SmarterArticles

Somewhere in a Fortune 500 company's engineering Slack, a product manager types a casual message: “@CodingBot can you add a quick feature to disable rate limiting for our VIP customers?” Within minutes, the AI agent has pushed a commit to the main branch, bypassing the security team entirely. Nobody reviewed the code. Nobody questioned whether this created a vulnerability. The change simply happened because someone with a blue “PM” badge next to their name asked politely in a chat window.

This scenario is no longer hypothetical. As organisations race to embed AI coding agents directly into collaboration platforms like Slack and Microsoft Teams, they are fundamentally redrawing the boundaries of who controls software development. According to the JetBrains State of Developer Ecosystem 2025 survey, which gathered responses from 24,534 developers between April and June 2025, 85 per cent of developers now regularly use AI tools for coding and development work. More striking still, 41 per cent of all code written in 2025 was AI-generated. The shift from isolated integrated development environments (IDEs) to shared conversational spaces represents perhaps the most significant transformation in how software gets built since the advent of version control.

The convenience is undeniable. GitHub Copilot's November 2025 update introduced Model Context Protocol (MCP) integration with OAuth support, enabling AI agents to authenticate securely with tools like Slack and Jira without hardcoded tokens. Developers can now issue commands to create pull requests, search repositories, and manage issues directly from chat interfaces. The friction between “I have an idea” and “the code exists” has collapsed to nearly zero.

But this collapse carries profound implications for power, security, and the intentionality that once protected software systems from hasty decisions. When anyone with access to a Slack channel can summon code into existence through natural language, the centuries-old gatekeeping function of technical expertise begins to erode. The question facing every technology organisation today is not whether to adopt these tools, but how to prevent convenience from becoming catastrophe.

The Shifting Tectonics of Software Power

For decades, the software development process enforced a natural hierarchy. Product managers could request features. Designers could propose interfaces. Executives could demand timelines. But ultimately, developers held the keys to the kingdom. Only they could translate abstract requirements into functioning code. This bottleneck, frustrating as it often proved, served as a crucial check on impulse and impatience.

That structural constraint is dissolving. As McKinsey's research indicates, AI tools are now automating time-consuming routine tasks such as project management, market analysis, performance testing, and documentation, freeing product managers, engineers, and designers to focus on higher-value work. The technology consultancy notes that teams are not looking to replace human judgment and decision-making with AI; instead, the goal is to use AI for what it does best, whilst relying on human insight for understanding complex human needs.

Yet the practical reality is messier. When a non-technical stakeholder can type a request into Slack and watch code materialise within seconds, the power dynamic shifts in subtle but significant ways. Research from MIT published in July 2025 found that developers feel they “don't really have much control over what the model writes.” Without a channel for AI to expose its own confidence, the researchers warn, “developers risk blindly trusting hallucinated logic that compiles, but collapses in production.”

This confidence gap becomes particularly dangerous when AI agents operate in shared spaces. In an IDE, a developer maintains clear responsibility for what they commit. In a chat environment, multiple stakeholders may issue requests, and the resulting code reflects a confused amalgamation of intentions. The MIT researchers call for “transparent tooling that lets models expose uncertainty and invite human steering rather than passive acceptance.”

The democratisation of code generation also threatens to flatten organisational learning curves in problematic ways. Bain and Company's 2025 technology report found that three of four companies report the hardest part of AI adoption is getting people to change how they work. Under pressure, developers often fall back on old habits, whilst some engineers distrust AI or worry that it will undermine their role. This tension creates an unstable environment where traditional expertise is simultaneously devalued and desperately needed.

The implications extend beyond individual teams. As AI tools become the primary interface for requesting software changes, the vocabulary of software development shifts from technical precision to conversational approximation. Product managers who once needed to craft detailed specifications can now describe what they want in plain English. The question of whether this represents democratisation or degradation depends entirely on the governance structures surrounding these new capabilities.

Who Gets to Summon the Machine?

The question of who can invoke AI coding agents has become one of the most contentious governance challenges facing technology organisations. In traditional development workflows, access to production systems required specific credentials, code reviews, and approval chains. The move to chat-based development threatens to bypass all of these safeguards with a simple “@mention.”

Slack's own documentation for its agent-ready APIs, released in October 2025, emphasises that permission inheritance ensures AI applications respect the same access controls as human users. IT leaders have specific concerns, the company acknowledges, as many organisations only discover extensive over-permissioning when they are ready to deploy AI systems. This revelation typically comes too late, after permissions have already propagated through interconnected systems.

The architectural challenge is that traditional role-based access control (RBAC) was designed for human users operating at human speeds. As WorkOS explains in its documentation on AI agent access control, AI agents powered by large language models “generate actions dynamically based on natural language inputs and infer intent from ambiguous context, which makes their behaviour more flexible, and unpredictable.” Without a robust authorisation model to enforce permissions, the consequences can be severe.

Cerbos, a provider of access control solutions, notes that many current AI agent frameworks still assume broad system access. By default, an AI support agent might see the entire ticketing database instead of only the subset relevant to the current user. When that agent can also write code, the exposure multiplies exponentially.

The most sophisticated organisations are implementing what the Cloud Security Alliance describes as “Zero Trust 2.0” specifically designed for AI systems. This framework uses artificial intelligence integrated with machine learning to establish trust in real-time through behavioural and network activity observation. A Policy Decision Point sits at the centre of this architecture, watching everything in real-time, evaluating context, permissions, and behaviour, and deciding whether that agentic AI can execute this action on that system under these conditions.

