executives who determined which artists received investment and promotion. These gatekeepers were imperfect, often biased, and frequently wrong, but they operated according to evaluative frameworks that at least attempted to assess artistic merit alongside commercial potential.

The transformation began with digital distribution and accelerated with streaming. By the early 2020s, the typical song on the Billboard Hot 100 derived approximately 73 per cent of its chart position from streaming, 25 per cent from radio airplay, and a mere 2 per cent from digital sales. This represented a dramatic inversion from the late 1990s, when radio airplay accounted for 75 per cent of a song's chart fortunes. Billboard's methodology has continued to evolve, with the company announcing in late 2025 that effective January 2026, the ratio between paid subscription and ad-supported on-demand streaming would be adjusted to 1:2.5, further cementing streaming's dominance whilst simultaneously prompting YouTube to withdraw its data from Billboard charts in protest over what it characterised as unfair undervaluation of ad-supported listening. The metrics that now crown hits are fundamentally different in character: stream counts, skip rates, playlist additions, save rates, and downstream consumption patterns. These are measures of engagement behaviour, not assessments of artistic quality.

Streaming platforms have become what scholars describe as the “new gatekeepers” of the music industry. Unlike their predecessors, these platforms wield what researchers Tiziano Bonini and Alessandro Gandini term “algo-torial power,” a fusion of algorithmic and curatorial capabilities that far exceeds the influence of traditional intermediaries. Spotify alone, commanding approximately 35 per cent of the global streaming market in 2025, manages over 3,000 official editorial playlists, with flagship lists like Today's Top Hits commanding over 34 million followers. A single placement on such a playlist can translate into millions of streams overnight, with artists reporting that high positions on editorial playlists generate cascading effects across their entire catalogues.

Yet the balance has shifted even further toward automation. Since 2017, Spotify has developed what it calls “Algotorial” technology, combining human editorial expertise with algorithmic personalisation. The company reports that over 81 per cent of users cite personalisation as what they value most about the platform. The influence of human-curated playlists has declined correspondingly. Major music labels have reported significant drops in streams from flagship playlists like RapCaviar and Dance Hits, signalling a fundamental change in how listeners engage with curated content. Editorial playlists, whilst still powerful, often feature songs for only about a week, limiting their long-term impact compared to algorithmic recommendation systems that continuously surface content based on listening patterns.

This shift has consequences for what can succeed commercially. Algorithmic recommendation systems favour predictable structures and familiar sonic elements. Data analysis suggests songs that maintain listener engagement within the first 30 seconds receive preferential treatment, incentivising shorter introductions and immediate hooks, often at the expense of nuanced musical development.

Artists and their teams are encouraged to optimise for “asset rank,” a function of user feedback reflecting how well a song performs in particular consumption contexts. The most successful strategies involve understanding algorithmic nuances, social media marketing, and digital engagement techniques.

Into this optimisation landscape, AI-generated music arrives perfectly suited. Systems like Suno, the platform behind both Xania Monet and numerous other AI artists, can produce content calibrated to the precise engagement patterns that algorithms reward. The music need not express lived experience or demonstrate artistic growth. It need only trigger the behavioural signals that platforms interpret as success.

When 97 Per Cent of Ears Cannot Distinguish

In November 2025, French streaming service Deezer commissioned what it described as the world's first survey focused on perceptions and attitudes toward AI-generated music. Conducted by Ipsos across 9,000 participants in eight countries, the study produced a startling headline finding: when asked to listen to three tracks and identify which was fully AI-generated, 97 per cent of respondents failed.

A majority of participants (71 per cent) expressed surprise at this result, whilst more than half (52 per cent) reported feeling uncomfortable at their inability to distinguish machine-made music from human creativity. The findings carried particular weight given the survey's scale and geographic breadth, spanning markets with different musical traditions and consumption patterns.

The implications extend beyond parlour game failures. If listeners cannot reliably identify AI-generated music, then the primary quality filter that has historically separated commercially successful music from unsuccessful music has been compromised. Human audiences, consciously or not, have traditionally evaluated music according to criteria that include emotional authenticity, creative originality, and the sense that a human being is communicating something meaningful.

If AI can convincingly simulate these qualities to most listeners, then the market mechanism that was supposed to reward genuine artistic achievement has become unreliable.

Research from MIT Media Lab exposed participants to both AI and human music under various labelling conditions, finding that participants were significantly more likely to rate human-composed music as more effective at eliciting target emotional states, regardless of whether they knew the composer's identity. A 2024 study published in PLOS One compared emotional reactions to AI-generated and human-composed music among 88 participants monitored through heart rate, skin conductance, and self-reported emotion.

Both types triggered feelings, but human compositions scored consistently higher for expressiveness, authenticity, and memorability. Many respondents described AI music as “technically correct” but “emotionally flat.” The distinction between technical competence and emotional resonance emerged as a recurring theme across multiple research efforts, suggesting that whilst AI can successfully mimic surface-level musical characteristics, deeper qualities associated with human expression remain more elusive.

These findings suggest that humans can perceive meaningful differences when prompted to evaluate carefully. But streaming consumption is rarely careful evaluation. It is background listening during commutes, ambient accompaniment to work tasks, algorithmic playlists shuffling in the background of social gatherings. In these passive consumption contexts, the distinctions that laboratory studies reveal may not register at all.

The SyncVault 2025 Trends Report found that 74 per cent of content creators now prefer to license music from identifiable human composers, citing creative trust and legal clarity. A survey of 100 music industry insiders found that 98 per cent consider it “very important” to know if music is human-made, and 96 per cent would consider paying a premium for a human-verified music service. Industry professionals, at least, believe the distinction matters. Whether consumers will pay for that distinction in practice remains uncertain.

Four Stakeholders, Four Incompatible Scorecards

The chart success of AI-generated music exposes a deeper fragmentation: different stakeholder groups in the music industry operate according to fundamentally different definitions of what “success” means, and these definitions are becoming increasingly incompatible.

For streaming platforms and their algorithms, success is engagement. A successful track is one that generates streams, maintains listener attention, triggers saves and playlist additions, and encourages downstream consumption. These metrics are agnostic about the source of the music. An AI-generated track that triggers the right engagement patterns is, from the platform's perspective, indistinguishable from a human creation that does the same. The platform's business model depends on maximising time spent listening, regardless of whether that listening involves human artistry or algorithmic simulation.

For record labels and investors, success is revenue. The global music market reached $40.5 billion in 2024, with streaming accounting for 69 per cent of global recorded music revenues, surpassing $20 billion for the first time. Goldman Sachs projects the market will reach $110.8 billion by 2030.

In this financial framework, AI music represents an opportunity to generate content with dramatically reduced labour costs. An AI artist requires no advances, no touring support, no management of creative disagreements or personal crises. As Victoria Monet observed when commenting on AI artist Xania Monet, “our time is more finite. We have to rest at night. So, the eight hours, nine hours that we're resting, an AI artist could potentially still be running, studying, and creating songs like a machine.”

Hallwood Media, the company that signed Xania Monet to a reported $3 million deal, is led by Neil Jacobson, formerly president of Geffen Records. The company has positioned itself at the forefront of AI music commercialisation, also signing imoliver, described as the top-streaming “music designer” on Suno, in what was characterised as the first traditional label signing of an AI music creator. Jacobson framed these moves as embracing innovation, stating that imoliver “represents the future of our medium.”

For traditional gatekeeping institutions like the Grammy Awards, success involves human authorship as a precondition. The Recording Academy clarified in its 66th Rules and Guidelines that “A work that contains no human authorship is not eligible in any Categories.” CEO Harvey Mason Jr. elaborated: “Here's the super easy, headline statement: AI, or music that contains AI-created elements is absolutely eligible for entry and for consideration for Grammy nomination. Period. What's not going to happen is we are not going to give a Grammy or Grammy nomination to the AI portion.”

This creates a category distinction: AI-assisted human creativity can receive institutional recognition, but pure AI generation cannot. The Grammy position attempts to preserve human authorship as a prerequisite for the highest forms of cultural validation.

But this distinction may prove difficult to maintain. If AI tools become sufficiently sophisticated, determining where “meaningful human contribution” begins and ends may become arbitrary. And if AI creations achieve commercial success that rivals or exceeds Grammy-winning human artists, the cultural authority of the Grammy distinction may erode.

For human artists, success often encompasses dimensions that neither algorithms nor financial metrics capture: creative fulfilment, authentic emotional expression, the sense of communicating something true about human experience, and recognition from peers and critics who understand the craft involved.

When Kehlani criticised the Xania Monet deal in a social media post, she articulated this perspective: “There is an AI R&B artist who just signed a multimillion-dollar deal... and the person is doing none of the work.” The objection is not merely economic but existential. Success that bypasses creative labour does not register as success in the traditional artistic sense.

SZA connected her critique to broader concerns, noting that AI technology causes “harm” to marginalised neighbourhoods through the energy demands of data centres. She asked fans not to create AI images or songs using her likeness.

Muni Long questioned why AI artists appeared to be gaining acceptance in R&B specifically, suggesting a genre-specific vulnerability: “It wouldn't be allowed to happen in country or pop.” This observation points to power dynamics within the industry, where some artistic communities may be more exposed to AI disruption than others.

What the Charts Reveal About Themselves

If AI systems can achieve commercial validation through existing distribution and ranking systems without the cultural legitimacy or institutional endorsement traditionally required of human artists, what does this reveal about those gatekeeping institutions?

The first revelation is that commercial gatekeeping has largely decoupled from quality assessment. Billboard charts measure commercial performance. They count downloads, streams, and airplay. They do not and cannot assess whether the music being counted represents artistic achievement.

For most of chart history, this limitation mattered less because commercial success and artistic recognition, whilst never perfectly aligned, operated in the same general neighbourhood. The processes that led to commercial success included human gatekeepers making evaluative judgements about which artists to invest in, which songs to programme, and which acts to promote. AI success bypasses these evaluative filters entirely.

The second revelation concerns the vulnerability of metrics-based systems to manipulation. Billboard's digital sales charts have been targets for manipulation for years. The Country Digital Song Sales chart that Breaking Rust topped requires only approximately 2,500 downloads to claim the number one position.

This is a vestige of an era when iTunes ruled the music industry, before streaming subscription models made downloads a relic. In 2024, downloads accounted for just $329 million according to the RIAA, approximately 2 per cent of US recorded music revenue.

Critics have argued that the situation represents “a Milli Vanilli-level fraud being perpetrated on music consumers, facilitated by Billboard's permissive approach to their charts.” The Saving Country Music publication declared that “Billboard must address AI on the charts NOW,” suggesting the chart organisation is avoiding “gatekeeping” accusations by remaining content with AI encroaching on its rankings without directly addressing the issue.

If the industry's most prestigious measurement system can be topped by AI-generated content with minimal organic engagement, the system's legitimacy as a measure of popular success comes into question.

The third revelation is that cultural legitimacy and commercial success have become separable in ways they previously were not. Throughout the twentieth century, chart success generally brought cultural legitimacy. Artists who topped charts received media attention, critical engagement, and the presumption that their success reflected some form of popular validation.

AI chart success does not translate into cultural legitimacy in the same way. No one regards Breaking Rust as a significant country artist regardless of its chart position. The chart placement functions as a technical achievement rather than a cultural coronation.

This separability creates an unstable situation. If commercial metrics can be achieved without cultural legitimacy, and cultural legitimacy cannot be achieved through commercial metrics alone, then the unified system that connected commercial success to cultural status has fractured. Different stakeholders now operate in different legitimacy frameworks that may be incompatible.

Royalty Dilution and the Economics of Content Flooding

Beyond questions of legitimacy, AI-generated music creates concrete economic pressures on human artists through royalty pool dilution. Streaming platforms operate on pro-rata payment models: subscription revenue enters a shared pool divided according to total streams. When more content enters the system, the per-stream value for all creators decreases.

Deezer has been the most transparent about the scale of this phenomenon. The platform reported receiving approximately 10,000 fully AI-generated tracks daily in January 2025. By April, this had risen to 20,000. By September, 28 per cent of all content delivered to Deezer was fully AI-generated. By November, the figure had reached 34 per cent, representing over 50,000 AI-generated tracks uploaded daily.

These tracks represent not merely competition for listener attention but direct extraction from the royalty pool. Deezer has found that up to 70 per cent of streams generated by fully AI-generated tracks are fraudulent.

The company's Beatdapp co-CEO Morgan Hayduk noted: “Every point of market share is worth a couple hundred million US dollars today. So we're talking about a billion dollars minimum, that's a billion dollars being taken out of a finite pool of royalties.”

The connection between AI music generation and streaming fraud became explicit in September 2024, when a North Carolina musician named Michael Smith was indicted by federal prosecutors over allegations that he used an AI music company to help create “hundreds of thousands” of songs, then used those AI tracks to steal more than $10 million in fraudulent streaming royalty payments since 2017. Manhattan federal prosecutors charged Smith with three counts of wire fraud, wire fraud conspiracy, and money laundering conspiracy, making it the first federal case targeting streaming fraud.

Universal Music Group addressed this threat pre-emptively, placing provisions in agreements with digital service providers that prevent AI-generated content from being counted in the same royalty pools as human artists. UMG chief Lucian Grainge criticised the “exponential growth of AI slop” on streaming services. But artists not represented by major labels may lack similar protections.

A study conducted by CISAC (the International Confederation of Societies of Authors and Composers, representing over 5 million creators worldwide) and PMP Strategy projected that nearly 24 per cent of music creators' revenues are at risk by 2028, representing cumulative losses of 10 billion euros over five years and annual losses of 4 billion euros by 2028 specifically. The study further predicted that generative AI music would account for approximately 20 per cent of music streaming platforms' revenues and 60 per cent of music library revenues by 2028. Notably, CISAC reported that not a single AI developer has signed a licensing agreement with any of the 225 collective management organisations that are members of CISAC worldwide, despite societies approaching hundreds of AI companies with requests to negotiate licences. The model that has sustained recorded music revenues for the streaming era may be fundamentally threatened if AI content continues its current growth trajectory.

Human Artists as Raw Material

The relationship between AI music systems and human artists extends beyond competition. The AI platforms achieving chart success were trained on human creativity. Suno CEO Mikey Shulman acknowledged that the company trains on copyrighted music, stating: “We train our models on medium- and high-quality music we can find on the open internet. Much of the open internet indeed contains copyrighted materials.”

Major record labels responded with landmark lawsuits in June 2024 against Suno and Udio, the two leading AI music generation platforms, seeking damages of up to $150,000 per infringed recording. The legal battle represents one of the most significant intellectual property disputes of the streaming era, with outcomes that could fundamentally reshape how AI companies source training data and how human creators are compensated when their work is used to train commercial AI systems.

This creates a paradox: AI systems that threaten human artists' livelihoods were made possible by consuming those artists' creative output without compensation. The US Copyright Office's May 2025 report provided significant guidance on this matter, finding that training and deploying generative AI systems using copyright-protected material involves multiple acts that could establish prima facie infringement. The report specifically noted that “the use of more creative or expressive works (such as novels, movies, art, or music) is less likely to be fair use than use of factual or functional works” and warned that “making commercial use of vast troves of copyrighted works to produce expressive content that competes with them in existing markets... goes beyond established fair use boundaries.” Yet legal resolution remains distant, and in the interim, AI platforms continue generating content that competes with the human artists whose work trained them.

When Victoria Monet confronted the existence of Xania Monet, an AI persona whose name, appearance, and vocal style bore resemblance to her own, she described an experiment: a friend typed the prompt “Victoria Monet making tacos” into an AI image generator, and the system produced visuals that looked uncannily similar to Xania Monet's promotional imagery.

Whether this reflects direct training on Victoria Monet's work or emergent patterns from broader R&B training data, the practical effect remains the same. An artist's distinctive identity becomes raw material for generating commercial competitors. The boundaries between inspiration, derivation, and extraction blur when machine learning systems can absorb and recombine stylistic elements at industrial scale.

Possible Reckonings and Plausible Futures

The situation the music industry faces is not one problem but many interconnected problems that compound each other. Commercial metrics have been detached from quality assessment. Gatekeeping institutions have lost their filtering function. Listener perception has become unreliable as a quality signal. Royalty economics are being undermined by content flooding. Training data extraction has turned human creativity against its creators. And different stakeholder groups operate according to incompatible success frameworks.

Could widespread AI chart performance actually force a reckoning with how the music industry measures and defines value itself? There are reasons for cautious optimism.

Deezer has positioned itself as the first streaming service to automatically label 100 per cent AI-generated tracks, removing them from algorithmic recommendations and editorial playlists. This represents an attempt to preserve human music's privileged position in the discovery ecosystem. If other platforms adopt similar approaches, AI content might be effectively segregated into a separate category that does not compete directly with human artists.

The EU's AI Act, which entered into force on 1 August 2024, mandates unprecedented transparency about training data. Article 53 requires providers of general-purpose AI models to publish sufficiently detailed summaries of their training data, including content protected by copyright, according to a template published by the European Commission's AI Office in July 2025. Compliance became applicable from 2 August 2025, with the AI Office empowered to verify compliance and issue corrective measures from August 2026, with potential fines reaching 15 million euros or 3 per cent of global annual revenue. The GPAI Code of Practice operationalises these requirements by mandating that providers maintain copyright policies, rely only on lawful data sources, respect machine-readable rights reservations, and implement safeguards against infringing outputs. This transparency requirement could make it harder for AI music platforms to operate without addressing rights holder concerns.