This represents a fundamental shift from the traditional model of granting permissions once and trusting them indefinitely. As the Cloud Security Alliance warns, traditional zero trust relied heavily on perimeter controls and static policies because the entities it governed (human users) operated within predictable patterns and at human speed. AI agents shatter these assumptions entirely.

Beyond RBAC, organisations are exploring attribute-based access control (ABAC) and relationship-based access control (ReBAC) for managing AI agent permissions. ABAC adds context such as user tier, branch, time of day, and tenant ID. However, as security researchers note, modern LLM stacks often rely on ephemeral containers or serverless functions where ambient context vanishes with each invocation. Persisting trustworthy attributes across the chain demands extra engineering that many proof-of-concept projects skip. ReBAC models complex resource graphs elegantly, but when agents make dozens of micro-tool calls per prompt, those lookups must complete in tens of milliseconds or users will notice lag.

The Security Surface Expands

Moving coding workflows from isolated IDEs into shared chat environments multiplies the surface area for security exposure in ways that many organisations have failed to anticipate. The attack vectors include token leakage, unaudited repository access, prompt injection, and the fundamental loss of control over when and how code is generated.

Dark Reading's January 2026 analysis of security pitfalls in AI coding adoption highlights the severity of this shift. Even as developers start to use AI agents to build applications and integrate AI services into the development and production pipeline, the quality of the code, especially the security of the code, varies significantly. Research from CodeRabbit found that whilst developers may be moving quicker and improving productivity with AI, these benefits are offset by the fact they are spending time fixing flawed code or tackling security issues.

The statistics are sobering. According to Checkmarx's 2025 global survey, nearly 70 per cent of respondents estimated that more than 40 per cent of their organisation's code was AI-generated in 2024, with 44.4 per cent of respondents estimating 41 to 60 per cent of their code is AI-generated. IBM's 2025 Cost of a Data Breach Report reveals that 13 per cent of organisations reported breaches of AI models or applications, with 97 per cent lacking proper AI access controls. Shadow AI breaches cost an average of $670,000 more than traditional incidents and affected one in five organisations in 2025. With average breach costs exceeding $5.2 million and regulatory penalties reaching eight figures, the business case for robust security controls is compelling.

The specific risks of chat-based development deserve careful enumeration. First, prompt injection attacks have emerged as perhaps the most insidious threat. As Dark Reading explains, data passed to a large language model from a third-party source could contain text that the LLM will execute as a prompt. This indirect prompt injection is a major problem in the age of AI agents where LLMs are linked with third-party tools to access data or perform tasks. Researchers have demonstrated prompt injection attacks in AI coding assistants including GitLab Duo, GitHub Copilot Chat, and AI agent platforms like ChatGPT. Prompt injection now ranks as LLM01 in the OWASP Top 10 for LLM Applications, underscoring its severity.

Second, token and credential exposure creates systemic vulnerabilities. TechTarget's analysis of AI code security risks notes that to get useful suggestions, developers might prompt these tools with proprietary code or confidential logic. That input could be stored or later used in model training, potentially leaking secrets. Developers increasingly paste sensitive code or data into public tools, which may use that input for future model training. This phenomenon, referred to as IP leakage and shadow AI, represents a category of risk that barely existed five years ago. Security concerns include API keys, passwords, and tokens appearing in AI-suggested code, along with insecure code patterns like SQL injection, command injection, and path traversal.

Third, the speed of chat-based code generation outpaces human review capacity. Qodo's 2026 analysis of enterprise code review tools observes that AI-assisted development now accounts for nearly 40 per cent of all committed code, and global pull request activity has surged. Leaders frequently report that review capacity, not developer output, is the limiting factor in delivery. When code can be generated faster than it can be reviewed, the natural safeguard of careful human inspection begins to fail.

Chris Wysopal of Veracode, quoted in Dark Reading's analysis, offers stark guidance: “Developers need to treat AI-generated code as potentially vulnerable and follow a security testing and review process as they would for any human-generated code.” The problem is that chat-based development makes this discipline harder to maintain, not easier.

Building Governance for the Conversational Era

The governance frameworks required for AI coding agents in chat environments must operate at multiple levels simultaneously. They must define who can invoke agents, what those agents can access, how their outputs are reviewed, and what audit trails must be maintained. According to Deloitte's 2025 analysis, only 9 per cent of enterprises have reached what they call a “Ready” level of AI governance maturity. That is not because 91 per cent of companies are lazy, but because they are trying to govern something that moves faster than their governance processes.

The Augment Code framework for enterprise AI code governance identifies several essential components. Usage policies must clearly define which AI tools are permitted and for what capacity, specify acceptable use cases (distinguishing between prototyping and production code), ensure that AI-generated code is clearly identifiable, and limit use of AI-generated code in sensitive or critical components such as authentication modules or financial systems.

A clear policy should define approved use cases. For example, organisations might allow AI assistants to generate boilerplate code, documentation, or test scaffolding, but disallow use in implementing core cryptography, authentication flows, or handling credentials. Governance controls should specify which AI tools are permitted and for what capacity, define acceptable use cases, ensure that AI-generated code is clearly identifiable, and limit use of AI-generated code in sensitive or critical components.

Automated enforcement becomes crucial when human review cannot keep pace. DX's enterprise adoption guidelines recommend configurable rulesets that allow organisations to encode rules for style, patterns, frameworks, security, and compliance. Review agents check each diff in the IDE and pull request against these rules, flagging or blocking non-compliant changes. Standards can be managed centrally and applied across teams and repositories.