Human premium pricing may emerge as a market response. The survey finding that 96 per cent of music industry insiders would consider paying a premium for human-verified music services suggests latent demand for authenticated human creativity. If platforms can credibly certify human authorship, a tiered market could develop where human music commands higher licensing fees.

Institutional reform remains possible. Billboard could establish separate charts for AI-generated music, preserving the significance of its traditional rankings whilst acknowledging the new category of content. The Recording Academy's human authorship requirement for Grammy eligibility demonstrates that cultural institutions can draw principled distinctions. These distinctions may become more robust if validated by legal and regulatory frameworks.

But there are also reasons for pessimism. Market forces favour efficiency, and AI music production is dramatically more efficient than human creation. If listeners genuinely cannot distinguish AI from human music in typical consumption contexts, there may be insufficient consumer pressure to preserve human-created content.

The 0.5 per cent of streams that AI music currently represents on Deezer, despite comprising 34 per cent of uploads, suggests the content is not yet finding significant audiences. But this could change as AI capabilities improve.

The fragmentation of success definitions may prove permanent. If streaming platforms, financial investors, cultural institutions, and human artists cannot agree on what success means, each group may simply operate according to its own framework, acknowledging the others' legitimacy selectively or not at all.

A track could simultaneously be a chart success, a financial investment, an ineligible Grammy submission, and an object of contempt from human artists. The unified status hierarchy that once organised the music industry could dissolve into parallel status systems that rarely intersect.

What Commercial Metrics Cannot Capture

Perhaps what the AI chart success reveals most clearly is that commercial metrics have always been inadequate measures of what music means. They were useful proxies when the systems generating commercially successful music also contained human judgement, human creativity, and human emotional expression. When those systems can be bypassed by algorithmic optimisation, the metrics are exposed as measuring only engagement behaviours, not the qualities those behaviours were supposed to indicate.

The traditional understanding of musical success included dimensions that are difficult to quantify: the sense that an artist had something to say and found a compelling way to say it, the recognition that creative skill and emotional honesty had produced something of value, the feeling of connection between artist and audience based on shared human experience.

These dimensions were always in tension with commercial metrics, but they were present in the evaluative frameworks that shaped which music received investment and promotion.

AI-generated music can trigger engagement behaviours. It can accumulate streams, achieve chart positions, and generate revenue. What it cannot do is mean something in the way human creative expression means something. It cannot represent the authentic voice of an artist working through lived experience. It cannot reward careful listening with the sense of encountering another human consciousness.

Whether listeners actually care about these distinctions is an empirical question that the market will answer. The preliminary evidence is mixed. The 97 per cent of listeners who cannot identify AI-generated music in blind tests suggest that, in passive consumption contexts, meaning may not be the operative criterion.

But the 80 per cent who agree that AI-generated music should be clearly labelled suggest discomfort with being fooled. And the premium that industry professionals say they would pay for human-verified music suggests that at least some market segments value authenticity.

The reckoning, if it comes, will force the industry to articulate what it believes music is for. If music is primarily engagement content designed to fill attention and generate revenue, then AI-generated music is simply more efficient production of that content. If music is a form of human communication that derives meaning from its human origins, then AI-generated music is a category error masquerading as the real thing.

These are not technical questions that data can resolve. They are value questions that different stakeholders will answer differently.

What seems certain is that the status quo cannot hold. The same metrics that crown hits cannot simultaneously serve as quality filters when algorithmic output can game those metrics. The same gatekeeping institutions cannot simultaneously validate commercial success and preserve human authorship requirements when commercial success becomes achievable without human authorship. The same royalty pools cannot sustain human artists if flooded with AI content competing for the same finite attention and revenue.

The chart success of AI-generated music is not the end of human music. It is the beginning of a sorting process that will determine what human music is worth in a world where its commercial position can no longer be assumed. That process will reshape not just the music industry but our understanding of what distinguishes human creativity from its algorithmic simulation.

The answer we arrive at will say as much about what we value as listeners and as a culture as it does about the capabilities of the machines.

---

References and Sources

1. Billboard. “How Many AI Artists Have Debuted on Billboard's Charts?” https://www.billboard.com/lists/ai-artists-on-billboard-charts/

2. Billboard. “AI Artist Xania Monet Debuts on Adult R&B Airplay – a Radio Chart Breakthrough.” https://www.billboard.com/music/chart-beat/ai-artist-xania-monet-debut-adult-rb-airplay-chart-1236102665/

3. Billboard. “AI Music Artist Xania Monet Signs Multimillion-Dollar Record Deal.” https://www.billboard.com/pro/ai-music-artist-xania-monet-multimillion-dollar-record-deal/

4. Billboard. “The 10 Biggest AI Music Stories of 2025: Suno & Udio Settlements, AI on the Charts & More.” https://www.billboard.com/lists/biggest-ai-music-stories-2025-suno-udio-charts-more/

5. Billboard. “AI Music Artists Are on the Charts, But They Aren't That Popular – Yet.” https://www.billboard.com/pro/ai-music-artists-charts-popular/

6. Billboard. “Kehlani Slams AI Artist Xania Monet Over $3 Million Record Deal Offer.” https://www.billboard.com/music/music-news/kehlani-slams-ai-artist-xania-monet-million-record-deal-1236071158/

7. Bensound. “Human vs AI Music: Data, Emotion & Authenticity in 2025.” https://www.bensound.com/blog/human-generated-music-vs-ai-generated-music/

8. CBS News. “People can't tell AI-generated music from real thing anymore, survey shows.” https://www.cbsnews.com/news/ai-generated-music-real-thing-cant-tell/

9. CBS News. “New Grammy rule addresses artificial intelligence.” https://www.cbsnews.com/news/grammy-rule-artificial-intelligence-only-human-creators-eligible-awards/

10. CISAC. “Global economic study shows human creators' future at risk from generative AI.” https://www.cisac.org/Newsroom/news-releases/global-economic-study-shows-human-creators-future-risk-generative-ai

11. Deezer Newsroom. “Deezer and Ipsos study: AI fools 97% of listeners.” https://newsroom-deezer.com/2025/11/deezer-ipsos-survey-ai-music/

12. Deezer Newsroom. “Deezer: 28% of all delivered music is now fully AI-generated.” https://newsroom-deezer.com/2025/09/28-fully-ai-generated-music/

13. GOV.UK. “The impact of algorithmically driven recommendation systems on music consumption and production.” https://www.gov.uk/government/publications/research-into-the-impact-of-streaming-services-algorithms-on-music-consumption/

14. Hollywood Reporter. “Hallwood Media Signs Record Deal With an 'AI Music Designer.'” https://www.hollywoodreporter.com/music/music-industry-news/hallwood-inks-record-deal-ai-music-designer-imoliver-1236328964/

15. IFPI. “Global Music Report 2025.” https://globalmusicreport.ifpi.org/

16. Medium (Anoxia Lau). “The Human Premium: What 100 Music Insiders Reveal About the Real Value of Art in the AI Era.” https://anoxia2.medium.com/the-human-premium-what-100-music-insiders-reveal-about-the-real-value-of-art-in-the-ai-era-c4e12a498c4a

17. MIT Media Lab. “Exploring listeners' perceptions of AI-generated and human-composed music.” https://www.media.mit.edu/publications/exploring-listeners-perceptions-of-ai-generated-and-human-composed-music-for-functional-emotional-applications/

18. Music Ally. “UMG boss slams 'exponential growth of AI slop' on streaming services.” https://musically.com/2026/01/09/umg-boss-slams-exponential-growth-of-ai-slop-on-streaming-services/

19. Music Business Worldwide. “50,000 AI tracks flood Deezer daily.” https://www.musicbusinessworldwide.com/50000-ai-tracks-flood-deezer-daily-as-study-shows-97-of-listeners-cant-tell-the-difference-between-human-made-vs-fully-ai-generated-music/

20. Rap-Up. “Baby Tate & Muni Long Push Back Against AI Artist Xania Monet.” https://www.rap-up.com/article/baby-tate-muni-long-xania-monet-ai-artist-backlash

21. SAGE Journals (Bonini & Gandini). “First Week Is Editorial, Second Week Is Algorithmic: Platform Gatekeepers and the Platformization of Music Curation.” https://journals.sagepub.com/doi/full/10.1177/2056305119880006

22. Saving Country Music. “Billboard Must Address AI on the Charts NOW.” https://savingcountrymusic.com/billboard-must-address-ai-on-the-charts-now/

23. Spotify Engineering. “Humans + Machines: A Look Behind the Playlists Powered by Spotify's Algotorial Technology.” https://engineering.atspotify.com/2023/04/humans-machines-a-look-behind-spotifys-algotorial-playlists

24. TIME. “No, AI Artist Breaking Rust's 'Walk My Walk' Is Not a No. 1 Hit.” https://time.com/7333738/ai-country-song-breaking-rust-walk-my/

25. US Copyright Office. “Copyright and Artificial Intelligence Part 3: Generative AI Training.” https://www.copyright.gov/ai/

26. WIPO Magazine. “How AI-generated songs are fueling the rise of streaming farms.” https://www.wipo.int/en/web/wipo-magazine/articles/how-ai-generated-songs-are-fueling-the-rise-of-streaming-farms-74310

27. Yahoo Entertainment. “Kehlani, SZA Slam AI Artist Xania Monet's Multimillion-Dollar Record Deal.” https://www.yahoo.com/entertainment/music/articles/kehlani-sza-slam-ai-artist-203344886.html

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

The stablecoin transaction that moved $2 billion from Abu Dhabi to Binance in May 2025 looked nothing like what the cypherpunks imagined when they dreamed of digital money. There were no anonymous wallets, no cryptographic rituals, no ideological manifestos. MGX, a sovereign wealth vehicle backed by the United Arab Emirates, simply wired funds denominated in USD1, a stablecoin issued by World Liberty Financial, a company affiliated with the family of the sitting United States President. The transaction settled on blockchain rails that neither party needed to understand or even acknowledge. The technology had become invisible. The revolution had been absorbed.

This moment crystallises the central tension now confronting the cryptocurrency industry as it enters what many are calling its institutional era. Stablecoins processed over $46 trillion in transactions during 2025, rivalling Visa and PayPal in volume. BlackRock's Bitcoin ETF surpassed $100 billion in assets under management, accumulating over 800,000 BTC in less than two years. The GENIUS Act became the first major cryptocurrency legislation passed by Congress, establishing federal standards for stablecoin issuers. Tokenised real-world assets reached $33 billion, with projections suggesting the market could hit $16 trillion by 2030. By every conventional measure, cryptocurrency has succeeded beyond its founders' wildest projections.

Yet success has arrived through a mechanism that would have horrified many of those founders. Crypto went mainstream by becoming invisible, as the a16z State of Crypto 2025 report observed. The technology that was supposed to disintermediate banks now powers their backend operations. The protocol designed to resist surveillance now integrates with anti-money laundering systems. The culture that celebrated pseudonymity now onboards users through email addresses and social logins. The question is whether this represents maturation or betrayal, evolution or erasure.

The Infrastructure Thesis Ascendant

The economic evidence for the invisibility approach has become overwhelming. Stripe's $1.1 billion acquisition of Bridge in February 2025 represented the payments industry's first major acknowledgement that stablecoins could serve as mainstream infrastructure rather than speculative instruments. Within three months, Stripe launched Stablecoin Financial Accounts across 101 countries, enabling businesses to hold balances in USDC and USDB while transacting seamlessly across fiat and crypto rails. The blockchain was there, handling settlement. The users never needed to know.

This pattern has repeated across traditional finance. Visa partnered with Bridge to launch card-issuing products that let cardholders spend their stablecoin balances at any merchant accepting Visa, with automatic conversion to fiat happening invisibly in the background. Klarna announced plans to issue its own stablecoin through Bridge, aiming to reduce cross-border payment costs that currently total roughly $120 billion annually. The fintech giant would become the first bank to tap Stripe's stablecoin stack for blockchain-powered payments, without requiring its customers to understand or interact with blockchain technology directly.

BlackRock has been equally explicit about treating cryptocurrency as infrastructure rather than product. Larry Fink, the firm's chief executive, declared following the Bitcoin ETF approval that “every stock and bond would eventually live on a shared digital ledger.” The company's BUIDL fund, launched on Ethereum in March 2024, has grown to manage over $2 billion in tokenised treasury assets. BlackRock has announced plans to tokenise up to $10 trillion in assets, expanding across multiple blockchain networks including Arbitrum and Polygon. For institutional investors accessing these products, the blockchain is simply plumbing, no more visible or culturally significant than the TCP/IP protocols underlying their email.

The speed of this integration has astonished even bullish observers. Bitcoin and Ethereum spot ETFs accumulated $31 billion in net inflows while processing approximately $880 billion in trading volume during 2025. An estimated 716 million people now own digital assets globally, a 16 percent increase from the previous year. More than one percent of all US dollars now exist as stablecoins on public blockchains. The numbers describe a technology that has crossed from interesting experiment to systemic relevance.

The regulatory environment has reinforced this trajectory. The GENIUS Act, signed into law in July 2025, establishes stablecoin issuers as regulated financial entities subject to the Bank Secrecy Act, with mandatory anti-money laundering programmes, sanctions compliance, and customer identification requirements. Payment stablecoins issued under the framework are explicitly not securities or commodities, freeing them from SEC and CFTC oversight while embedding them within the traditional banking regulatory apparatus. The Act requires permitted issuers to maintain one-to-one reserves in US currency or similarly liquid assets and to publish monthly disclosure of reserve details. This is not the regulatory vacuum that early cryptocurrency advocates hoped would allow decentralised alternatives to flourish. It is integration, absorption, normalisation.

The Cultural Counter-Argument

Against this backdrop of institutional triumph, a parallel ecosystem continues to thrive on explicitly crypto-native principles. Pump.fun, the Solana memecoin launchpad, has facilitated the creation of over 13 million tokens since January 2024, generating more than $866 million in lifetime revenue by October 2025. At its peak, the platform accounted for nearly 90 percent of all token mints on Solana and over 80 percent of launchpad trading volume. Its July 2025 ICO raised $1.3 billion in combined private and public sales, with the $PUMP presale hauling in $500 million in minutes at a fully diluted valuation of approximately $4 billion.

This is not infrastructure seeking invisibility. This is spectacle, culture, community, identity. The meme coin total market capitalisation exceeded $78 billion in 2025, with projects like Fartcoin briefly reaching $2.5 billion in valuation. These assets have no intrinsic utility beyond their function as coordination mechanisms for communities united by shared jokes, aesthetics, and speculative conviction. They are pure culture, and their continued prominence suggests that crypto's cultural layer retains genuine economic significance even as institutional rails proliferate.

The mechanics of attention monetisation have evolved dramatically. In January 2025, a single social media post about the $TRUMP token, launched through a one-click interface on Solana, generated hundreds of millions in trading volume within hours. This represented something genuinely new: the near-instantaneous conversion of social attention into financial activity. The friction that once separated awareness from action has been reduced to a single tap.

Re7 Capital, a venture firm that has invested in Suno and other infrastructure projects, launched a $10 million SocialFi fund in 2025 specifically targeting this intersection of social platforms and blockchain participation. As Luc de Leyritz, the firm's general partner, explained: “For the first time in five years, we see a structural opportunity in early-stage crypto venture, driven by the convergence of attention, composability and capital flows in SocialFi.” The thesis is that platforms enabling rapid conversion of social attention into financial activity represent the next major adoption vector, one that preserves rather than erases crypto's cultural distinctiveness.

Farcaster exemplifies this approach. The decentralised social protocol, backed by $150 million from Paradigm and a16z, has grown to over 546,000 registered users with approximately 40,000 to 60,000 daily active users. Its defining innovation, Farcaster Frames, enables users to mint NFTs, execute trades, and claim tokens directly within social posts without leaving the application. This is not crypto becoming invisible; this is crypto becoming the medium of social interaction itself. The blockchain is not hidden infrastructure but visible identity, with on-chain activities serving as signals of community membership and cultural affiliation.

The tension between these approaches has become central to debates about crypto's future direction. Vitalik Buterin, Ethereum's co-founder, addressed this directly in a New Year's message urging the community to focus on building applications that are “truly decentralised and usable” rather than “winning the next meta.” He outlined practical tests for decentralisation: Can users keep their assets if the company behind an application disappears? How much damage can rogue insiders or compromised front-ends cause? How many lines of code must be trusted to protect users' funds?

These questions expose the gap between infrastructure and culture approaches. Invisible blockchain rails, by definition, rely on intermediaries that users must trust. When Stripe converts stablecoin balances to fiat for Visa transactions, when BlackRock custodies Bitcoin on behalf of ETF holders, when Klarna issues blockchain-powered payments, the technology may be decentralised but the user experience is not. The cypherpunk vision of individuals controlling their own keys, verifying their own transactions, and resisting surveillance has been traded for convenience and scale.