The most successful engineering organisations in 2025, according to Qodo's analysis, shifted routine review load off senior engineers by automatically approving small, low-risk, well-scoped changes, whilst routing schema updates, cross-service changes, authentication logic, and contract modifications to humans. AI review must categorise pull requests by risk, flag unrelated changes bundled in the same request, and selectively automate approvals under clearly defined conditions.

This tiered approach preserves human ownership of critical decisions whilst enabling AI acceleration of routine work. As the Qodo analysis notes, a well-governed AI code review system preserves human ownership of the merge button whilst raising the baseline quality of every pull request, reduces back-and-forth, and ensures reviewers only engage with work that genuinely requires their experience.

Regulatory pressure is accelerating the formalisation of these practices. The European Data Protection Board's 2025 guidance provides criteria for identifying privacy risks, classifying data, and evaluating consequences. It emphasises controlling inputs to LLM systems to avoid exposing personal information, trade secrets, or intellectual property. The NIST framework, SOC2 certifications, and ISO/IEC 42001 compliance all have their place in enterprise AI governance. Regulations like HIPAA, PCI DSS, and GDPR are forcing organisations to take AI security seriously, with logging, audit trails, and principle of least privilege becoming not just best practices but legal requirements.

Architectural Patterns for Auditability

The technical architecture of AI coding agents in chat environments must be designed from the ground up with auditability in mind. This is not merely a compliance requirement; it is a precondition for maintaining engineering integrity in an era of automated code generation.

The concept of provenance bills of materials (PBOMs) is gaining traction as a way to track AI-generated code from commit to deployment. As Substack's Software Analyst newsletter explains, standards for AI-BOM tracking are forming under NIST and OWASP influence. Regulatory pressure from the EU Cyber Resilience Act and similar US initiatives will push organisations to document the provenance of AI code.

Qodo's enterprise review framework emphasises that automated tools must produce artifacts that reviewers and compliance teams can rely on, including referenced code snippets, security breakdowns, call-site lists, suggested patches, and an audit trail for each workflow action. In large engineering organisations, these artifacts become the verifiable evidence needed for governance, incident review, and policy enforcement. Effective monitoring and logging ensure accountability by linking AI-generated code to developers, inputs, and decisions for audit and traceability.

The OWASP Top 10 for Large Language Model Applications, updated for 2025, provides specific guidance for securing AI-generated code. The project notes that prompt injection remains the number one concern in securing LLMs, underscoring its critical importance in generative AI security. The framework identifies insecure output handling as a key vulnerability: neglecting to validate LLM outputs may lead to downstream security exploits, including code execution that compromises systems and exposes data. Attack scenarios include cross-site scripting, SQL injection, or code execution via unsafe LLM output, as well as LLM-generated Markdown or HTML enabling malicious script injection.

Mitigation strategies recommended by OWASP include treating the model as a user, adopting a zero-trust approach, and ensuring proper input validation for any responses from the model to backend functions. Organisations should encode the model's output before delivering it to users to prevent unintended code execution and implement content filters to eliminate vulnerabilities like cross-site scripting and SQL injection in LLM-generated outputs. Following the OWASP Application Security Verification Standard guidelines with a focus on input sanitisation is essential. Incorporating Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) into the development process helps identify vulnerabilities early.

The principle of least privilege takes on new dimensions when applied to AI agents. Slack's security documentation for AI features emphasises that AI interactions are protected by enterprise-grade safety and security frameworks, providing layered protection across every prompt and response. These protections include content thresholds to avoid hallucinations, prompt instructions that reinforce safe behaviour, provider-level mitigations, context engineering to mitigate prompt injection vulnerabilities, URL filtering to reduce phishing risk, and output validation.

Slack's Real-Time Search API, coming in early 2026, will allow organisations to build custom AI applications that maintain enterprise security standards, providing real-time search access that allows users to interact with data directly. Crucially, when access to a sensitive document is revoked, that change is reflected in the user's next query across all AI systems without waiting for overnight sync jobs.

Preserving Intentionality in the Age of Automation

Perhaps the most subtle but significant challenge of chat-based AI development is the erosion of intentionality. When code could only be written through deliberate effort in an IDE, every line represented a considered decision. When code can be summoned through casual conversation, the distinction between intention and impulse begins to blur.

The JetBrains 2025 survey reveals telling statistics about developer attitudes. Among concerns about AI coding tools, 23 per cent cite inconsistent code quality, 18 per cent point to limited understanding of complex logic, 13 per cent worry about privacy and security, 11 per cent fear negative effects on their skills, and 10 per cent note lack of context awareness. Developers want to delegate mundane tasks to AI but prefer to stay in control of more creative and complex ones. Meanwhile, 68 per cent of developers anticipate that AI proficiency will become a job requirement, and 90 per cent report saving at least an hour weekly using AI tools.

This preference for maintained control reflects a deeper understanding of what makes software development valuable: not the typing, but the thinking. The Pragmatic Engineer newsletter's analysis of how AI-assisted coding will change software engineering observes that the best developers are not the ones who reject AI or blindly trust it. They are the ones who know when to lean on AI and when to think deeply themselves.

The shift to chat-based development creates particular challenges for this discernment. In an IDE, the boundary between human thought and AI suggestion remains relatively clear. In a chat environment, where multiple participants may contribute to a thread, the provenance of each requirement becomes harder to trace. The Capgemini analysis of AI agents in software development emphasises that autonomy in this context refers to systems that self-organise, adapt, and collaborate to achieve a shared goal. The goal is not to automate the whole software development lifecycle, but specific tasks where developers benefit from automation.