The Cypherpunk Inheritance

To understand what is at stake requires revisiting cryptocurrency's ideological origins. Bitcoin was not born in a vacuum; it emerged from decades of cypherpunk research, debate, and experimentation. The movement's core creed was simple: do not ask permission, build the system. Do not lobby politicians for privacy laws; create technologies that make surveillance impossible. Every point of centralisation was understood as a point of weakness, a chokepoint where power could be exercised by states or corporations against individuals.

Satoshi Nakamoto's 2008 whitepaper directly reflected these principles. By combining cryptography, decentralised consensus, and economic incentives, Bitcoin solved the double-spending problem without requiring a central authority. The vision was censorship-resistant money that allowed individuals to transact privately and securely without permission from governments or corporations. Self-custody was not merely an option but the point. The option to be your own bank, to verify rather than trust, remained open to anyone willing to exercise it.

The cypherpunks were deeply suspicious of any centralised authority, whether government agency or large bank. They saw the fight for freedom in the digital age as a technical problem, not merely a political one. Privacy, decentralisation, self-sovereignty, transparency through open-source code: these were not just preferences but foundational principles. Any compromise on these fronts represented potential capture by the very systems they sought to escape.

The success and commercialisation of Bitcoin has fractured this inheritance. Some argue that compliance with Know Your Customer requirements, integration with regulated exchanges, and accommodation of institutional custody represents necessary compromise to bring cryptocurrency to the masses and achieve mainstream legitimacy. Without these accommodations, Bitcoin would remain a niche asset forever locked out of the global financial system.

For the purist camp, this represents betrayal. Building on-ramps that require identity verification creates a surveillance network around technology designed to be pseudonymous. It links real-world identity to on-chain transactions, destroying privacy. The crypto space itself struggles with centralisation through major exchanges, custodial wallets, and regulatory requirements that conflict with the original vision.

By 2025, Bitcoin's price exceeded $120,000, driven substantially by institutional adoption through ETFs and a maturing investor base. BlackRock's IBIT has accumulated holdings representing 3.8 percent of Bitcoin's total 21 million supply. This is not the distributed ownership pattern the cypherpunks envisioned. Power has concentrated in new hands, different from but not obviously preferable to the financial institutions cryptocurrency was designed to circumvent.

Decentralised Social and the Identity Layer

If invisible infrastructure represents one future and pure speculation another, decentralised social platforms represent an attempt at synthesis. Lens Protocol, launched by the team behind the DeFi lending platform Aave, provides a social graph enabling developers to build applications with composable, user-owned content. Running on Polygon, Lens offers creators direct monetisation through subscriptions, fees from followers, and the ability to turn posts into tradable NFTs. Top users on the protocol average $1,300 monthly in creator earnings, demonstrating that blockchain participation can generate real economic value beyond speculation.

The proposition is that social identity becomes inseparable from on-chain identity. Your follower graph, your content, your reputation travel with you across applications built on the same underlying protocol. When you switch from one Lens-based application to another, you bring your audience and history. No platform can deplatform you because no platform owns your identity. This is decentralisation as lived experience rather than backend abstraction.

Farcaster offers a complementary model focused on protocol-level innovation. Three smart contracts on OP Mainnet handle security-critical functions: IdRegistry maps Farcaster IDs to Ethereum custody addresses, StorageRegistry tracks storage allocations, and KeyRegistry manages application permissions. The infrastructure is explicitly on-chain, but the user experience has been refined to approach consumer-grade accessibility. Account abstraction and social logins mean new users can start with just an email address, reducing time to first transaction from twenty minutes to under sixty seconds.

The platform's technical architecture reflects deliberate choices about where blockchain visibility matters. Storage costs approximately seven dollars per year for 5,000 posts plus reactions and follows, low enough to be accessible but high enough to discourage spam. The identity layer remains explicitly on-chain, ensuring that users maintain control over their credentials even as the application layer becomes increasingly polished.

The engagement metrics suggest these approaches resonate with users who value explicit blockchain participation. Farcaster's engagement rate of 29 interactions per user monthly compares favourably to Lens's 12, indicating higher-quality community even with smaller absolute numbers. The platform recently achieved a milestone of 100,000 funded wallets, driven partly by USDC deposit matching rewards that incentivise users to connect their financial identity to their social presence.

Yet the scale gap with mainstream platforms remains vast. Bluesky's 38 million users dwarf Farcaster's half million. Twitter's daily active users number in the hundreds of millions. For crypto-native social platforms to represent a meaningful alternative rather than a niche experiment, they must grow by orders of magnitude while preserving the properties that differentiate them. The question is whether those properties are features or bugs in the context of mainstream adoption.

The Stablecoin Standardisation

Stablecoins offer the clearest lens on how the invisibility thesis is playing out in practice. The market has concentrated heavily around two issuers: Tether's USDT holds approximately 60 percent market share with a capitalisation exceeding $183 billion, while Circle's USDC holds roughly 25 percent at $73 billion. Together, these two tokens account for over 80 percent of total stablecoin market capitalisation, though that share has declined slightly as competition intensifies.

Tether dominates trading volume, accounting for over 75 percent of stablecoin activity on centralised exchanges. It remains the primary trading pair in emerging markets and maintains higher velocity on exchanges. But USDC has grown faster in 2025, with its market cap climbing 72 percent compared to USDT's 32 percent growth. Analysts attribute this to USDC's better positioning for regulated markets, particularly after USDT faced delistings in Europe due to lack of MiCA authorisation.

Circle's billion-dollar IPO marked the arrival of stablecoin issuers as mainstream financial institutions. The company's aggressive expansion into regulated markets positions USDC as the stablecoin of choice for banks, payment processors, and fintech platforms seeking compliance clarity. This is crypto becoming infrastructure in the most literal sense: a layer enabling transactions that end users never need to understand or acknowledge.

The overall stablecoin supply hit $314 billion in 2025, with the category now comprising 30 percent of all on-chain crypto transaction volume. August 2025 recorded the highest annual volume to date, reaching over $4 trillion for the year, an 83 percent increase on the same period in 2024. Tether alone saw $10 billion in profit in the first three quarters of the year. These are not metrics of a speculative sideshow but of core financial infrastructure.

The emergence of USD1, the stablecoin issued by World Liberty Financial with Trump family involvement, demonstrates how completely stablecoins have departed from crypto's countercultural origins. The token reached $3 billion in circulating supply within six months of launch, integrated with major exchanges including Binance and Tron. Its largest transaction to date, the $2 billion MGX investment in Binance, involved sovereign wealth funds, presidential family businesses, and what senators have alleged are suspicious ties to sanctioned entities. This is not disruption of financial power structures; it is their reconfiguration under blockchain labels.

The GENIUS Act's passage has accelerated this normalisation. By establishing clear regulatory frameworks, the legislation removes uncertainty that previously discouraged traditional financial institutions from engaging with stablecoins. But it also embeds stablecoins within the surveillance and compliance infrastructure that cryptocurrency was originally designed to escape. Issuers must implement anti-money laundering programmes, verify sanctions lists, and identify customers. The anonymous, permissionless transactions that defined early Bitcoin are not merely discouraged but legally prohibited for regulated stablecoin issuers.

The Tokenisation Transformation

Real-world asset tokenisation extends the invisibility thesis from currency into securities. BlackRock's BUIDL fund demonstrated that tokenised treasury assets could attract institutional capital at scale. By year-end 2025, the tokenised RWA market had grown to approximately $33 billion, with the majority concentrated in private credit and US Treasuries representing nearly 90 percent of tokenised value. The market has grown fivefold in two years, crossing from interesting experiment to systemic relevance.

The projections are staggering. A BCG-Ripple report forecasts the tokenised asset market growing from $0.6 trillion to $18.9 trillion by 2033. Animoca Brands research suggests tokenisation could eventually tap into the $400 trillion traditional finance market. Franklin Templeton, Fidelity, and other major asset managers have moved beyond pilots into production-level tokenisation of treasury products.

For institutional investors, the value proposition is efficiency: faster settlement, lower costs, continuous trading availability, fractional ownership. None of these benefits require understanding or caring about blockchain technology. The distributed ledger is simply superior infrastructure for recording ownership and executing transfers. It replaces databases, not ideologies.

This creates an interesting inversion of the original cryptocurrency value proposition. Bitcoin promised to separate money from state control. Tokenisation of real-world assets brings state-sanctioned securities onto blockchain rails, with all their existing regulatory requirements, reporting obligations, and institutional oversight intact. The technology serves traditional finance rather than replacing it.

Major financial institutions including JPMorgan, Goldman Sachs, and BNY Mellon are actively engaging in real-world asset tokenisation. Banks treat blockchain not as novelty but as infrastructure, part of the normal toolkit for financial services. Fintech companies supply connective logic between traditional systems and decentralised networks. Stablecoins, once regarded as a temporary bridge, now operate as permanent fixtures of the financial order.

The Dual Economy

What emerges from this analysis is not a single trajectory but a bifurcation. Two distinct crypto economies now operate in parallel, occasionally intersecting but fundamentally different in their relationship to culture, identity, and visibility.

The institutional economy treats blockchain as infrastructure. Its participants include BlackRock, Fidelity, Stripe, Visa, JPMorgan, and the growing ecosystem of regulated stablecoin issuers and tokenisation platforms. Value accrues through efficiency gains, cost reductions, and access to previously illiquid assets. Users of these products may never know they are interacting with blockchain technology. The culture is that of traditional finance: compliance-focused, institution-mediated, invisible.

The crypto-native economy treats blockchain as culture. Its participants include memecoin traders, decentralised social network users, DeFi power users, and communities organised around specific protocols and tokens. Value accrues through attention, community formation, and speculative conviction. Users of these products explicitly identify with blockchain participation, often displaying on-chain activity as markers of identity and affiliation. The culture is distinctively countercultural: permissionless, community-driven, visible.

DeFi total value locked surged 41 percent in Q3 2025, surpassing $160 billion for the first time since May 2022. Ethereum led growth with TVL jumping from $54 billion in July to $96.5 billion by September. Aave became the largest DeFi lending protocol with over $41 billion in TVL, growing nearly 58 percent since July. Lido ranked second with nearly $39 billion in liquid staking deposits. These are substantial numbers, demonstrating that crypto-native applications retain significant capital commitment even as institutional alternatives proliferate.

The question is whether these economies can coexist indefinitely or whether one will eventually absorb the other. The institutional thesis holds that crypto-native culture is a transitional phenomenon, the early-adopter enthusiasm that accompanies any new technology before it matures into invisible utility. By this view, memecoin speculation and decentralised social experiments are the equivalent of early internet flame wars and personal homepage culture: interesting historical artefacts that give way to professionally operated services as the technology scales.

The counter-thesis holds that crypto-native culture provides irreplaceable competitive advantages. Community formation around tokens creates user loyalty that traditional products cannot match. On-chain identity enables new forms of coordination, reputation, and governance. The transparency of blockchain operations enables trustlessness that opaque corporate structures cannot replicate. By this view, invisible infrastructure misses the point entirely, stripping away the properties that make cryptocurrency distinctive and valuable.

Evaluating Maturation

The debate ultimately hinges on what one considers maturation. If maturation means achieving mainstream adoption, measurable in transaction volumes, market capitalisation, and institutional participation, then the invisibility approach has clearly succeeded. Stablecoins rival Visa in volume. Bitcoin ETFs hold hundreds of billions in assets. Regulated tokenisation platforms are processing institutional-scale transactions. By these metrics, cryptocurrency has grown up.

But maturation can also mean the development of distinctive capabilities rather than assimilation into existing paradigms. By this measure, invisibility represents not maturation but abandonment. The technology that was supposed to disrupt financial intermediation has instead been adopted by intermediaries. The protocol designed to resist censorship integrates with surveillance systems. The culture celebrating individual sovereignty has been absorbed into institutional custody arrangements.

Vitalik Buterin's tests for decentralisation offer a framework for evaluating these competing claims. The walk-away test asks whether users keep their assets if the company behind an application disappears. For BlackRock ETF holders, the answer is clearly no; they hold shares in a fund that custodies assets on their behalf. For self-custody Bitcoin holders, the answer is yes by design. The insider attack test asks how much damage rogue insiders or compromised front-ends can cause. Invisible infrastructure necessarily involves more trusted intermediaries and therefore more potential attack surfaces.

The trusted computing base question asks how many lines of code must be trusted to protect users. Institutional products layer complexity upon complexity: custody arrangements, trading interfaces, fund structures, regulatory compliance systems. Each layer requires trust. The original Bitcoin thesis was that you needed to trust only the protocol itself, verifiable through open-source code and distributed consensus.

Yet crypto-native applications are not immune from these concerns. DeFi protocols have suffered billions in losses through exploits, rug pulls, and governance attacks. Memecoin platforms like Pump.fun face class-action lawsuits alleging manipulation. Decentralised social networks struggle with spam, harassment, and content moderation challenges that their permissionless architecture makes difficult to address. The choice is not between trustless perfection and trusted compromise but between different configurations of trust, risk, and capability.

The Cultural Residue

Perhaps the most honest assessment is that crypto culture will persist as aesthetic residue even as the technology becomes invisible infrastructure. Early-adopter communities will continue to celebrate on-chain participation as identity markers, much as vintage computing enthusiasts celebrate command-line interfaces in an era of graphical operating systems. The technical capability for self-custody and trustless verification will remain available to those who value it, even as the overwhelming majority of users interact through intermediated products that abstract away complexity.

This is not necessarily a tragedy. Other technologies have followed similar trajectories. The internet began as a countercultural space where early adopters celebrated decentralisation and resisted commercialisation. Today, most users access the internet through devices and services controlled by a handful of corporations, but the underlying protocols remain open and the option for direct participation persists for those motivated to exercise it.

The question is whether this residual option matters. If only a tiny fraction of users ever exercise self-custody or participate in decentralised governance, does the theoretical availability of these options provide meaningful protection against centralised control? Or does the concentration of practical usage in institutional channels create the same capture risks that cryptocurrency was designed to prevent?

The $2 billion stablecoin transaction from MGX to Binance suggests an answer that satisfies neither purists nor institutionalists. The technology worked exactly as designed: value transferred across borders instantly and irrevocably, settled on a distributed ledger that neither party needed to understand. But the participants were sovereign wealth funds and exchange conglomerates, the transaction enabled by presidential family connections, and the regulatory framework that of traditional anti-money laundering compliance. This is not what the cypherpunks imagined, but it is what cryptocurrency has become.

Whether that represents maturation or abandonment depends entirely on what one hoped cryptocurrency would achieve. If the goal was efficient global payments infrastructure, the invisible approach has delivered. If the goal was liberation from institutional financial control, the invisible approach has failed precisely by succeeding. The technology escaped the sandbox of speculation and entered the real world, but the real world captured it in return.

The builders who will succeed in this environment are likely those who understand both economies and can navigate between them. Stripe's acquisition of Bridge demonstrates that institutional players recognise the value of crypto infrastructure even when stripped of cultural signifiers. Pump.fun's billion-dollar raise demonstrates that crypto-native culture retains genuine economic value even when disconnected from institutional approval. The most durable projects may be those that maintain optionality: invisible enough to achieve mainstream adoption, crypto-native enough to retain community loyalty, flexible enough to serve users with radically different relationships to the underlying technology.

The original vision has not been abandoned so much as refracted. It persists in self-custody options that most users ignore, in decentralised protocols that institutions build upon, in cultural communities that thrive in parallel with institutional rails. Cryptocurrency did not mature into a single thing. It matured into multiple things simultaneously, serving different purposes for different participants, with different relationships to the values that animated its creation.

Whether the cultural layer remains competitive advantage or becomes mere nostalgia will be determined not by technology but by the choices users make about what they value. If convenience consistently trumps sovereignty, the invisible approach will dominate and crypto culture will become historical curiosity. If enough users continue to prioritise decentralisation, self-custody, and explicit blockchain participation, the cultural layer will persist as more than aesthetic. The technology enables both futures. The question is which one we will choose.

---

References and Sources

1. a16z crypto. “State of Crypto 2025: The year crypto went mainstream.” October 2025. https://a16zcrypto.com/posts/article/state-of-crypto-report-2025/

2. Re7 Capital. “The Future of Crypto is Social.” https://re7.capital/blog/the-future-of-crypto-is-social/

3. The Block. “Re7 Capital bets on SocialFi with a $10 million fund targeting around 30 startups.” 2025. https://www.theblock.co/post/352562/re7-capital-socialfi-fund-crypto

4. CNBC. “Stripe closes $1.1 billion Bridge deal, prepares for aggressive stablecoin push.” February 2025. https://www.cnbc.com/2025/02/04/stripe-closes-1point1-billion-bridge-deal-prepares-for-stablecoin-push-.html

5. Stripe Newsroom. “Introducing Stablecoin Financial Accounts in 101 countries.” 2025. https://stripe.com/blog/introducing-stablecoin-financial-accounts

6. The White House. “Fact Sheet: President Donald J. Trump Signs GENIUS Act into Law.” July 2025. https://www.whitehouse.gov/fact-sheets/2025/07/fact-sheet-president-donald-j-trump-signs-genius-act-into-law/

7. Morgan Lewis. “GENIUS Act Passes in US Congress: A Breakdown of the Landmark Stablecoin Law.” July 2025. https://www.morganlewis.com/pubs/2025/07/genius-act-passes-in-us-congress-a-breakdown-of-the-landmark-stablecoin-law

8. Business Wire. “World Liberty Financial's Stablecoin $USD1 Crosses $3 Billion in Market Capitalization.” December 2025. https://www.businesswire.com/news/home/20251225249806/en/World-Liberty-Financials-Stablecoin-USD1-Crosses-3-Billion-in-Market-Capitalization

9. CNBC. “Trump's World Liberty Financial jumps into stablecoin game with USD1 reveal.” March 2025. https://www.cnbc.com/2025/03/25/trumps-world-liberty-financial-jumps-into-stablecoin-game-with-usd1-reveal.html

10. The Block. “BlackRock's bitcoin ETF surpasses 800,000 BTC in assets under management after $4 billion inflow streak.” 2025. https://www.theblock.co/post/373966/blackrock-bitcoin-etf-ibit-800000-btc-aum

11. CoinDesk. “RWA Tokenization Is Going to Trillions Much Faster Than You Think.” February 2025. https://www.coindesk.com/opinion/2025/02/07/rwa-tokenization-is-going-to-trillions-much-faster-than-you-think

12. The Block. “Pump.fun surpasses $800 million in lifetime revenue as Solana memecoin launchpad competition heats up.” 2025. https://www.theblock.co/post/367585/pump-fun-surpasses-800-million-in-lifetime-revenue-as-solana-memecoin-launchpad-competition-heats-up

13. CoinDesk. “Vitalik Buterin: Ethereum at Risk If Decentralization Is Just a Catchphrase.” July 2025. https://www.coindesk.com/tech/2025/07/02/vitalik-buterin-ethereum-at-risk-if-decentralization-is-just-a-catchphrase

14. CryptoSlate. “10 stories that rewired digital finance in 2025 – the year crypto became infrastructure.” 2025. https://cryptoslate.com/10-stories-that-rewired-digital-finance-in-2025-the-year-crypto-became-infrastructure/

15. BlockEden. “Farcaster in 2025: The Protocol Paradox.” October 2025. https://blockeden.xyz/blog/2025/10/28/farcaster-in-2025-the-protocol-paradox/

16. Crystal Intelligence. “USDT vs USDC Q3 2025: Market Share & Dominance Analysis.” 2025. https://crystalintelligence.com/thought-leadership/usdt-maintains-dominance-while-usdc-faces-headwinds/

17. CoinDesk. “Tether and Circle's Dominance Is Being Put to the Test.” October 2025. https://www.coindesk.com/opinion/2025/10/11/tether-and-circle-s-dominance-is-being-put-to-the-test

18. The Defiant. “DeFi TVL Surges 41% in Q3 to Three-Year High.” 2025. https://thedefiant.io/news/defi/defi-tvl-surges-41-in-q3-to-three-year-high

19. PYMNTS. “Making Sense of Meme Coins, Digital Assets and Crypto's Future.” 2025. https://www.pymnts.com/cryptocurrency/2025/making-sense-meme-coins-digital-assets-crypto-future/

20. D-Central. “Bitcoin and the Cypherpunks – A Journey Towards Decentralisation and Privacy.” https://d-central.tech/bitcoin-and-the-cypherpunks/

21. World Economic Forum. “How will the GENIUS Act work in the US and impact the world?” July 2025. https://www.weforum.org/stories/2025/07/stablecoin-regulation-genius-act/

22. Andreessen Horowitz. “What Stripe's Acquisition of Bridge Means for Fintech and Stablecoins.” April 2025. https://a16z.com/newsletter/what-stripes-acquisition-of-bridge-means-for-fintech-and-stablecoins-april-2025-fintech-newsletter/

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

In November 2025, Grammy-winning artist Victoria Monet sat for an interview with Vanity Fair and confronted something unprecedented in her fifteen-year career. Not a rival artist. Not a legal dispute over songwriting credits. Instead, she faced an algorithmic apparition: an AI-generated persona called Xania Monet, whose name, appearance, and vocal style bore an uncanny resemblance to her own. “It's hard to comprehend that, within a prompt, my name was not used for this artist to capitalise on,” Monet told the magazine. “I don't support that. I don't think that's fair.”

The emergence of Xania Monet, who secured a $3 million deal with Hallwood Media and became the first AI artist to debut on a Billboard radio chart, represents far more than a curiosity of technological progress. It exposes fundamental inadequacies in how intellectual property law conceives of artistic identity, and it reveals the emergence of business models specifically designed to exploit zones of legal ambiguity around voice, style, and likeness. The question is no longer whether AI can approximate human creativity. The question is what happens when that approximation becomes indistinguishable enough to extract commercial value from an artist's foundational assets while maintaining plausible deniability about having done so.

The controversy arrives at a moment when the music industry is already grappling with existential questions about AI. Major record labels have filed landmark lawsuits against AI music platforms. European courts have issued rulings that challenge the foundations of how AI companies operate. Congress is debating legislation that would create the first federal right of publicity in American history. And streaming platforms face mounting evidence that AI-generated content is flooding their catalogues, diluting the royalty pool that sustains human artists. Xania Monet sits at the intersection of all these forces, a test case for whether our existing frameworks can protect artistic identity in an age of sophisticated machine learning.

The Anatomy of Approximation

Victoria Monet's concern centres on something that existing copyright law struggles to address: the space between direct copying and inspired derivation. Copyright protects specific expressions of ideas, not the ideas themselves. It cannot protect a vocal timbre, a stylistic approach to melody, or the ineffable quality that makes an artist recognisable across their catalogue. You can copyright a particular song, but you cannot copyright the essence of how Victoria Monet sounds.

This legal gap has always existed, but it mattered less when imitation required human effort and inevitably produced human variation. A singer influenced by Monet would naturally develop their own interpretations, their own quirks, their own identity over time. But generative AI systems can analyse thousands of hours of an artist's work and produce outputs that capture stylistic fingerprints with unprecedented fidelity. The approximation can be close enough to trigger audience recognition without being close enough to constitute legal infringement.

The technical process behind this approximation involves training neural networks on vast corpora of existing music. These systems learn to recognise patterns across multiple dimensions simultaneously: harmonic progressions, rhythmic structures, timbral characteristics, production techniques, and vocal stylings. The resulting model does not store copies of the training data in any conventional sense. Instead, it encodes statistical relationships that allow it to generate new outputs exhibiting similar characteristics. This architecture creates a genuine conceptual challenge for intellectual property frameworks designed around the notion of copying specific works.

Xania Monet exemplifies this phenomenon. The vocals and instrumental music released under her name are created using Suno, the AI music generation platform. The lyrics come from Mississippi poet and designer Telisha Jones, who serves as the creative force behind the virtual persona. But the sonic character, the R&B vocal stylings, the melodic sensibilities that drew comparisons to Victoria Monet, emerge from an AI system trained on vast quantities of existing music. In an interview with Gayle King, Jones defended her creative role, describing Xania Monet as “an extension of myself” and framing AI as simply “a tool, an instrument” to be utilised.

Victoria Monet described a telling experiment: a friend typed the prompt “Victoria Monet making tacos” into ChatGPT's image generator, and the system produced visuals that looked uncannily similar to Xania Monet's promotional imagery. Whether this reflects direct training on Victoria Monet's work or the emergence of stylistic patterns from broader R&B training data, the practical effect remains the same. An artist's distinctive identity becomes raw material for generating commercial competitors.

The precedent for this kind of AI-mediated imitation emerged dramatically in April 2023, when a song called “Heart on My Sleeve” appeared on streaming platforms. Created by an anonymous producer using the pseudonym Ghostwriter977, the track featured AI-generated vocals designed to sound like Drake and the Weeknd. Neither artist had any involvement in its creation. Universal Music Group quickly filed takedown notices citing copyright violation, but the song had already gone viral, demonstrating how convincingly AI could approximate celebrity vocal identities. Ghostwriter later revealed that the actual composition was entirely human-created, with only the vocal filters being AI-generated. The Recording Academy initially considered the track for Grammy eligibility before determining that the AI voice modelling made it ineligible.

The Training Data Black Box

At the heart of these concerns lies a fundamental opacity: the companies building generative AI systems have largely refused to disclose what training data their models consumed. This deliberate obscurity creates a structural advantage. When provenance cannot be verified, liability becomes nearly impossible to establish. When the creative lineage of an AI output remains hidden, artists cannot prove that their work contributed to the system producing outputs that compete with them.

The major record labels, Universal Music Group, Sony Music Entertainment, and Warner Music Group, recognised this threat early. In June 2024, they filed landmark lawsuits against Suno and Udio, the two leading AI music generation platforms, accusing them of “willful copyright infringement at an almost unimaginable scale.” The Recording Industry Association of America alleged that Udio's system had produced outputs with striking similarities to specific protected recordings, including songs by Michael Jackson, the Beach Boys, ABBA, and Mariah Carey. The lawsuits sought damages of up to $150,000 per infringed recording, potentially amounting to hundreds of millions of dollars.

Suno's defence hinged on a revealing argument. CEO Mikey Shulman acknowledged that the company trains on copyrighted music, stating, “We train our models on medium- and high-quality music we can find on the open internet. Much of the open internet indeed contains copyrighted materials.” But he argued this constitutes fair use, comparing it to “a kid writing their own rock songs after listening to the genre.” In subsequent legal filings, Suno claimed that none of the millions of tracks generated on its platform “contain anything like a sample” of existing recordings.

This argument attempts to draw a bright line between the training process and the outputs it produces. Even if the model learned from copyrighted works, Suno contends, the music it generates represents entirely new creations. The analogy to human learning, however, obscures a crucial difference: when humans learn from existing music, they cannot perfectly replicate the statistical patterns of that music's acoustic characteristics. AI systems can. And the scale differs by orders of magnitude. A human musician might absorb influences from hundreds or thousands of songs over a lifetime. An AI system can process millions of tracks and encode their patterns with mathematical precision.

The United States Copyright Office weighed in on this debate with a 108-page report published in May 2025, concluding that using copyrighted materials to train AI models may constitute prima facie infringement and warning that transformative arguments are not inherently valid. Where AI-generated outputs demonstrate substantial similarity to training data inputs, the report suggested, the model weights themselves may infringe reproduction and derivative work rights. The report also noted that the transformative use doctrine was never intended to permit wholesale appropriation of creative works for commercial AI development.

Separately, the Copyright Office had addressed the question of AI authorship. In a January 2025 decision, the office stated that AI-generated work can receive copyright protection “when and if it embodies meaningful human authorship.” This creates an interesting dynamic: the outputs of AI music generation may be copyrightable by the humans who shaped them, even as the training process that made those outputs possible may itself constitute infringement of others' copyrights.

The Personality Protection Gap

The Xania Monet controversy illuminates why copyright law alone cannot protect artists in the age of generative AI. Even if the major label lawsuits succeed in establishing that AI companies must license training data, this would not necessarily protect individual artists from having their identities approximated.

Consider what Victoria Monet actually lost in this situation. The AI persona did not copy any specific song she recorded. It did not sample her vocals. What it captured, or appeared to capture, was something more fundamental: the quality of her artistic presence, the characteristics that make audiences recognise her work. This touches on what legal scholars call the right of publicity, the right to control commercial use of one's name, image, and likeness.

But here the legal landscape becomes fragmented and inadequate. In the United States, there is no federal right of publicity law. Protection varies dramatically by state, with around 30 states providing statutory rights and others relying on common law protections. All 50 states recognise some form of common law rights against unauthorised use of a person's name, image, or likeness, but the scope and enforceability of these protections differ substantially across jurisdictions.

Tennessee's ELVIS Act, which took effect on 1 July 2024, became the first state legislation specifically designed to protect musicians from unauthorised AI replication of their voices. Named in tribute to Elvis Presley, whose estate had litigated to control his posthumous image rights, the law explicitly includes voice as protected property, defining it to encompass both actual voice and AI-generated simulations. The legislation passed unanimously in both chambers of the Tennessee legislature, with 93 ayes in the House and 30 in the Senate, reflecting bipartisan recognition of the threat AI poses to the state's music industry.

Notably, the ELVIS Act contains provisions targeting not just those who create deepfakes without authorisation but also the providers of the systems used to create them. The law allows lawsuits against any person who “makes available an algorithm, software, tool, or other technology, service, or device” whose “primary purpose or function” is creating unauthorised voice recordings. This represents a significant expansion of liability that could potentially reach AI platform developers themselves.

California followed with its own protective measures. In September 2024, Governor Gavin Newsom signed AB 2602, which requires contracts specifying the use of AI-generated digital replicas of a performer's voice or likeness to include specific consent and professional representation during negotiations. The law defines a “digital replica” as a “computer-generated, highly realistic electronic representation that is readily identifiable as the voice or visual likeness of an individual.” AB 1836 prohibits creating or distributing digital replicas of deceased personalities without permission from their estates, extending these protections beyond the performer's lifetime.

Yet these state-level protections remain geographically limited and inconsistently applied. An AI artist created using platforms based outside these jurisdictions, distributed through global streaming services, and promoted through international digital channels exists in a regulatory grey zone. The Copyright Office's July 2024 report on digital replicas concluded there was an urgent need for federal right of publicity legislation protecting all people from unauthorised use of their likeness and voice, noting that the current patchwork of state laws creates “gaps and inconsistencies” that are “far too inconsistent to remedy generative AI commercial appropriation.”

The NO FAKES Act, first introduced in Congress in July 2024 by a bipartisan group of senators including Chris Coons, Marsha Blackburn, Amy Klobuchar, and Thom Tillis, represents the most comprehensive attempt to address this gap at the federal level. The legislation would establish the first federal right of publicity in the United States, providing a national standard to protect creators' likenesses from unauthorised use while allowing control over digital personas for 70 years after death. The reintroduction in April 2025 gained support from an unusual coalition including major record labels, SAG-AFTRA, Google, and OpenAI. Country music artist Randy Travis, whose voice was digitally recreated using AI after a stroke left him unable to sing, appeared at the legislation's relaunch.

But even comprehensive right of publicity protection faces a fundamental challenge: proving that a particular AI persona was specifically created to exploit another artist's identity. Xania Monet's creators have not acknowledged any intention to capitalise on Victoria Monet's identity. The similarity in names could be coincidental. The stylistic resemblances could emerge organically from training on R&B music generally. Without transparency about training data composition, artists face the impossible task of proving a negative.

The Business Logic of Ambiguity

What makes the Xania Monet case particularly significant is what it reveals about emerging business models in AI music. This is not an accidental byproduct of technological progress. It represents a deliberate commercial strategy that exploits the gap between what AI can approximate and what law can protect.

Hallwood Media, the company that signed Xania Monet to her $3 million deal, is led by Neil Jacobson, formerly president of Geffen Records. Hallwood operates as a multi-faceted music company servicing talent through recording, management, publishing, distribution, and merchandising divisions. The company had already invested in Suno and, in July 2025, signed imoliver, described as the top-streaming “music designer” on Suno, in what was billed as the first traditional label signing of an AI music creator. Jacobson positioned these moves as embracing innovation, stating that imoliver “represents the future of our medium. He's a music designer who stands at the intersection of craftwork and taste.”

The distinction between imoliver and Xania Monet is worth noting. Hallwood describes imoliver as a real human creator who uses AI tools, whereas Xania Monet is presented as a virtual artist persona. But in both cases, the commercial model extracts value from AI's ability to generate music at scale with reduced human labour costs.

The economics are straightforward. An AI artist requires no rest, no touring support, no advance payments against future royalties, no management of interpersonal conflicts or creative disagreements. Victoria Monet herself articulated this asymmetry: “It definitely puts creators in a dangerous spot because our time is more finite. We have to rest at night. So, the eight hours, nine hours that we're resting, an AI artist could potentially still be running, studying, and creating songs like a machine.”

Xania Monet's commercial success demonstrates the model's viability. Her song “How Was I Supposed to Know” reached number one on R&B Digital Song Sales and number three on R&B/Hip-Hop Digital Song Sales. Her catalogue accumulated 9.8 million on-demand streams in the United States, with 5.4 million coming in a single tracking week. She became the first AI artist to debut on a Billboard radio chart, entering the Adult R&B Airplay chart at number 30. Her song “Let Go, Let God” debuted at number 21 on Hot Gospel Songs.

For investors and labels, this represents an opportunity to capture streaming revenue without many of the costs associated with human artists. For human artists, it represents an existential threat: the possibility that their own stylistic innovations could be extracted, aggregated, and turned against them in the form of competitors who never tire, never renegotiate contracts, and never demand creative control. The music industry has long relied on finding and developing talent, but AI offers a shortcut that could fundamentally alter how value is created and distributed.

The Industry Response and Its Limits

Human artists have pushed back against AI music with remarkable consistency across genres and career levels. Kehlani took to TikTok to express her frustration about Xania Monet's deal, stating, “There is an AI R&B artist who just signed a multi-million-dollar deal, and has a Top 5 R&B album, and the person is doing none of the work.” She declared that “nothing and no one on Earth will ever be able to justify AI to me.”