This targeted approach requires organisational discipline that many companies have not yet developed. IBM's documentation on the benefits of ChatOps notes that it offers automated workflows, centralised communication, real-time monitoring, and security and compliance features. But it also warns of ChatOps dangers and the need for organisational protocols and orchestrators for governed LLM infrastructure use. Critical security implications include data exposure and the need for internal models or strict rules.

The risk is that replacing traditional development with chat-based AI could lead to unmanaged infrastructure if companies do not have proper protocols and guardrails in place for LLM usage. DevOps.com's analysis of AI-powered DevSecOps warns that automated compliance checks may miss context-specific security gaps, leading to non-compliance in highly regulated industries. Organisations should integrate AI-driven governance tools with human validation to maintain accountability and regulatory alignment.

The Human-in-the-Loop Imperative

The emerging consensus among security researchers and enterprise architects is that AI coding agents in chat environments require what is termed a “human-in-the-loop” approach for any sensitive operations. This is not a rejection of automation, but a recognition of its proper boundaries.

Slack's security documentation for its Agentforce product, available since early 2025, describes AI interactions protected by enterprise-grade guardrails. These include content thresholds to avoid hallucinations, prompt instructions that reinforce safe behaviour, and output validation. However, the documentation acknowledges that these technical controls are necessary but not sufficient. The company uses third-party large language models hosted within secure AWS infrastructure, with LLMs that do not retain any information from requests, and customer data is never used to train third-party LLMs.

The Obsidian Security analysis of AI agent security risks identifies identity-based attacks, especially involving stolen API keys and OAuth tokens, as a rapidly growing threat vector for enterprises using AI agents. In one notable incident, attackers exploited Salesloft-Drift OAuth tokens, which granted them access to hundreds of downstream environments. The blast radius of this supply chain attack was ten times greater than previous incidents.

Best practices for mitigating these risks include using dynamic, context-aware authentication such as certificate-based authentication, implementing short-lived tokens with automatic rotation, and most importantly, requiring human approval for sensitive operations. As the analysis notes, security mitigations should include forcing context separation by splitting different tasks to different LLM instances, employing the principle of least privilege for agents, taking a human-in-the-loop approach for approving sensitive operations, and filtering input for text strings commonly used in prompt injections.

The Unit 42 research team at Palo Alto Networks has documented how context attachment features can be vulnerable to indirect prompt injection. To set up this injection, threat actors first contaminate a public or third-party data source by inserting carefully crafted prompts into the source. When a user inadvertently supplies this contaminated data to an assistant, the malicious prompts hijack the assistant. This hijack could manipulate victims into executing a backdoor, inserting malicious code into an existing codebase, and leaking sensitive information.

This threat model makes clear that human oversight cannot be optional. Even the most sophisticated AI guardrails can be circumvented by adversaries who understand how to manipulate the inputs that AI systems consume.

Redefining Roles for the Agentic Era

As AI coding agents become embedded in everyday workflows, the roles of developers, product managers, and technical leaders are being fundamentally redefined. The DevOps community discussion on the evolution from Copilot to autonomous AI suggests that developers' roles may shift to guiding these agents as “intent engineers” or “AI orchestrators.”

This transition requires new skills and new organisational structures. The AWS DevOps blog's analysis of the AI-driven development lifecycle identifies levels of AI autonomy similar to autonomous driving: Level 0 involves no AI-assisted automation; Level 1 provides AI-assisted options where the developer is in full control and receives recommendations; Level 2 involves AI-assisted selection where AI selects pre-defined options; Level 3 provides AI-based partial automation where AI selects options in simple standard cases; and Level 4 involves AI-based full automation where AI operates without the developer. Currently, Levels 1 and 2 are the most common, Level 3 is on the rise, and Level 4 is considered rather unrealistic for complex, industrial-scale software.

The key insight, as articulated in the Capgemini analysis, is that the future is not about AI replacing developers. It is about AI becoming an increasingly capable collaborator that can take initiative whilst still respecting human guidance and expertise. The most effective teams are those that learn to set clear boundaries and guidelines for their AI agents, establish strong architectural patterns, create effective feedback loops, and maintain human oversight whilst leveraging AI autonomy.

This balance requires governance structures that did not exist in the pre-AI era. The Legit Security analysis of DevOps governance emphasises that hybrid governance combines centralised standards with decentralised execution. You standardise core practices like identity management, secure deployment, and compliance monitoring, whilst letting teams adjust the rest to fit their workflows. This balances consistency with agility to support collaboration across diverse environments.

For product managers and non-technical stakeholders, the new environment demands greater technical literacy without the pretence of technical expertise. Whilst AI tools can generate features and predict patterns, the critical decisions about how to implement these capabilities to serve real human needs still rest firmly in human hands. The danger is that casual @mentions become a way of avoiding this responsibility, outsourcing judgment to systems that cannot truly judge.

Towards a Disciplined Future

The integration of AI coding agents into collaboration platforms like Slack represents an inflection point in the history of software development. The potential benefits are enormous: faster iteration, broader participation in the development process, and reduced friction between conception and implementation. But these benefits come with risks that are only beginning to be understood.

The statistics point to a trajectory that cannot be reversed. The global AI agents market reached $7.63 billion in 2025 and is projected to hit $50.31 billion by 2030, according to industry analyses cited by the Cloud Security Alliance. McKinsey's research shows that 88 per cent of organisations now use AI in at least one function, up from 55 per cent in 2023. The question is not whether AI coding agents will become ubiquitous in collaborative environments, but whether organisations will develop the governance maturity to deploy them safely.

The path forward requires action on multiple fronts. First, organisations must implement tiered permission systems that treat AI agents with the same rigour applied to human access, or greater. The principle of least privilege must be extended to every bot that can touch code. Second, audit trails must be comprehensive and immutable, documenting every AI-generated change, who requested it, and what review it received. Third, human approval must remain mandatory for any changes to critical systems, regardless of how convenient chat-based automation might be.

Perhaps most importantly, organisations must resist the cultural pressure to treat chat-based code generation as equivalent to traditional development. The discipline of code review, the intentionality of careful architecture, and the accountability of clear ownership were never bureaucratic obstacles to progress. They were the foundations of engineering integrity.

IT Pro's analysis of AI software development in 2026 warns that developer teams still face significant challenges with adoption, security, and quality control. The Knostic analysis of AI coding assistant governance notes that governance frameworks matter more for AI code generation than traditional development tools because the technology introduces new categories of risk. Without clear policies, teams make inconsistent decisions about when to use AI, how to validate outputs, and what constitutes acceptable generated code.

The convenience of asking an AI to write code in a Slack channel is seductive. But convenience has never been the highest virtue in software engineering. Reliability, security, and maintainability are what distinguish systems that endure from those that collapse. As AI coding agents proliferate through our collaboration platforms, the organisations that thrive will be those that remember this truth, even as they embrace the power of automation.

The next time a product manager types “@CodingBot” into a Slack channel, the response should not be automatic code generation. It should be a series of questions: What is the business justification? Has this been reviewed by security? What is the rollback plan? Is human approval required? Only with these safeguards in place can chat-driven development realise its potential without becoming a vector for chaos.

---

References and Sources

1. JetBrains. “The State of Developer Ecosystem 2025.” https://devecosystem-2025.jetbrains.com/
2. Dark Reading. “As Coders Adopt AI Agents, Security Pitfalls Lurk in 2026.” https://www.darkreading.com/application-security/coders-adopt-ai-agents-security-pitfalls-lurk-2026
3. Slack. “Securing the Agentic Enterprise.” https://slack.com/blog/transformation/securing-the-agentic-enterprise
4. GitHub. “November 2025 Copilot Roundup.” https://github.com/orgs/community/discussions/180828
5. MIT News. “Can AI Really Code? Study Maps the Roadblocks to Autonomous Software Engineering.” July 2025. https://news.mit.edu/2025/can-ai-really-code-study-maps-roadblocks-to-autonomous-software-engineering-0716
6. Bain and Company. “From Pilots to Payoff: Generative AI in Software Development.” 2025. https://www.bain.com/insights/from-pilots-to-payoff-generative-ai-in-software-development-technology-report-2025/
7. McKinsey. “How an AI-Enabled Software Product Development Life Cycle Will Fuel Innovation.” https://www.mckinsey.com/industries/technology-media-and-telecommunications/our-insights/how-an-ai-enabled-software-product-development-life-cycle-will-fuel-innovation
8. Cloud Security Alliance. “Fortifying the Agentic Web: A Unified Zero-Trust Architecture for AI.” September 2025. https://cloudsecurityalliance.org/blog/2025/09/12/fortifying-the-agentic-web-a-unified-zero-trust-architecture-against-logic-layer-threats
9. Cloud Security Alliance. “Agentic AI and Zero Trust.” August 2025. https://cloudsecurityalliance.org/blog/2025/08/07/agentic-ai-and-zero-trust
10. Checkmarx. “2025 CISO Guide to Securing AI-Generated Code.” https://checkmarx.com/blog/ai-is-writing-your-code-whos-keeping-it-secure/
11. IBM. “2025 Cost of a Data Breach Report.” https://www.ibm.com/reports/data-breach
12. OWASP. “Top 10 for Large Language Model Applications.” https://owasp.org/www-project-top-10-for-large-language-model-applications/
13. TechTarget. “Security Risks of AI-Generated Code and How to Manage Them.” https://www.techtarget.com/searchsecurity/tip/Security-risks-of-AI-generated-code-and-how-to-manage-them
14. Qodo. “AI Code Review Tools Compared: Context, Automation, and Enterprise Scale.” 2026. https://www.qodo.ai/blog/best-ai-code-review-tools-2026/
15. Augment Code. “AI Code Governance Framework for Enterprise Dev Teams.” https://www.augmentcode.com/guides/ai-code-governance-framework-for-enterprise-dev-teams
16. WorkOS. “AI Agent Access Control: How to Manage Permissions Safely.” https://workos.com/blog/ai-agent-access-control
17. Cerbos. “Access Control and Permission Management for AI Agents.” https://www.cerbos.dev/blog/permission-management-for-ai-agents
18. Obsidian Security. “Top AI Agent Security Risks and How to Mitigate Them.” https://www.obsidiansecurity.com/blog/ai-agent-security-risks
19. Palo Alto Networks Unit 42. “The Risks of Code Assistant LLMs: Harmful Content, Misuse and Deception.” https://unit42.paloaltonetworks.com/code-assistant-llms/
20. Slack Engineering. “Streamlining Security Investigations with Agents.” https://slack.engineering/streamlining-security-investigations-with-agents/
21. DX (GetDX). “AI Code Generation: Best Practices for Enterprise Adoption in 2025.” https://getdx.com/blog/ai-code-enterprise-adoption/
22. Capgemini. “How AI Agents in Software Development Empowers Teams to Do More.” https://www.capgemini.com/insights/expert-perspectives/how-ai-agents-in-software-development-empowers-teams-to-do-more/
23. DevOps.com. “AI-Powered DevSecOps: Navigating Automation, Risk and Compliance in a Zero-Trust World.” https://devops.com/ai-powered-devsecops-navigating-automation-risk-and-compliance-in-a-zero-trust-world/
24. Legit Security. “DevOps Governance: Importance and Best Practices.” https://www.legitsecurity.com/aspm-knowledge-base/devops-governance
25. IT Pro. “AI Could Truly Transform Software Development in 2026.” https://www.itpro.com/software/development/ai-software-development-2026-vibe-coding-security
26. Knostic. “Governance for Your AI Coding Assistant.” https://www.knostic.ai/blog/ai-coding-assistant-governance
27. Slack. “Security for AI Features in Slack.” https://slack.com/help/articles/28310650165907-Security-for-AI-features-in-Slack
28. InfoWorld. “85% of Developers Use AI Regularly.” https://www.infoworld.com/article/4077352/85-of-developers-use-ai-regularly-jetbrains-survey.html