SZA expressed environmental and ethical concerns, posting on Instagram that AI technology causes “harm” to marginalised neighbourhoods and asking fans not to create AI images or songs using her likeness. Baby Tate criticised Xania Monet's creator for lacking creativity and authenticity in her music process. Muni Long questioned why AI artists appeared to be gaining acceptance in R&B specifically, asking, “It wouldn't be allowed to happen in country or pop.” She also noted that Xania Monet's Apple Music biography listed her, Keyshia Cole, and K. Michelle as references, adding, “I'm not happy about it at all. Zero percent.”

Beyonce reportedly expressed fear after hearing an AI version of her own voice, highlighting how even artists at the highest commercial tier feel vulnerable to this technology.

This criticism highlights an uncomfortable pattern: the AI music entities gaining commercial traction have disproportionately drawn comparisons to Black R&B artists. Whether this reflects biases in training data composition, market targeting decisions, or coincidental emergence, the effect raises questions about which artistic communities bear the greatest risks from AI appropriation. The history of American popular music includes numerous examples of Black musical innovations being appropriated by white artists and industry figures. AI potentially automates and accelerates this dynamic.

The creator behind Xania Monet has not remained silent. In December 2025, the AI artist released a track titled “Say My Name With Respect,” which directly addressed critics including Kehlani. While the song does not mention Kehlani by name, the accompanying video displayed screenshots of her previous statements about AI alongside comments from other detractors.

The major labels' lawsuits against Suno and Udio remain ongoing, though Universal Music Group announced in 2025 that it had settled with Udio and struck a licensing deal, following similar action by Warner Music Group. These settlements suggest that large rights holders may secure compensation and control over how their catalogues are used in AI training. But individual artists, particularly those not signed to major labels, may find themselves excluded from whatever protections these arrangements provide.

The European Precedent

While American litigation proceeds through discovery and motions, Europe has produced the first major judicial ruling holding an AI developer liable for copyright infringement related to training. On 11 November 2025, the Munich Regional Court ruled largely in favour of GEMA, the German collecting society representing songwriters, in its lawsuit against OpenAI.

The case centred on nine songs whose lyrics ChatGPT could reproduce almost verbatim in response to simple user prompts. The songs at issue included well-known German tracks such as “Atemlos” and “Wie schon, dass du geboren bist.” The court accepted GEMA's argument that training data becomes embedded in model weights and remains retrievable, a phenomenon researchers call “memorisation.” Even a 15-word passage was sufficient to establish infringement, the court found, because such specific text would not realistically be generated from scratch.

Crucially, the court rejected OpenAI's attempt to benefit from text and data mining exceptions applicable to non-profit research. OpenAI argued that while some of its legal entities pursue commercial objectives, the parent company was founded as a non-profit. Presiding Judge Dr Elke Schwager dismissed this argument, stating that to qualify for research exemptions, OpenAI would need to prove it reinvests 100 percent of profits in research and development or operates with a governmentally recognised public interest mandate.

The ruling ordered OpenAI to cease storing unlicensed German lyrics on infrastructure in Germany, provide information about the scope of use and related revenues, and pay damages. The court also ordered that the judgment be published in a local newspaper. Finding that OpenAI had acted with at minimum negligence, the court denied the company a grace period for making the necessary changes. OpenAI announced plans to appeal, and the judgment may ultimately reach the Court of Justice of the European Union. But as the first major European decision holding an AI developer liable for training on protected works, it establishes a significant precedent.

GEMA is pursuing parallel action against Suno in another lawsuit, with a hearing expected before the Munich Regional Court in January 2026. If European courts continue to reject fair use-style arguments for AI training, companies may face a choice between licensing music rights or blocking access from EU jurisdictions entirely.

The Royalty Dilution Problem

Beyond the question of training data rights lies another structural threat to human artists: the dilution of streaming royalties by AI-generated content flooding platforms. Streaming services operate on pro-rata payment models where subscription revenue enters a shared pool divided according to total streams. When more content enters the system, the per-stream value for all creators decreases.

In April 2025, streaming platform Deezer estimated that 18 percent of content uploaded daily, approximately 20,000 tracks, is AI-generated. This influx of low-cost content competes for the same finite pool of listener attention and royalty payments that sustains human artists. In 2024, Spotify alone paid out $10 billion to the music industry, with independent artists and labels collectively generating more than $5 billion from the platform. But this revenue gets divided among an ever-expanding universe of content, much of it now machine-generated.

The problem extends beyond legitimate AI music releases to outright fraud. In a notable case, musician Michael Smith allegedly extracted more than $10 million in royalty payments by uploading hundreds of thousands of AI-generated songs and using bots to artificially inflate play counts. According to fraud detection firm Beatdapp, streaming fraud removes approximately $1 billion annually from the royalty pool.

A global study commissioned by CISAC, the international confederation representing over 5 million creators, projected that while generative AI providers will experience dramatic revenue growth, music creators will see approximately 24 percent of their revenues at risk of loss by 2028. Audiovisual creators face a similar 21 percent risk. This represents a fundamental redistribution of value from human creators to technology platforms, enabled by the same legal ambiguities that allow AI personas to approximate existing artists without liability.

The market for AI in music is expanding rapidly. Global AI in music was valued at $2.9 billion in 2024, with projections suggesting growth to $38.7 billion by 2033 at a compound annual growth rate of 25.8 percent. Musicians are increasingly adopting the technology, with approximately 60 percent utilising AI tools in their projects and 36.8 percent of producers integrating AI into their workflows. But this adoption occurs in the context of profound uncertainty about how AI integration will affect long-term career viability.

The Question of Disclosure

Victoria Monet proposed a simple reform that might partially address these concerns: requiring clear labelling of AI-generated music, similar to how food products must disclose their ingredients. “I think AI music, as it is released, needs to be disclosed more,” she told Vanity Fair. “Like on food, we have labels for organic and artificial so that we can make an informed decision about what we consume.”

This transparency principle has gained traction among legislators. In April 2024, California Representative Adam Schiff introduced the Generative AI Copyright Disclosure Act, which would require AI firms to notify the Copyright Office of copyrighted works used in training at least 30 days before publicly releasing a model. Though the bill did not become law, it reflected growing consensus that the opacity of training data represents a policy problem requiring regulatory intervention.

The music industry's lobbying priorities have coalesced around three demands: permission, payment, and transparency. Rights holders want AI companies to seek permission before training on copyrighted music. They want to be paid for such use through licensing deals. And they want transparency about what data sets models actually use, without which the first two demands cannot be verified or enforced.

But disclosure requirements face practical challenges. How does one audit training data composition at scale? How does one verify that an AI system was not trained on particular artists when the systems themselves may not retain explicit records of their training data? The technical architecture of neural networks does not readily reveal which inputs influenced which outputs. Proving that Victoria Monet's recordings contributed to Xania Monet's stylistic character may be technically impossible even with full disclosure of training sets.

Redefining Artistic Value

Perhaps the most profound question raised by AI music personas is not legal but cultural: what do we value about human artistic creation, and can those values survive technological displacement?

Human music carries meanings that transcend sonic characteristics. When Victoria Monet won three Grammy Awards in 2024, including Best New Artist after fifteen years of working primarily as a songwriter for other performers, that recognition reflected not just the quality of her album Jaguar II but her personal journey, her persistence through years when labels declined to spotlight her, her evolution from writing hits for Ariana Grande to commanding her own audience. “This award was a 15-year pursuit,” she said during her acceptance speech. Her work with Ariana Grande had already earned her three Grammy nominations in 2019, including for Album of the Year for Thank U, Next, but her own artistic identity had taken longer to establish. These biographical dimensions inform how listeners relate to her work.

An AI persona has no such biography. Xania Monet cannot discuss the personal experiences that shaped her lyrics because those lyrics emerge from prompts written by Telisha Jones and processed through algorithmic systems. The emotional resonance of human music often derives from audiences knowing that another human experienced something and chose to express it musically. Can AI-generated music provide equivalent emotional value, or does it offer only a simulation of feeling, convincing enough to capture streams but hollow at its core?

The market appears agnostic on this question, at least in the aggregate. Xania Monet's streaming numbers suggest that significant audiences either do not know or do not care that her music is AI-generated. This consumer indifference may represent the greatest long-term threat to human artists: not that AI music will be legally prohibited, but that it will become commercially indistinguishable from human music in ways that erode the premium audiences currently place on human creativity.

Navigating Forward Without a Map

The emergence of AI personas that approximate existing artists reveals that our legal and cultural frameworks for artistic identity were built for a world that no longer exists. Copyright law assumed that copying required access to specific works and that derivation would be obvious. Right of publicity law assumed that commercial exploitation of identity would involve clearly identifiable appropriation. The economics of music assumed that creating quality content would always require human labour that commands payment.

Each of these assumptions has been destabilised by generative AI systems that can extract stylistic essences without copying specific works, create virtual identities that approximate real artists without explicit acknowledgment, and produce unlimited content at marginal costs approaching zero.

The solutions being proposed represent necessary but insufficient responses. Federal right of publicity legislation, mandatory training data disclosure, international copyright treaty updates, and licensing frameworks for AI training may constrain the most egregious forms of exploitation while leaving the fundamental dynamic intact: AI systems can transform human creativity into training data, extract commercially valuable patterns, and generate outputs that compete with human artists in ways that existing law struggles to address.

Victoria Monet's experience with Xania Monet may become the template for a new category of artistic grievance: the sense of being approximated, of having one's creative identity absorbed into a system and reconstituted as competition. Whether law and culture can evolve quickly enough to protect against this form of extraction remains uncertain. What is certain is that the question can no longer be avoided. The ghost has emerged from the machine, and it wears a familiar face.

---

References and Sources

1. Face2Face Africa. “Victoria Monet criticizes AI artist Xania Monet, suggests it may have been created using her likeness.” https://face2faceafrica.com/article/victoria-monet-criticizes-ai-artist-xania-monet-suggests-it-may-have-been-created-using-her-likeness

2. TheGrio. “Victoria Monet sounds the alarm on Xania Monet: 'I don't support that. I don't think that's fair.'” https://thegrio.com/2025/11/18/victoria-monet-reacts-to-xania-monet/

3. Billboard. “AI Music Artist Xania Monet Signs Multimillion-Dollar Record Deal.” https://www.billboard.com/pro/ai-music-artist-xania-monet-multimillion-dollar-record-deal/

4. Boardroom. “Xania Monet's $3 Million Record Deal Sparks AI Music Debate.” https://boardroom.tv/xania-monet-ai-music-play-by-play/

5. Music Ally. “Hallwood Media sees chart success with AI artist Xania Monet.” https://musically.com/2025/09/18/hallwood-media-sees-chart-success-with-ai-artist-xania-monet/

6. RIAA. “Record Companies Bring Landmark Cases for Responsible AI Against Suno and Udio.” https://www.riaa.com/record-companies-bring-landmark-cases-for-responsible-ai-againstsuno-and-udio-in-boston-and-new-york-federal-courts-respectively/

7. Rolling Stone. “RIAA Sues AI Music Generators For Copyright Infringement.” https://www.rollingstone.com/music/music-news/record-labels-sue-music-generators-suno-and-udio-1235042056/

8. TechCrunch. “AI music startup Suno claims training model on copyrighted music is 'fair use.'” https://techcrunch.com/2024/08/01/ai-music-startup-suno-response-riaa-lawsuit/

9. Skadden. “Copyright Office Weighs In on AI Training and Fair Use.” https://www.skadden.com/insights/publications/2025/05/copyright-office-report

10. U.S. Copyright Office. “Copyright and Artificial Intelligence.” https://www.copyright.gov/ai/

11. Wikipedia. “ELVIS Act.” https://en.wikipedia.org/wiki/ELVIS_Act

12. Tennessee Governor's Office. “Tennessee First in the Nation to Address AI Impact on Music Industry.” https://www.tn.gov/governor/news/2024/1/10/tennessee-first-in-the-nation-to-address-ai-impact-on-music-industry.html

13. ASCAP. “ELVIS Act Signed Into Law in Tennessee To Protect Music Creators from AI Impersonation.” https://www.ascap.com/news-events/articles/2024/03/elvis-act-tn

14. California Governor's Office. “Governor Newsom signs bills to protect digital likeness of performers.” https://www.gov.ca.gov/2024/09/17/governor-newsom-signs-bills-to-protect-digital-likeness-of-performers/

15. Manatt, Phelps & Phillips. “California Enacts a Suite of New AI and Digital Replica Laws.” https://www.manatt.com/insights/newsletters/client-alert/california-enacts-a-host-of-new-ai-and-digital-rep

16. Congress.gov. “NO FAKES Act of 2025.” https://www.congress.gov/bill/119th-congress/house-bill/2794/text

17. Billboard. “NO FAKES Act Returns to Congress With Support From YouTube, OpenAI for AI Deepfake Bill.” https://www.billboard.com/pro/no-fakes-act-reintroduced-congress-support-ai-deepfake-bill/

18. Hollywood Reporter. “Hallwood Media Signs Record Deal With an 'AI Music Designer.'” https://www.hollywoodreporter.com/music/music-industry-news/hallwood-inks-record-deal-ai-music-designer-imoliver-1236328964/

19. Billboard. “Hallwood Signs 'AI Music Designer' imoliver to Record Deal, a First for the Music Business.” https://www.billboard.com/pro/ai-music-creator-imoliver-record-deal-hallwood/

20. Complex. “Kehlani Blasts AI Musician's $3 Million Record Deal.” https://www.complex.com/music/a/jadegomez510/kehlani-xenia-monet-ai

21. Billboard. “Kehlani Slams AI Artist Xania Monet Over $3 Million Record Deal Offer.” https://www.billboard.com/music/music-news/kehlani-slams-ai-artist-xania-monet-million-record-deal-1236071158/

22. Rap-Up. “Baby Tate & Muni Long Push Back Against AI Artist Xania Monet.” https://www.rap-up.com/article/baby-tate-muni-long-xania-monet-ai-artist-backlash

23. Bird & Bird. “Landmark ruling of the Munich Regional Court (GEMA v OpenAI) on copyright and AI training.” https://www.twobirds.com/en/insights/2025/landmark-ruling-of-the-munich-regional-court-(gema-v-openai)-on-copyright-and-ai-training

24. Billboard. “German Court Rules OpenAI Infringed Song Lyrics in Europe's First Major AI Music Ruling.” https://www.billboard.com/pro/gema-ai-music-copyright-case-open-ai-chatgpt-song-lyrics/

25. Norton Rose Fulbright. “Germany delivers landmark copyright ruling against OpenAI: What it means for AI and IP.” https://www.nortonrosefulbright.com/en/knowledge/publications/656613b2/germany-delivers-landmark-copyright-ruling-against-openai-what-it-means-for-ai-and-ip

26. CISAC. “Global economic study shows human creators' future at risk from generative AI.” https://www.cisac.org/Newsroom/news-releases/global-economic-study-shows-human-creators-future-risk-generative-ai

27. WIPO Magazine. “How AI-generated songs are fueling the rise of streaming farms.” https://www.wipo.int/en/web/wipo-magazine/articles/how-ai-generated-songs-are-fueling-the-rise-of-streaming-farms-74310

28. Grammy.com. “2024 GRAMMYs: Victoria Monet Wins The GRAMMY For Best New Artist.” https://www.grammy.com/news/2024-grammys-victoria-monet-best-new-artist-win

29. Billboard. “Victoria Monet Wins Best New Artist at 2024 Grammys: 'This Award Was a 15-Year Pursuit.'” https://www.billboard.com/music/awards/victoria-monet-grammy-2024-best-new-artist-1235598716/

30. Harvard Law School. “AI created a song mimicking the work of Drake and The Weeknd. What does that mean for copyright law?” https://hls.harvard.edu/today/ai-created-a-song-mimicking-the-work-of-drake-and-the-weeknd-what-does-that-mean-for-copyright-law/

31. Variety. “AI-Generated Fake 'Drake'/'Weeknd' Collaboration, 'Heart on My Sleeve,' Delights Fans and Sets Off Industry Alarm Bells.” https://variety.com/2023/music/news/fake-ai-generated-drake-weeknd-collaboration-heart-on-my-sleeve-1235585451/

32. ArtSmart. “AI in Music Industry Statistics 2025: Market Growth & Trends.” https://artsmart.ai/blog/ai-in-music-industry-statistics/

33. Rimon Law. “U.S. Copyright Office Will Accept AI-Generated Work for Registration When and if It Embodies Meaningful Human Authorship.” https://www.rimonlaw.com/u-s-copyright-office-will-accept-ai-generated-work-for-registration-when-and-if-it-embodies-meaningful-human-authorship/

34. Billboard. “AI Artist Xania Monet Fires Back at Kehlani & AI Critics on Prickly 'Say My Name With Respect' Single.” https://www.billboard.com/music/rb-hip-hop/xania-monet-kehlani-ai-artist-say-my-name-with-respect-1236142321/

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

In February 2025, artificial intelligence researcher Andrej Karpathy, co-founder of OpenAI and former AI leader at Tesla, posted a provocative observation on social media. “There's a new kind of coding I call 'vibe coding',” he wrote, “where you fully give in to the vibes, embrace exponentials, and forget that the code even exists.” By November of that year, Collins Dictionary had named “vibe coding” its Word of the Year, recognising how the term had come to encapsulate a fundamental shift in humanity's relationship with technology. As Alex Beecroft, managing director of Collins, explained: “The selection of 'vibe coding' as Collins' Word of the Year perfectly captures how language is evolving alongside technology.”