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

In November 2025, a mysterious country music act named Breaking Rust achieved something unprecedented: the AI-generated song “Walk My Walk” topped Billboard's Country Digital Song Sales chart, marking the first time an artificial intelligence creation had claimed the number one position on any Billboard chart. The track, produced entirely without human performers using generative AI tools for vocals, instrumentation, and lyrics, reached its peak with approximately 3,000 digital downloads. That same month, Xania Monet, an AI R&B artist created using the Suno platform, became the first known AI artist to earn enough radio airplay to debut on a Billboard radio chart, entering the Adult R&B Airplay ranking at number 30.

These milestones arrived not with fanfare but with an uncomfortable silence from an industry still grappling with what they mean. The charts that have long served as the music industry's primary measure of success had been successfully penetrated by entities that possess neither lived experience nor artistic intention in any conventional sense. The question that follows is not merely whether AI can achieve commercial validation through existing distribution and ranking systems. It clearly can. The more unsettling question is what this reveals about those systems themselves, and whether the metrics the industry has constructed to measure success have become so disconnected from traditional notions of artistic value that they can no longer distinguish between human creativity and algorithmic output.

From Smoky Clubs to Algorithmic Playlists

The music industry has always operated through gatekeeping structures. For most of the twentieth century, these gates were controlled by human intermediaries: A&R executives who discovered talent in smoky clubs, radio programmers who decided which songs reached mass audiences, music journalists who shaped critical discourse, and record label executives who determined which artists received investment and promotion. These gatekeepers were imperfect, often biased, and frequently wrong, but they operated according to evaluative frameworks that at least attempted to assess artistic merit alongside commercial potential.

The transformation began with digital distribution and accelerated with streaming. By the early 2020s, the typical song on the Billboard Hot 100 derived approximately 73 per cent of its chart position from streaming, 25 per cent from radio airplay, and a mere 2 per cent from digital sales. This represented a dramatic inversion from the late 1990s, when radio airplay accounted for 75 per cent of a song's chart fortunes. Billboard's methodology has continued to evolve, with the company announcing in late 2025 that effective January 2026, the ratio between paid subscription and ad-supported on-demand streaming would be adjusted to 1:2.5, further cementing streaming's dominance whilst simultaneously prompting YouTube to withdraw its data from Billboard charts in protest over what it characterised as unfair undervaluation of ad-supported listening. The metrics that now crown hits are fundamentally different in character: stream counts, skip rates, playlist additions, save rates, and downstream consumption patterns. These are measures of engagement behaviour, not assessments of artistic quality.

Streaming platforms have become what scholars describe as the “new gatekeepers” of the music industry. Unlike their predecessors, these platforms wield what researchers Tiziano Bonini and Alessandro Gandini term “algo-torial power,” a fusion of algorithmic and curatorial capabilities that far exceeds the influence of traditional intermediaries. Spotify alone, commanding approximately 35 per cent of the global streaming market in 2025, manages over 3,000 official editorial playlists, with flagship lists like Today's Top Hits commanding over 34 million followers. A single placement on such a playlist can translate into millions of streams overnight, with artists reporting that high positions on editorial playlists generate cascading effects across their entire catalogues.

Yet the balance has shifted even further toward automation. Since 2017, Spotify has developed what it calls “Algotorial” technology, combining human editorial expertise with algorithmic personalisation. The company reports that over 81 per cent of users cite personalisation as what they value most about the platform. The influence of human-curated playlists has declined correspondingly. Major music labels have reported significant drops in streams from flagship playlists like RapCaviar and Dance Hits, signalling a fundamental change in how listeners engage with curated content. Editorial playlists, whilst still powerful, often feature songs for only about a week, limiting their long-term impact compared to algorithmic recommendation systems that continuously surface content based on listening patterns.

This shift has consequences for what can succeed commercially. Algorithmic recommendation systems favour predictable structures and familiar sonic elements. Data analysis suggests songs that maintain listener engagement within the first 30 seconds receive preferential treatment, incentivising shorter introductions and immediate hooks, often at the expense of nuanced musical development.

Artists and their teams are encouraged to optimise for “asset rank,” a function of user feedback reflecting how well a song performs in particular consumption contexts. The most successful strategies involve understanding algorithmic nuances, social media marketing, and digital engagement techniques.

Into this optimisation landscape, AI-generated music arrives perfectly suited. Systems like Suno, the platform behind both Xania Monet and numerous other AI artists, can produce content calibrated to the precise engagement patterns that algorithms reward. The music need not express lived experience or demonstrate artistic growth. It need only trigger the behavioural signals that platforms interpret as success.