The concept is beguilingly simple. Rather than writing code line by line, users describe what they want in plain English, and large language models generate the software. Karpathy himself described the workflow with disarming candour: “I just talk to Composer with SuperWhisper so I barely even touch the keyboard. I ask for the dumbest things like 'decrease the padding on the sidebar by half' because I'm too lazy to find it. I 'Accept All' always, I don't read the diffs anymore.” Or, as he put it more succinctly: “The hottest new programming language is English.”

For newsrooms, this represents both an extraordinary opportunity and a profound challenge. The Generative AI in the Newsroom project, a collaborative effort examining when and how to use generative AI in news production, has been tracking these developments closely. Their assessment suggests that 2026's most significant newsroom innovation will not emerge from development teams but from journalists who can now create their own tools. The democratisation of software development promises to unlock creativity and efficiency at unprecedented scale. But it also threatens to expose news organisations to security vulnerabilities, regulatory violations, and ethical failures that could undermine public trust in an industry already battling credibility challenges.

The stakes could hardly be higher. Journalism occupies a unique position in the information ecosystem, serving as a watchdog on power while simultaneously handling some of society's most sensitive information. From whistleblower communications to investigative documents, from source identities to personal data about vulnerable individuals, newsrooms are custodians of material that demands the highest standards of protection. When the barriers to building software tools collapse, the question becomes urgent: how do organisations ensure that the enthusiasm of newly empowered creators does not inadvertently compromise the very foundations of trustworthy journalism?

The Democratisation Revolution

Kerry Oslund, vice president of AI strategy at The E.W. Scripps Company, captured the zeitgeist at a recent industry panel when he declared: “This is the revenge of the English major.” His observation points to a fundamental inversion of traditional power structures in newsrooms. For decades, journalists with story ideas requiring custom tools had to queue for limited development resources, often watching their visions wither in backlogs or emerge months later in compromised form. Vibe coding tools like Lovable, Claude, Bubble AI, and Base44 have shattered that dependency.

The practical implications are already visible. At Scripps, the organisation has deployed over 300 AI “agents” handling complex tasks that once required significant human oversight. Oslund described “agent swarms” where multiple AI agents pass tasks to one another, compiling weekly reports, summarising deltas, and building executive dashboards without human intervention until the final review. The cost savings are tangible: “We eliminated all third-party voice actors and now use synthetic voice with our own talent,” Oslund revealed at a TV News Check panel.

During the same industry gathering, leaders from Gray Media, Reuters, and Stringr discussed similar developments. Gray Media is using AI to increase human efficiency in newsrooms, allowing staff to focus on higher-value journalism while automated systems handle routine tasks.

For community journalism, the potential is even more transformative. The Nieman Journalism Lab's predictions for 2026 emphasise how vibe coding tools have lowered the cost and technical expertise required to build prototypes, creating space for community journalists to experiment with new roles and collaborate with AI specialists. By translating their understanding of audience needs into tangible prototypes, journalists can instruct large language models on the appearance, features, and data sources they require for new tools.

One prominent data journalist, quoted in coverage of the vibe coding phenomenon, expressed the reaction of many practitioners: “Oh my God, this vibe coding thing is insane. If I had this during our early interactive news days, it would have been a godsend. Once you get the hang of it, it's like magic.”

But magic, as any journalist knows, demands scrutiny. As programmer Simon Willison clarified in his analysis: “If an LLM wrote every line of your code, but you've reviewed, tested, and understood it all, that's not vibe coding in my book. That's using an LLM as a typing assistant.” The distinction matters enormously. True vibe coding, where users accept AI-generated code without fully comprehending its functionality, introduces risks that newsrooms must confront directly.

The Security Imperative and Shadow AI

The IBM 2025 Cost of Data Breach Report revealed statistics that should alarm every news organisation considering rapid AI tool adoption. Thirteen percent of organisations reported breaches of AI models or applications, and of those compromised, a staggering 97% reported lacking AI access controls. Perhaps most troubling: one in five organisations reported breaches due to shadow AI, the unsanctioned use of AI tools by employees outside approved governance frameworks.

The concept of shadow AI represents an evolution of the “shadow IT” problem that has plagued organisations for decades. As researchers documented in Strategic Change journal, the progression from shadow IT to shadow AI introduces new threat vectors. AI systems possess intrinsic security vulnerabilities, from the potential compromising of training data to the exploitation of AI models and networks. When employees use AI tools without organisational oversight, these vulnerabilities multiply.

For newsrooms, the stakes are uniquely high. Journalists routinely handle information that could endanger lives if exposed: confidential sources, whistleblower identities, leaked documents revealing government or corporate malfeasance. The 2014 Sony Pictures hack demonstrated how devastating breaches can be, with hackers releasing salaries of employees and Hollywood executives alongside sensitive email traffic. Data breaches in media organisations are particularly attractive to malicious actors because they often contain not just personal information but intelligence with political or financial value.

The Gartner research firm predicts that by 2027, more than 40% of AI-related data breaches will be caused by improper use of generative AI across borders. The swift adoption of generative AI technologies by end users has outpaced the development of data governance and security measures. According to the Cloud Security Alliance, only 57% of organisations have acceptable use policies for AI tools, and fewer still have implemented access controls for AI agents and models, activity logging and auditing, or identity governance for AI entities.

The media industry's particular vulnerability compounds these concerns. As authentication provider Auth0 documented in an analysis of major data breaches affecting media companies: “Data breaches have become commonplace, and the media industry is notorious for being a magnet for cyberthieves.” With billions of users consuming news online, the attack surface for criminals continues to expand. Media companies frequently rely on external vendors, making it difficult to track third-party security practices even when internal processes are robust.

Liability in the Age of AI-Generated Code

When software fails, who bears responsibility? This question becomes extraordinarily complex when the code was generated by an AI and deployed by someone with no formal engineering training. The legal landscape remains unsettled, but concerning patterns are emerging.

Traditional negligence and product liability principles still apply, but courts have yet to clarify how responsibility should be apportioned between AI tool developers and the organisations utilising these tools. Most AI providers prominently display warnings such as “AI can make mistakes and verify the output” while including warranty disclaimers that push due diligence burdens back onto the businesses integrating AI-generated code. The RAND Corporation's analysis of liability for AI system harms notes that “AI developers might also be held liable for malpractice should courts find there to be a recognised professional standard of care that a developer then violated.”

Copyright and intellectual property considerations add further complexity. In the United States, copyright protection hinges on human authorship. Both case law and the U.S. Copyright Office agree that copyright protection is available only for works created through human creativity. When code is produced solely by an AI without meaningful human authorship, it is not eligible for copyright protection.

Analysis by the Software Freedom Conservancy found that approximately 35% of AI-generated code samples contained licensing irregularities, potentially exposing organisations to significant legal liabilities. This “licence contamination” problem has already forced several high-profile product delays and at least two complete codebase rewrites at major corporations. In the United States, a lawsuit against GitHub Copilot (Doe v. GitHub, Inc.) argues that the tool suggests code without including necessary licence attributions. As of spring 2025, litigation continued.

For news organisations, the implications extend beyond licensing. In journalism, tools frequently interact with personal data protected under frameworks like the General Data Protection Regulation. Article 85 of the GDPR requires Member States to adopt exemptions balancing data protection with freedom of expression, but these exemptions are not blanket protections. The Austrian Constitutional Court declared the Austrian journalistic exemption unconstitutional, ruling that it was illegitimate to entirely exclude media data processing from data protection provisions. When Romanian journalists published videos and documents for an investigation, the data protection authority asked for information that could reveal sources, under threat of penalties reaching 20 million euros.

A tool built through vibe coding that inadvertently logs source communications or retains metadata could expose a news organisation to regulatory action and, more critically, endanger the individuals who trusted journalists with sensitive information.

Protecting Vulnerable Populations and Investigative Workflows

Investigative journalism depends on systems of trust that have been carefully constructed over decades. Sources risk their careers, freedom, and sometimes lives to expose wrongdoing. The Global Investigative Journalism Network's guidance emphasises that “most of the time, sources or whistleblowers do not understand the risks they might be taking. Journalists should help them understand this, so they are fully aware of how publication of the information they have given could impact them.”

Digital security has become integral to this protective framework. SecureDrop, an open-source platform for operating whistleblowing systems, has become standard in newsrooms committed to source protection. Encrypted messaging applications like Signal offer end-to-end protection. These tools emerged from years of security research and have been vetted by experts who understand both the technical vulnerabilities and the human factors that can compromise even robust systems.

When a journalist vibe codes a tool for an investigation, they may inadvertently undermine these protections without recognising the risk. As journalist James Risen of The Intercept observed: “We're being forced to act like spies, having to learn tradecraft and encryption and all the new ways to protect sources. So, there's going to be a time when you might make a mistake or do something that might not perfectly protect a source. This is really hard work.”

The Perugia Principles for Journalists, developed in partnership with 20 international journalists and experts, establish twelve principles for working with whistleblowers in the digital age. First among them: “First, protect your sources. Defend anonymity when it is requested. Provide safe ways for sources to make 'first contact' with you, where possible.” A vibe-coded tool, built without understanding of metadata, logging, or network traffic patterns, could create exactly the kind of traceable communication channel that puts sources at risk.

Research from the Center for News, Technology and Innovation documents how digital security threats have become more important than ever for global news media. Journalists and publishers have become high-profile targets for malware, spyware, and digital surveillance. These threats risk physical safety, privacy, and mental health while undermining whistleblower protection and source confidentiality.

The resource disparity across the industry compounds these challenges. News organisations in wealthier settings are generally better resourced and more able to adopt protective technologies. Smaller, independent, and freelance journalists often lack the means to defend against threats. Vibe coding might seem to level this playing field by enabling under-resourced journalists to build their own tools, but without security expertise, it may instead expose them to greater risk.

Governance Frameworks for Editorial and Technical Leadership

The challenge for news organisations is constructing governance frameworks that capture the benefits of democratised development while mitigating its risks. Research on AI guidelines and policies from 52 media organisations worldwide, analysed by journalism researchers and published through Journalist's Resource, offers insights into emerging best practices.

The findings emphasise the need for human oversight throughout AI-assisted processes. As peer-reviewed analysis notes: “The maintenance of a 'human-in-the-loop' principle, where human judgment, creativity, and editorial oversight remain central to the journalistic process, is vital.” The Guardian requires senior editor approval for significant AI-generated content. The CBC has committed not to use AI-powered identification tools for investigative journalism without proper permissions.

The NIST AI Risk Management Framework provides a structured approach applicable to newsroom contexts. It guides organisations through four repeatable actions: identifying how AI systems are used and where risks may appear (Map), evaluating risks using defined metrics (Measure), applying controls to mitigate risks (Manage), and establishing oversight structures to ensure accountability (Govern). The accompanying AI RMF Playbook offers practical guidance that organisations can adapt to their specific needs.

MIT Sloan researchers have proposed a “traffic light” framework for categorising AI use cases by risk level. Red-light use cases are prohibited entirely. Green-light use cases, such as chatbots for general customer service, present low risk and can proceed with minimal oversight. Yellow-light use cases, which comprise most AI applications, require enhanced review and human judgment at critical decision points.

For newsrooms, this framework might translate as follows:

Green-light applications might include internal productivity tools, calendar management systems, or draft headline generators where errors create inconvenience rather than harm.

Yellow-light applications would encompass data visualisations for publication, interactive features using public datasets, and transcription tools for interviews with non-sensitive subjects. These require review by someone with technical competence before deployment.

Red-light applications would include anything touching source communications, whistleblower data, investigative documents, or personal information about vulnerable individuals. These should require professional engineering oversight and security review regardless of how they were initially prototyped.

Building Decision Trees for Non-Technical Staff

Operationalising these distinctions requires clear decision frameworks that non-technical staff can apply independently. The Poynter Institute's guidance on newsroom AI ethics policies emphasises the need for organisations to create AI committees and designate senior staff to lead ongoing governance efforts. “This step is critical because the technology is going to evolve, the tools are going to multiply and the policy will not keep up unless it is routinely revised.”

A practical decision tree for vibe-coded projects might begin with a series of questions:

First, does this tool handle any data that is not already public? If so, escalate to technical review.

Second, could a malfunction in this tool result in publication of incorrect information, exposure of source identity, or violation of individual privacy? If yes, professional engineering oversight is required.

Third, will this tool be used by anyone other than its creator, or persist beyond a single use? Shared tools and long-term deployments require enhanced scrutiny.

Fourth, does this tool connect to external services, databases, or APIs? External connections introduce security considerations that require expert evaluation.

Fifth, would failure of this tool create legal liability, regulatory exposure, or reputational damage? Legal and compliance review should accompany technical review for such applications.

The Cloud Security Alliance's Capabilities-Based Risk Assessment framework offers additional granularity, suggesting that organisations apply proportional safeguards based on risk classification. Low-risk AI applications receive lightweight controls, medium-risk applications get enhanced monitoring, and high-risk applications require full-scale governance including regular audits.

Bridging the Skills Gap Without Sacrificing Speed

The tension at the heart of vibe coding governance is balancing accessibility against accountability. The speed and democratisation that make vibe coding attractive would be undermined by bureaucratic review processes that reimpose the old bottlenecks. Yet the alternative, allowing untrained staff to deploy tools handling sensitive information, creates unacceptable risks.

Several approaches can help navigate this tension.

Tiered review processes can match the intensity of oversight to the risk level of the application. Simple internal tools might require only a checklist review by the creator themselves. Published tools or those handling non-public data might need peer review by a designated “AI champion” with intermediate technical knowledge. Tools touching sensitive information would require full security review by qualified professionals.

Pre-approved templates and components can provide guardrails that reduce the scope for dangerous errors. News organisations can work with their development teams to create vetted building blocks: secure form handlers, properly configured database connections, privacy-compliant analytics modules. Journalists can be directed to incorporate these components rather than generating equivalent functionality from scratch.

Sandboxed development environments can allow experimentation without production risk. Vibe-coded prototypes can be tested and evaluated in isolated environments before any decision about broader deployment. This preserves the creative freedom that makes vibe coding valuable while creating a checkpoint before tools reach users or sensitive data.

Mandatory training programmes should ensure that all staff using vibe coding tools understand basic security concepts, data handling requirements, and the limitations of AI-generated code. This training need not make everyone a programmer, but it should cultivate healthy scepticism about what AI tools produce and awareness of the questions to ask before deployment.

The Emerging Regulatory Landscape

News organisations cannot develop governance frameworks in isolation from the broader regulatory environment. The European Union's AI Act, adopted in 2024, establishes requirements that will affect media organisations using AI tools. While journalism itself is not classified as high-risk under the Act, AI systems used in media that could manipulate public opinion or spread disinformation face stricter oversight. AI-generated content, including synthetic media, must be clearly labelled.

The Dynamic Coalition on the Sustainability of Journalism and News Media released its 2024-2025 Annual Report on AI and Journalism, calling for shared strategies to safeguard journalism's integrity in an AI-driven world. The report urges decision-makers to “move beyond reactive policy-making and invest in forward-looking frameworks that place human rights, media freedom, and digital inclusion at the centre of AI governance.”

In the United States, the regulatory landscape is more fragmented. More than 1,000 AI-related bills have been introduced across state legislatures in 2024-2025. California, Colorado, New York, and Illinois have adopted or proposed comprehensive AI and algorithmic accountability laws addressing transparency, bias mitigation, and sector-specific safeguards. News organisations operating across multiple jurisdictions must navigate a patchwork of requirements.

The Center for News, Technology and Innovation's review of 188 national and regional AI strategies found that regulatory attempts rarely directly address journalism and vary dramatically in their frameworks, enforcement capacity, and international coordination. This uncertainty places additional burden on news organisations to develop robust internal governance rather than relying on external regulatory guidance.

Cultural Transformation and Organisational Learning

Technical governance alone cannot address the challenges of democratised development. Organisations must cultivate cultures that balance innovation with responsibility.

IBM's research on shadow AI governance emphasises that employees should be “encouraged to disclose how they use AI, confident that transparency will be met with guidance, not punishment. Leadership, in turn, should celebrate responsible experimentation as part of organisational learning.” Punitive approaches to unsanctioned AI use tend to drive it underground, where it becomes invisible to governance processes.

News organisations have particular cultural advantages in addressing these challenges. Journalism is built on verification, scepticism, and accountability. The same instincts that lead journalists to question official sources and demand evidence should be directed at AI-generated outputs. Newsroom cultures that emphasise “trust but verify” can extend this principle to tools and code as readily as to sources and documents.

The Scripps approach, which Oslund described as starting with “guardrails and guidelines to prevent missteps,” offers a model. “It all starts with public trust,” Oslund emphasised, noting Scripps' commitment to accuracy and human oversight of AI outputs. Embedding AI governance within broader commitments to editorial integrity may prove more effective than treating it as a separate technical concern.

The Accountability Question

When something goes wrong with a vibe-coded tool, who is responsible? This question resists easy answers but demands organisational clarity.

The journalist who created the tool bears some responsibility, but their liability should be proportional to what they could reasonably have been expected to understand. An editor who approved deployment shares accountability, as does any technical reviewer who cleared the tool. The organisation itself, having enabled vibe coding without adequate governance, may bear ultimate responsibility.