When 97 Per Cent of Ears Cannot Distinguish

In November 2025, French streaming service Deezer commissioned what it described as the world's first survey focused on perceptions and attitudes toward AI-generated music. Conducted by Ipsos across 9,000 participants in eight countries, the study produced a startling headline finding: when asked to listen to three tracks and identify which was fully AI-generated, 97 per cent of respondents failed.

A majority of participants (71 per cent) expressed surprise at this result, whilst more than half (52 per cent) reported feeling uncomfortable at their inability to distinguish machine-made music from human creativity. The findings carried particular weight given the survey's scale and geographic breadth, spanning markets with different musical traditions and consumption patterns.

The implications extend beyond parlour game failures. If listeners cannot reliably identify AI-generated music, then the primary quality filter that has historically separated commercially successful music from unsuccessful music has been compromised. Human audiences, consciously or not, have traditionally evaluated music according to criteria that include emotional authenticity, creative originality, and the sense that a human being is communicating something meaningful.

If AI can convincingly simulate these qualities to most listeners, then the market mechanism that was supposed to reward genuine artistic achievement has become unreliable.

Research from MIT Media Lab exposed participants to both AI and human music under various labelling conditions, finding that participants were significantly more likely to rate human-composed music as more effective at eliciting target emotional states, regardless of whether they knew the composer's identity. A 2024 study published in PLOS One compared emotional reactions to AI-generated and human-composed music among 88 participants monitored through heart rate, skin conductance, and self-reported emotion.

Both types triggered feelings, but human compositions scored consistently higher for expressiveness, authenticity, and memorability. Many respondents described AI music as “technically correct” but “emotionally flat.” The distinction between technical competence and emotional resonance emerged as a recurring theme across multiple research efforts, suggesting that whilst AI can successfully mimic surface-level musical characteristics, deeper qualities associated with human expression remain more elusive.

These findings suggest that humans can perceive meaningful differences when prompted to evaluate carefully. But streaming consumption is rarely careful evaluation. It is background listening during commutes, ambient accompaniment to work tasks, algorithmic playlists shuffling in the background of social gatherings. In these passive consumption contexts, the distinctions that laboratory studies reveal may not register at all.

The SyncVault 2025 Trends Report found that 74 per cent of content creators now prefer to license music from identifiable human composers, citing creative trust and legal clarity. A survey of 100 music industry insiders found that 98 per cent consider it “very important” to know if music is human-made, and 96 per cent would consider paying a premium for a human-verified music service. Industry professionals, at least, believe the distinction matters. Whether consumers will pay for that distinction in practice remains uncertain.

Four Stakeholders, Four Incompatible Scorecards

The chart success of AI-generated music exposes a deeper fragmentation: different stakeholder groups in the music industry operate according to fundamentally different definitions of what “success” means, and these definitions are becoming increasingly incompatible.

For streaming platforms and their algorithms, success is engagement. A successful track is one that generates streams, maintains listener attention, triggers saves and playlist additions, and encourages downstream consumption. These metrics are agnostic about the source of the music. An AI-generated track that triggers the right engagement patterns is, from the platform's perspective, indistinguishable from a human creation that does the same. The platform's business model depends on maximising time spent listening, regardless of whether that listening involves human artistry or algorithmic simulation.

For record labels and investors, success is revenue. The global music market reached $40.5 billion in 2024, with streaming accounting for 69 per cent of global recorded music revenues, surpassing $20 billion for the first time. Goldman Sachs projects the market will reach $110.8 billion by 2030.

In this financial framework, AI music represents an opportunity to generate content with dramatically reduced labour costs. An AI artist requires no advances, no touring support, no management of creative disagreements or personal crises. As Victoria Monet observed when commenting on AI artist Xania Monet, “our time is more finite. We have to rest at night. So, the eight hours, nine hours that we're resting, an AI artist could potentially still be running, studying, and creating songs like a machine.”

Hallwood Media, the company that signed Xania Monet to a reported $3 million deal, is led by Neil Jacobson, formerly president of Geffen Records. The company has positioned itself at the forefront of AI music commercialisation, also signing imoliver, described as the top-streaming “music designer” on Suno, in what was characterised as the first traditional label signing of an AI music creator. Jacobson framed these moves as embracing innovation, stating that imoliver “represents the future of our medium.”

For traditional gatekeeping institutions like the Grammy Awards, success involves human authorship as a precondition. The Recording Academy clarified in its 66th Rules and Guidelines that “A work that contains no human authorship is not eligible in any Categories.” CEO Harvey Mason Jr. elaborated: “Here's the super easy, headline statement: AI, or music that contains AI-created elements is absolutely eligible for entry and for consideration for Grammy nomination. Period. What's not going to happen is we are not going to give a Grammy or Grammy nomination to the AI portion.”

This creates a category distinction: AI-assisted human creativity can receive institutional recognition, but pure AI generation cannot. The Grammy position attempts to preserve human authorship as a prerequisite for the highest forms of cultural validation.

But this distinction may prove difficult to maintain. If AI tools become sufficiently sophisticated, determining where “meaningful human contribution” begins and ends may become arbitrary. And if AI creations achieve commercial success that rivals or exceeds Grammy-winning human artists, the cultural authority of the Grammy distinction may erode.

For human artists, success often encompasses dimensions that neither algorithms nor financial metrics capture: creative fulfilment, authentic emotional expression, the sense of communicating something true about human experience, and recognition from peers and critics who understand the craft involved.

When Kehlani criticised the Xania Monet deal in a social media post, she articulated this perspective: “There is an AI R&B artist who just signed a multimillion-dollar deal... and the person is doing none of the work.” The objection is not merely economic but existential. Success that bypasses creative labour does not register as success in the traditional artistic sense.