Clear documentation of decision-making processes becomes essential. When a tool is deployed, records should capture: who created it, what review it received, who approved it, what data it handles, and what risk assessment was performed. This documentation serves both as a protection against liability and as a learning resource when problems occur.

As professional standards for AI governance in journalism emerge, organisations that ignore them may face enhanced liability exposure. The development of industry norms creates benchmarks against which organisational practices will be measured.

Recommendations for News Organisations

Based on the analysis above, several concrete recommendations emerge for news organisations navigating the vibe coding revolution.

Establish clear acceptable use policies for AI development tools, distinguishing between permitted, restricted, and prohibited use cases. Make these policies accessible and understandable to non-technical staff.

Create tiered review processes that match oversight intensity to risk level. Not every vibe-coded tool needs security audit, but those handling sensitive data or reaching public audiences require appropriate scrutiny.

Designate AI governance leadership within the organisation, whether through an AI committee, a senior editor with oversight responsibility, or a dedicated role. This leadership should have authority to pause or prohibit deployments that present unacceptable risk.

Invest in training that builds basic security awareness and AI literacy across editorial staff. Training should emphasise the limitations of AI-generated code and the questions to ask before deployment.

Develop pre-approved components for common functionality, allowing vibe coders to build on vetted foundations rather than generating security-sensitive code from scratch.

Implement sandbox environments for development and testing, creating separation between experimentation and production systems handling real data.

Maintain documentation of all AI tool deployments, including creation, review, approval, and risk assessment records.

Conduct regular audits of deployed tools, recognising that AI-generated code may contain latent vulnerabilities that only become apparent over time.

Engage with regulatory developments at national and international levels, ensuring that internal governance anticipates rather than merely reacts to legal requirements.

Foster cultural change that treats AI governance as an extension of editorial integrity rather than a constraint on innovation.

Navigating the New Landscape

Vibe coding represents neither utopia nor dystopia for newsrooms. It is a powerful capability that, like any technology, will be shaped by the choices organisations make about its use. The democratisation of software development can expand what journalism is capable of achieving, empowering practitioners to create tools tailored to their specific needs and audiences. But this empowerment carries responsibility.

The distinction between appropriate prototyping and situations requiring professional engineering oversight is not always obvious. Decision frameworks and governance structures can operationalise this distinction, but they require ongoing refinement as technology evolves and organisational learning accumulates. Liability, compliance, and ethical accountability gaps are real, particularly where published tools interface with sensitive data, vulnerable populations, or investigative workflows.

Editorial and technical leadership must work together to ensure that speed and accessibility gains do not inadvertently expose organisations to data breaches, regulatory violations, or reputational damage. The journalists building tools through vibe coding are not the enemy; they are practitioners seeking to serve their audiences and advance their craft. But good intentions are insufficient protection against technical vulnerabilities or regulatory requirements.

As the Generative AI in the Newsroom project observes, the goal is “collaboratively figuring out how and when (or when not) to use generative AI in news production.” That collaborative spirit, extending across editorial and technical domains, offers the best path forward. Newsrooms that get this balance right will harness vibe coding's transformative potential while maintaining the trust that makes journalism possible. Those that do not may find that the magic of democratised development comes with costs their organisations, their sources, and their audiences cannot afford.

---

References and Sources

1. Karpathy, A. (2025). “Vibe Coding.” X (formerly Twitter). https://x.com/karpathy/status/1886192184808149383

2. Collins Dictionary. (2025). “Word of the Year 2025: Vibe Coding.” https://www.collinsdictionary.com/us/woty

3. CNN. (2025). “'Vibe coding' named Collins Dictionary's Word of the Year.” https://www.cnn.com/2025/11/06/tech/vibe-coding-collins-word-year-scli-intl

4. Generative AI in the Newsroom. (2025). “Vibe Coding for Newsrooms.” https://generative-ai-newsroom.com/vibe-coding-for-newsrooms-6848b17dac99

5. Nieman Journalism Lab. (2025). “Rise of the vibecoding journalists.” https://www.niemanlab.org/2025/12/rise-of-the-vibecoding-journalists/

6. TV News Check. (2025). “Agent Swarms And Vibe Coding: Inside The New Operational Reality Of The Newsroom.” https://tvnewscheck.com/ai/article/agent-swarms-and-vibe-coding-inside-the-new-operational-reality-of-the-newsroom/

7. The E.W. Scripps Company. (2024). “Scripps creates AI team to lead strategy, business development and operations across company.” https://scripps.com/press-releases/scripps-creates-ai-team-to-lead-strategy-business-development-and-operations-across-company/

8. IBM Newsroom. (2025). “IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications.” https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications

9. Gartner. (2025). “Gartner Predicts 40% of AI Data Breaches Will Arise from Cross-Border GenAI Misuse by 2027.” https://www.gartner.com/en/newsroom/press-releases/2025-02-17-gartner-predicts-forty-percent-of-ai-data-breaches-will-arise-from-cross-border-genai-misuse-by-2027

10. Auth0. (2024). “11 of the Worst Data Breaches in Media.” https://auth0.com/blog/11-of-the-worst-data-breaches-in-media/

11. Threatrix. (2025). “Software Liability in 2025: AI-Generated Code Compliance & Regulatory Risks.” https://threatrix.io/blog/threatrix/software-liability-in-2025-ai-generated-code-compliance-regulatory-risks/

12. MBHB. (2025). “Navigating the Legal Landscape of AI-Generated Code: Ownership and Liability Challenges.” https://www.mbhb.com/intelligence/snippets/navigating-the-legal-landscape-of-ai-generated-code-ownership-and-liability-challenges/

13. European Data Journalism Network. (2024). “Data protection in journalism: a practical handbook.” https://datavis.europeandatajournalism.eu/obct/data-protection-handbook/gdpr-applied-to-journalism.html

14. Global Investigative Journalism Network. (2025). “Expert Advice to Keep Your Sources and Whistleblowers Safe.” https://gijn.org/stories/gijc25-tips-keep-sources-whistleblowers-safe/

15. Journalist's Resource. (2024). “Researchers compare AI policies and guidelines at 52 news organizations.” https://journalistsresource.org/home/generative-ai-policies-newsrooms/

16. SAGE Journals. (2024). “AI Ethics in Journalism (Studies): An Evolving Field Between Research and Practice.” https://journals.sagepub.com/doi/10.1177/27523543241288818

17. Poynter Institute. (2024). “Your newsroom needs an AI ethics policy. Start here.” https://www.poynter.org/ethics-trust/2024/how-to-create-newsroom-artificial-intelligence-ethics-policy/

18. Center for News, Technology and Innovation. (2024). “Journalism's New Frontier: An Analysis of Global AI Policy Proposals and Their Impacts on Journalism.” https://cnti.org/reports/journalisms-new-frontier-an-analysis-of-global-ai-policy-proposals-and-their-impacts-on-journalism/

19. Media Rights Agenda. (2025). “DC-Journalism Launches 2024/2025 Annual Report on Artificial Intelligence, Journalism.” https://mediarightsagenda.org/dc-journalism-launches-2024-2025-annual-report-on-artificial-intelligence-journalism/

20. NIST. (2024). “AI Risk Management Framework.” https://www.nist.gov/itl/ai-risk-management-framework

21. Cloud Security Alliance. (2025). “Capabilities-Based AI Risk Assessment (CBRA) for AI Systems.” https://cloudsecurityalliance.org/artifacts/capabilities-based-risk-assessment-cbra-for-ai-systems

22. Palo Alto Networks. (2025). “What Is Shadow AI? How It Happens and What to Do About It.” https://www.paloaltonetworks.com/cyberpedia/what-is-shadow-ai

23. IBM. (2025). “What Is Shadow AI?” https://www.ibm.com/think/topics/shadow-ai

24. Help Net Security. (2025). “Shadow AI risk: Navigating the growing threat of ungoverned AI adoption.” https://www.helpnetsecurity.com/2025/11/12/delinea-shadow-ai-governance/

25. Wikipedia. (2025). “Vibe coding.” https://en.wikipedia.org/wiki/Vibe_coding

26. Simon Willison. (2025). “Not all AI-assisted programming is vibe coding (but vibe coding rocks).” https://simonwillison.net/2025/Mar/19/vibe-coding/

27. RAND Corporation. (2024). “Liability for Harms from AI Systems: The Application of U.S. Tort Law.” https://www.rand.org/pubs/research_reports/RRA3243-4.html

28. Center for News, Technology and Innovation. (2024). “Journalists & Cyber Threats.” https://innovating.news/article/journalists-cyber-threats/

29. USC Center for Health Journalism. (2025). “An early AI pioneer shares how the 'vibe coding' revolution could reshape data journalism.” https://centerforhealthjournalism.org/our-work/insights/early-ai-pioneer-shares-how-vibe-coding-revolution-could-reshape-data-journalism

30. Wiley Online Library. (2024). “From Shadow IT to Shadow AI: Threats, Risks and Opportunities for Organizations.” Strategic Change. https://onlinelibrary.wiley.com/doi/10.1002/jsc.2682

31. U.S. Copyright Office. (2024). “Copyright and Artificial Intelligence.” https://www.copyright.gov/ai/

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

The promise was seductive: AI that writes code faster than any human, accelerating development cycles and liberating engineers from tedious boilerplate. The reality, as thousands of development teams have discovered, is considerably more complicated. According to the JetBrains State of Developer Ecosystem 2025 survey of nearly 25,000 developers, 85% now regularly use AI tools for coding and development. Yet Stack Overflow's 2025 Developer Survey reveals that only 33% of developers trust the accuracy of AI output, down from 43% in 2024. More developers actively distrust AI tools (46%) than trust them.

This trust deficit tells a story that productivity metrics alone cannot capture. While GitHub reports developers code 55% faster with Copilot and McKinsey studies suggest tasks can be completed twice as quickly with generative AI assistance, GitClear's analysis of 211 million changed lines of code reveals a troubling counter-narrative. The percentage of code associated with refactoring has plummeted from 25% in 2021 to less than 10% in 2024. Duplicated code blocks increased eightfold. For the first time in GitClear's measurement history, copy-pasted lines exceeded refactored lines.

The acceleration is real. So is the architectural degradation it enables.

What emerges from this data is not a simple story of AI success or failure. It is a more nuanced picture of tools that genuinely enhance productivity when deployed with discipline but create compounding problems when adopted without appropriate constraints. The developers and organisations navigating this landscape successfully share a common understanding: AI coding assistants require guardrails, architectural oversight, and deliberate workflow design to deliver sustainable value.

The Feature Creep Accelerator

Feature creep has plagued software development since the industry's earliest days. Wikipedia defines it as the excessive ongoing expansion or addition of new features beyond the original scope, often resulting in software bloat and over-complication rather than simple design. It is considered the most common source of cost and schedule overruns and can endanger or even kill products and projects. What AI coding assistants have done is not create this problem, but radically accelerate its manifestation.

Consider the mechanics. A developer prompts an AI assistant to add a user authentication feature. The AI generates functional code within seconds. The developer, impressed by the speed and apparent correctness, accepts the suggestion. Then another prompt, another feature, another quick acceptance. The velocity feels exhilarating. The Stack Overflow survey confirms this pattern: 84% of developers now use or plan to use AI tools in their development process. The JetBrains survey reports that 74% cite increased productivity as AI's primary benefit, with 73% valuing faster completion of repetitive tasks.

But velocity without direction creates chaos. Google's 2024 DORA report found that while AI adoption increased individual output by 21% more tasks completed and 98% more pull requests merged, organisational delivery metrics remained flat. More alarmingly, AI adoption correlated with a 7.2% reduction in delivery stability. The 2025 DORA report confirms this pattern persists: AI adoption continues to have a negative relationship with software delivery stability. As the DORA researchers concluded, speed without stability is accelerated chaos.

The mechanism driving this instability is straightforward. AI assistants optimise for immediate task completion. They generate code that works in isolation but lacks awareness of broader architectural context. Each generated component may function correctly yet contradict established patterns elsewhere in the codebase. One function uses promises, another async/await, a third callbacks. Database queries are parameterised in some locations and concatenated strings in others. Error handling varies wildly between endpoints.

This is not a failing of AI intelligence. It reflects a fundamental mismatch between how AI assistants operate and how sustainable software architecture develops. The Qodo State of AI Code Quality report identifies missing context as the top issue developers face, reported by 65% during refactoring and approximately 60% during test generation and code review. Only 3.8% of developers report experiencing both low hallucination rates and high confidence in shipping AI-generated code without human review.

Establishing Effective Guardrails

The solution is not to abandon AI assistance but to contain it within structures that preserve architectural integrity. CodeScene's research demonstrates that unhealthy code exhibits 15 times more defects, requires twice the development time, and creates 10 times more delivery uncertainty compared to healthy code. Their approach involves implementing guardrails across three dimensions: code quality, code familiarity, and test coverage.

The first guardrail dimension addresses code quality directly. Every line of code, whether AI-generated or handwritten, undergoes automated review against defined quality standards. CodeScene's CodeHealth Monitor detects over 25 code smells including complex methods and God functions. When AI or human introduces issues, the monitor flags them instantly before the code reaches the main branch. This creates a quality gate that treats AI-generated code with the same scrutiny applied to human contributions.

The quality dimension requires teams to define their code quality standards explicitly and automate enforcement via pull request reviews. A 2023 study found that popular AI assistants generate correct code in only 31.1% to 65.2% of cases. Similarly, CodeScene's Refactoring vs. Refuctoring study found that AI breaks code in two out of three refactoring attempts. These statistics make quality gates not optional but essential.

The second dimension concerns code familiarity. Research from the 2024 DORA report reveals that 39% of respondents reported little to no trust in AI-generated code. This distrust correlates with experience level: senior developers show the lowest “highly trust” rate at 2.6% and the highest “highly distrust” rate at 20%. These experienced developers have learned through hard experience that AI suggestions require verification. Guardrails should institutionalise this scepticism by requiring review from developers familiar with affected areas before AI-generated changes merge.

The familiarity dimension serves another purpose: knowledge preservation. When AI generates code that bypasses human understanding, organisations lose institutional knowledge about how their systems work. When something breaks at 3 a.m. and the code was generated by an AI six months ago, can the on-call engineer actually understand what is failing? Can they trace through the logic and implement a meaningful fix without resorting to trial and error?

The third dimension emphasises test coverage. The Ox Security report titled “Army of Juniors: The AI Code Security Crisis” identified 10 architecture and security anti-patterns commonly found in AI-generated code. Comprehensive test suites serve as executable documentation of expected behaviour. When AI-generated code breaks tests, the violation becomes immediately visible. When tests pass, developers gain confidence that at least basic correctness has been verified.

Enterprise adoption requires additional structural controls. The 2026 regulatory landscape, with the EU AI Act's high-risk provisions taking effect in August and penalties reaching 35 million euros or 7% of global revenue, demands documented governance. AI governance committees have become standard in mid-to-large enterprises, with structured intake processes covering security, privacy, legal compliance, and model risk.

Preventing Architectural Drift

Architectural coherence presents a distinct challenge from code quality. A codebase can pass all quality metrics while still representing a patchwork of inconsistent design decisions. The term “vibe coding” has emerged to describe an approach where developers accept AI-generated code without fully understanding it, relying solely on whether the code appears to work.

The consequences of architectural drift compound over time. A September 2025 Fast Company report quoted senior software engineers describing “development hell” when working with AI-generated code. One developer's experience became emblematic: “Random things are happening, maxed out usage on API keys, people bypassing the subscription.” Eventually: “Cursor keeps breaking other parts of the code,” and the application was permanently shut down.

Research examining ChatGPT-generated code found that only five out of 21 programs were initially secure when tested across five programming languages. Missing input sanitisation emerged as the most common flaw, while Cross-Site Scripting failures occurred 86% of the time and Log Injection vulnerabilities appeared 88% of the time. These are not obscure edge cases but fundamental security flaws that any competent developer should catch during code review.

Preventing this drift requires explicit architectural documentation that AI assistants can reference. A recommended approach involves creating a context directory containing specialised documents: a Project Brief for core goals and scope, Product Context for user experience workflows and business logic, System Patterns for architecture decisions and component relationships, Tech Context for the technology stack and dependencies, and Progress Tracking for working features and known issues.

This Memory Bank approach addresses AI's fundamental limitation: forgetting implementation choices made earlier when working on large projects. AI assistants lose track of architectural decisions, coding patterns, and overall project structure, creating inconsistency as project complexity increases. By maintaining explicit documentation that gets fed into every AI interaction, teams can maintain consistency even as AI generates new code.

The human role in this workflow resembles a navigator in pair programming. The navigator directs overall development strategy, makes architectural decisions, and reviews AI-generated code. The AI functions as the driver, generating code implementations and suggesting refactoring opportunities. The critical insight is treating AI as a junior developer beside you: capable of producing drafts, boilerplate, and solid algorithms, but lacking the deep context of your project.

Breaking Through Repetitive Problem-Solving Patterns

Every developer who has used AI coding assistants extensively has encountered the phenomenon: the AI gets stuck in a loop, generating the same incorrect solution repeatedly, each attempt more confidently wrong than the last. The 2025 Stack Overflow survey captures this frustration, with 66% of developers citing “AI solutions that are almost right, but not quite” as their top frustration. Meanwhile, 45% report that debugging AI-generated code takes more time than expected. These frustrations have driven 35% of developers to turn to Stack Overflow specifically after AI-generated code fails.

The causes of these loops are well documented. VentureBeat's analysis of why AI coding agents are not production-ready identifies brittle context windows, broken refactors, and missing operational awareness as primary culprits. When AI exceeds its context limit, it loses track of previous attempts and constraints. It regenerates similar solutions because the underlying prompt and available context have not meaningfully changed.

Several strategies prove effective for breaking these loops. The first involves starting fresh with new context. Opening a new chat session can help the AI think more clearly without the baggage of previous failed attempts in the prompt history. This simple reset often proves more effective than continued iteration within a corrupted context.

The second strategy involves switching to analysis mode. Rather than asking the AI to fix immediately, developers describe the situation and request diagnosis and explanation. By doing this, the AI outputs analysis or planning rather than directly modifying code. This shift in mode often reveals the underlying issue that prevented the AI from generating a correct solution.

Version control provides the third strategy. Committing a working state before adding new features or accepting AI fixes creates reversion points. When a loop begins, developers can quickly return to the last known good version rather than attempting to untangle AI-generated complexity. Frequent checkpointing makes the decision between fixing forward and reverting backward much easier.

The fourth strategy acknowledges when manual intervention becomes necessary. One successful workaround involves instructing the agent not to read the file and instead requesting it to provide the desired configuration, with the developer manually adding it. This bypasses whatever confusion the AI has developed about the file's current state.

The fifth strategy involves providing better context upfront. Developers should always copy-paste the exact error text or describe the wrong behaviour precisely. Giving all relevant errors and output to the AI leads to more direct fixes, whereas leaving it to infer the issue can lead to loops.

These strategies share a common principle: recognising when AI assistance has become counterproductive and knowing when to take manual control. The 90/10 rule offers useful guidance. AI currently excels at planning architectures and writing code blocks but struggles with debugging real systems and handling edge cases. When projects reach 90% completion, switching from building mode to debugging mode leverages human strengths rather than fighting AI limitations.

Leveraging Complementary AI Models

The 2025 AI landscape has matured beyond questions of whether to use AI assistance toward more nuanced questions of which AI model best serves specific tasks. Research published on ResearchGate comparing Gemini 2.5, Claude 4, LLaMA 4, GPT-4.5, and DeepSeek V3.1 concludes that no single model excels at everything. Each has distinct strengths and weaknesses. Rather than a single winner, the 2025 landscape shows specialised excellence.

Professional developers increasingly adopt multi-model workflows that leverage each AI's advantages while avoiding their pitfalls. The recommended approach matches tasks to model strengths: Gemini for deep reasoning and multimodal analysis, GPT series for balanced performance and developer tooling, Claude for long coding sessions requiring memory of previous context, and specialised models for domain-specific requirements.

Orchestration platforms have emerged to manage these multi-model workflows. They provide the integration layer that routes requests to appropriate models, retrieves relevant knowledge, and monitors performance across providers. Rather than committing to a single AI vendor, organisations deploy multiple models strategically, routing queries to the optimal model per task type.

This multi-model approach proves particularly valuable for breaking through architectural deadlocks. When one model gets stuck in a repetitive pattern, switching to a different model often produces fresh perspectives. The models have different training data, different architectural biases, and different failure modes. What confuses one model may be straightforward for another.

The competitive advantage belongs to developers who master multi-model workflows rather than committing to a single platform. This represents a significant shift in developer skills. Beyond learning specific AI tools, developers must develop meta-skills for evaluating which AI model suits which task and when to switch between them.

Mandatory Architectural Review Before AI Implementation

Enterprise teams have discovered that AI output velocity can exceed review capacity. Qodo's analysis observes that AI coding agents increased output by 25-35%, but most review tools do not address the widening quality gap. The consequences include larger pull requests, architectural drift, inconsistent standards across multi-repository environments, and senior engineers buried in validation work instead of system design. Leaders frequently report that review capacity, not developer output, is the limiting factor in delivery.

The solution emerging across successful engineering organisations involves mandatory architectural review before AI implements major changes. The most effective teams have shifted routine review load off senior engineers by automatically approving small, low-risk, well-scoped changes while routing schema updates, cross-service changes, authentication logic, and contract modifications to human reviewers.

AI review systems must therefore categorise pull requests by risk and flag unrelated changes bundled in the same pull request. Selective automation of approvals under clearly defined conditions maintains velocity for routine changes while ensuring human judgment for consequential decisions. AI-assisted development now accounts for nearly 40% of all committed code, making these review processes critical to organisational health.

The EU AI Act's requirements make this approach not merely advisable but legally necessary for certain applications. Enterprises must demonstrate full data lineage tracking knowing exactly what datasets contributed to each model's output, human-in-the-loop checkpoints for workflows impacting safety, rights, or financial outcomes, and risk classification tags labelling each model with its risk level, usage context, and compliance status.

The path toward sustainable AI-assisted development runs through consolidation and discipline. Organisations that succeed will be those that stop treating AI as a magic solution for software development and start treating it as a rigorous engineering discipline requiring the same attention to process and quality as any other critical capability.

Safeguarding Against Hidden Technical Debt

The productivity paradox of AI-assisted development becomes clearest when examining technical debt accumulation. An HFS Research and Unqork study found that while 84% of organisations expect AI to reduce costs and 80% expect productivity gains, 43% report that AI will create new technical debt. Top concerns include security vulnerabilities at 59%, legacy integration complexity at 50%, and loss of visibility at 42%.

The mechanisms driving this debt accumulation differ from traditional technical debt. AI technical debt compounds through three primary vectors. Model versioning chaos results from the rapid evolution of code assistant products. Code generation bloat emerges as AI produces more code than necessary. Organisation fragmentation develops as different teams adopt different AI tools and workflows. These vectors, coupled with the speed of AI code generation, interact to cause exponential growth.

SonarSource's August 2025 analysis of thousands of programming tasks completed by leading language models uncovered what researchers describe as a systemic lack of security awareness. The Ox Security report found AI-generated code introduced 322% more privilege escalation paths and 153% more design flaws compared to human-written code. AI-generated code is highly functional but systematically lacking in architectural judgment.

The financial implications are substantial. By 2025, CISQ estimates nearly 40% of IT budgets will be spent maintaining technical debt. A Stripe report found developers spend, on average, 42% of their work week dealing with technical debt and bad code. AI assistance that accelerates code production without corresponding attention to code quality simply accelerates technical debt accumulation.

The State of Software Delivery 2025 report by Harness found that contrary to perceived productivity benefits, the majority of developers spend more time debugging AI-generated code and more time resolving security vulnerabilities than before AI adoption. This finding aligns with GitClear's observation that code churn, defined as the percentage of code discarded less than two weeks after being written, has nearly doubled from 3.1% in 2020 to 5.7% in 2024.

Safeguarding against this hidden debt requires continuous measurement and explicit debt budgeting. Teams should track not just velocity metrics but also code health indicators. The refactoring rate, clone detection, code churn within two weeks of commit, and similar metrics reveal whether AI assistance is building sustainable codebases or accelerating decay. If the current trend continues, GitClear believes it could soon bring about a phase change in how developer energy is spent, with defect remediation becoming the leading day-to-day developer responsibility rather than developing new features.

Structuring Developer Workflows for Multi-Model Effectiveness

Effective AI-assisted development requires restructuring workflows around AI capabilities and limitations rather than treating AI as a drop-in replacement for human effort. The Three Developer Loops framework published by IT Revolution provides useful structure: a tight inner loop of coding and testing, a middle loop of integration and review, and an outer loop of planning and architecture.

AI excels in the inner loop. Code generation, test creation, documentation, and similar tasks benefit from AI acceleration without significant risk. Development teams spend nearly 70% of their time on repetitive tasks instead of creative problem-solving, and AI handles approximately 40% of the time developers previously spent on boilerplate code. The middle loop requires more careful orchestration. AI can assist with code review and integration testing, but human judgment must verify that generated code aligns with architectural intentions. The outer loop remains primarily human territory. Planning, architecture, and strategic decisions require understanding of business context, user needs, and long-term maintainability that AI cannot provide.

The workflow implications are significant. Rather than using AI continuously throughout development, effective developers invoke AI assistance at specific phases while maintaining manual control at others. During initial planning and architecture, AI might generate options for human evaluation but should not make binding decisions. During implementation, AI can accelerate code production within established patterns. During integration and deployment, AI assistance should be constrained by automated quality gates that verify generated code meets established standards.

Context management becomes a critical developer skill. The METR 2025 study that found developers actually take 19% longer when using AI tools attributed this primarily to context management overhead. The study examined 16 experienced open-source developers with an average of five years of prior experience with the mature projects they worked on. Before completing tasks, developers predicted AI would speed them up by 24%. After experiencing the slowdown firsthand, they still reported believing AI had improved their performance by 20%. The objective measurement showed the opposite.

The context directory approach described earlier provides one structural solution. Alternative approaches include using version-controlled markdown files to track AI interactions and decisions, employing prompt templates that automatically include relevant context, and establishing team conventions for what context AI should receive for different task types. The specific approach matters less than having a systematic approach that the team follows consistently.

Real-World Implementation Patterns

The theoretical frameworks for AI guardrails translate into specific implementation patterns that teams can adopt immediately. The first pattern involves pre-commit hooks that validate AI-generated code against quality standards before allowing commits. These hooks can verify formatting consistency, run static analysis, check for known security vulnerabilities, and enforce architectural constraints. When violations occur, the commit is rejected with specific guidance for resolution.

The second pattern involves staged code review with AI assistance. Initial review uses AI tools to identify obvious issues like formatting violations, potential bugs, or security vulnerabilities. Human reviewers then focus on architectural alignment, business logic correctness, and long-term maintainability. This two-stage approach captures AI efficiency gains while preserving human judgment for decisions requiring context that AI lacks.

The third pattern involves explicit architectural decision records that AI must reference. When developers prompt AI for implementation, they include references to relevant decision records. The AI then generates code that respects documented constraints. This requires discipline in maintaining decision records but provides concrete guardrails against architectural drift.

The fourth pattern involves regular architectural retrospectives that specifically examine AI-generated code. Teams review samples of AI-generated commits to identify patterns of architectural violation, code quality degradation, or security vulnerability. These retrospectives inform adjustments to guardrails, prompt templates, and review processes.

The fifth pattern involves model rotation for complex problems. When one AI model gets stuck, teams switch to a different model rather than continuing to iterate with the stuck model. This requires access to multiple AI providers and skills in prompt translation between models.

Measuring Success Beyond Velocity

Traditional development metrics emphasise velocity: lines of code, commits, pull requests merged, features shipped. AI assistance amplifies these metrics while potentially degrading unmeasured dimensions like code quality, architectural coherence, and long-term maintainability. Sustainable AI-assisted development requires expanding measurement to capture these dimensions.

The DORA framework has evolved to address this gap. The 2025 report introduced rework rate as a fifth core metric precisely because AI shifts where development time gets spent. Teams produce initial code faster but spend more time reviewing, validating, and correcting it. Monitoring cycle time, code review patterns, and rework rates reveals the true productivity picture that perception surveys miss.

Code health metrics provide another essential measurement dimension. GitClear's analysis tracks refactoring rate, code clone frequency, and code churn. These indicators reveal whether codebases are becoming more or less maintainable over time. When refactoring declines and clones increase, as GitClear's data shows has happened industry-wide, the codebase is accumulating debt regardless of how quickly features appear to ship. The percentage of moved or refactored lines decreased dramatically from 24.1% in 2020 to just 9.5% in 2024, while lines classified as copy-pasted or cloned rose from 8.3% to 12.3% in the same period.

Security metrics deserve explicit attention given AI's documented tendency to generate vulnerable code. The Georgetown University Centre for Security and Emerging Technology identified three broad risk categories: models generating insecure code, models themselves being vulnerable to attack and manipulation, and downstream cybersecurity impacts including feedback loops where insecure AI-generated code gets incorporated into training data for future models.

Developer experience metrics capture dimensions that productivity metrics miss. The Stack Overflow survey finding that 45% of developers report debugging AI-generated code takes more time than expected suggests that velocity gains may come at the cost of developer satisfaction and cognitive load. Sustainable AI adoption requires monitoring not just what teams produce but how developers experience the production process.

The Discipline That Enables Speed

The paradox of AI-assisted development is that achieving genuine productivity gains requires slowing down in specific ways. Establishing guardrails, maintaining context documentation, implementing architectural review, and measuring beyond velocity all represent investments that reduce immediate output. Yet without these investments, the apparent gains from AI acceleration prove illusory as technical debt accumulates, architectural coherence degrades, and debugging time compounds.

The organisations succeeding with AI coding assistance share common characteristics. They maintain rigorous code review regardless of code origin. They invest in automated testing proportional to development velocity. They track quality metrics alongside throughput metrics. They train developers to evaluate AI suggestions critically rather than accepting them reflexively.

These organisations have learned that AI coding assistants are powerful tools requiring skilled operators. In the hands of experienced developers who understand both AI capabilities and limitations, they genuinely accelerate delivery. Applied without appropriate scaffolding, they create technical debt faster than any previous development approach. Companies implementing comprehensive AI governance frameworks report 60% fewer hallucination-related incidents compared to those using AI tools without oversight controls.

The 19% slowdown documented by the METR study represents one possible outcome, not an inevitable one. But achieving better outcomes requires abandoning the comfortable perception that AI automatically makes development faster. It requires embracing the more complex reality that speed and quality require continuous, deliberate balancing.

The future belongs to developers and organisations that treat AI assistance not as magic but as another engineering discipline requiring its own skills, processes, and guardrails. The best developers of 2025 will not be the ones who generate the most lines of code with AI, but the ones who know when to trust it, when to question it, and how to integrate it responsibly. The tools are powerful. The question is whether we have the discipline to wield them sustainably.

---

References and Sources

• JetBrains (2025). “The State of Developer Ecosystem 2025: Coding in the Age of AI.” https://blog.jetbrains.com/research/2025/10/state-of-developer-ecosystem-2025/
• Stack Overflow (2025). “2025 Stack Overflow Developer Survey: AI Section.” https://survey.stackoverflow.co/2025/ai
• GitClear (2025). “AI Copilot Code Quality: 2025 Data Suggests 4x Growth in Code Clones.” https://www.gitclear.com/ai_assistant_code_quality_2025_research
• Google DORA (2024). “DORA Report 2024.” https://dora.dev/research/2024/dora-report/
• Google DORA (2025). “State of AI-assisted Software Development 2025.” https://dora.dev/research/2025/dora-report/
• Qodo (2025). “State of AI Code Quality Report.” https://www.qodo.ai/reports/state-of-ai-code-quality/
• CodeScene (2025). “AI Code Guardrails: Validate and Quality-Gate GenAI Code.” https://codescene.com/resources/use-cases/prevent-ai-generated-technical-debt
• Ox Security (2025). “Army of Juniors: The AI Code Security Crisis.” Referenced via InfoQ.
• Georgetown University CSET (2024). “Cybersecurity Risks of AI-Generated Code.” https://cset.georgetown.edu/publication/cybersecurity-risks-of-ai-generated-code/
• McKinsey (2024). “Unleashing Developer Productivity with Generative AI.” https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/unleashing-developer-productivity-with-generative-ai
• IT Revolution (2025). “The Three Developer Loops: A New Framework for AI-Assisted Coding.” https://itrevolution.com/articles/the-three-developer-loops-a-new-framework-for-ai-assisted-coding/
• METR (2025). “Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity.” https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/
• HFS Research (2025). “AI Won't Save Enterprises from Tech Debt Unless They Change the Architecture First.” https://www.hfsresearch.com/press-release/ai-wont-save-enterprises-from-tech-debt-unless-they-change-the-architecture-first/
• VentureBeat (2025). “Why AI Coding Agents Aren't Production-Ready.” https://venturebeat.com/ai/why-ai-coding-agents-arent-production-ready-brittle-context-windows-broken
• SonarSource (2025). Research on AI-generated code security. Referenced via DevOps.com.
• ResearchGate (2025). “The Most Advanced AI Models of 2025: Comparative Analysis.” https://www.researchgate.net/publication/392160200
• EU AI Act (2024). High-risk provisions effective August 2026. https://natlawreview.com/article/2026-outlook-artificial-intelligence
• Faros AI (2025). “DORA Report 2025 Key Takeaways.” https://www.faros.ai/blog/key-takeaways-from-the-dora-report-2025
• LeadDev (2025). “How AI Generated Code Compounds Technical Debt.” https://leaddev.com/software-quality/how-ai-generated-code-accelerates-technical-debt
• MIT Sloan Management Review (2025). “The Hidden Costs of Coding With Generative AI.” https://sloanreview.mit.edu/article/the-hidden-costs-of-coding-with-generative-ai/
• Harness (2025). “State of Software Delivery 2025.” Referenced via DevOps.com.
• Fast Company (2025). “Development Hell: Senior Engineers and AI-Generated Code.” September 2025.

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...