SZA connected her critique to broader concerns, noting that AI technology causes “harm” to marginalised neighbourhoods through the energy demands of data centres. She asked fans not to create AI images or songs using her likeness.

Muni Long questioned why AI artists appeared to be gaining acceptance in R&B specifically, suggesting a genre-specific vulnerability: “It wouldn't be allowed to happen in country or pop.” This observation points to power dynamics within the industry, where some artistic communities may be more exposed to AI disruption than others.

What the Charts Reveal About Themselves

If AI systems can achieve commercial validation through existing distribution and ranking systems without the cultural legitimacy or institutional endorsement traditionally required of human artists, what does this reveal about those gatekeeping institutions?

The first revelation is that commercial gatekeeping has largely decoupled from quality assessment. Billboard charts measure commercial performance. They count downloads, streams, and airplay. They do not and cannot assess whether the music being counted represents artistic achievement.

For most of chart history, this limitation mattered less because commercial success and artistic recognition, whilst never perfectly aligned, operated in the same general neighbourhood. The processes that led to commercial success included human gatekeepers making evaluative judgements about which artists to invest in, which songs to programme, and which acts to promote. AI success bypasses these evaluative filters entirely.

The second revelation concerns the vulnerability of metrics-based systems to manipulation. Billboard's digital sales charts have been targets for manipulation for years. The Country Digital Song Sales chart that Breaking Rust topped requires only approximately 2,500 downloads to claim the number one position.

This is a vestige of an era when iTunes ruled the music industry, before streaming subscription models made downloads a relic. In 2024, downloads accounted for just $329 million according to the RIAA, approximately 2 per cent of US recorded music revenue.

Critics have argued that the situation represents “a Milli Vanilli-level fraud being perpetrated on music consumers, facilitated by Billboard's permissive approach to their charts.” The Saving Country Music publication declared that “Billboard must address AI on the charts NOW,” suggesting the chart organisation is avoiding “gatekeeping” accusations by remaining content with AI encroaching on its rankings without directly addressing the issue.

If the industry's most prestigious measurement system can be topped by AI-generated content with minimal organic engagement, the system's legitimacy as a measure of popular success comes into question.

The third revelation is that cultural legitimacy and commercial success have become separable in ways they previously were not. Throughout the twentieth century, chart success generally brought cultural legitimacy. Artists who topped charts received media attention, critical engagement, and the presumption that their success reflected some form of popular validation.

AI chart success does not translate into cultural legitimacy in the same way. No one regards Breaking Rust as a significant country artist regardless of its chart position. The chart placement functions as a technical achievement rather than a cultural coronation.

This separability creates an unstable situation. If commercial metrics can be achieved without cultural legitimacy, and cultural legitimacy cannot be achieved through commercial metrics alone, then the unified system that connected commercial success to cultural status has fractured. Different stakeholders now operate in different legitimacy frameworks that may be incompatible.

Royalty Dilution and the Economics of Content Flooding

Beyond questions of legitimacy, AI-generated music creates concrete economic pressures on human artists through royalty pool dilution. Streaming platforms operate on pro-rata payment models: subscription revenue enters a shared pool divided according to total streams. When more content enters the system, the per-stream value for all creators decreases.

Deezer has been the most transparent about the scale of this phenomenon. The platform reported receiving approximately 10,000 fully AI-generated tracks daily in January 2025. By April, this had risen to 20,000. By September, 28 per cent of all content delivered to Deezer was fully AI-generated. By November, the figure had reached 34 per cent, representing over 50,000 AI-generated tracks uploaded daily.

These tracks represent not merely competition for listener attention but direct extraction from the royalty pool. Deezer has found that up to 70 per cent of streams generated by fully AI-generated tracks are fraudulent.

The company's Beatdapp co-CEO Morgan Hayduk noted: “Every point of market share is worth a couple hundred million US dollars today. So we're talking about a billion dollars minimum, that's a billion dollars being taken out of a finite pool of royalties.”

The connection between AI music generation and streaming fraud became explicit in September 2024, when a North Carolina musician named Michael Smith was indicted by federal prosecutors over allegations that he used an AI music company to help create “hundreds of thousands” of songs, then used those AI tracks to steal more than $10 million in fraudulent streaming royalty payments since 2017. Manhattan federal prosecutors charged Smith with three counts of wire fraud, wire fraud conspiracy, and money laundering conspiracy, making it the first federal case targeting streaming fraud.

Universal Music Group addressed this threat pre-emptively, placing provisions in agreements with digital service providers that prevent AI-generated content from being counted in the same royalty pools as human artists. UMG chief Lucian Grainge criticised the “exponential growth of AI slop” on streaming services. But artists not represented by major labels may lack similar protections.

A study conducted by CISAC (the International Confederation of Societies of Authors and Composers, representing over 5 million creators worldwide) and PMP Strategy projected that nearly 24 per cent of music creators' revenues are at risk by 2028, representing cumulative losses of 10 billion euros over five years and annual losses of 4 billion euros by 2028 specifically. The study further predicted that generative AI music would account for approximately 20 per cent of music streaming platforms' revenues and 60 per cent of music library revenues by 2028. Notably, CISAC reported that not a single AI developer has signed a licensing agreement with any of the 225 collective management organisations that are members of CISAC worldwide, despite societies approaching hundreds of AI companies with requests to negotiate licences. The model that has sustained recorded music revenues for the streaming era may be fundamentally threatened if AI content continues its current growth trajectory.

Human Artists as Raw Material

The relationship between AI music systems and human artists extends beyond competition. The AI platforms achieving chart success were trained on human creativity. Suno CEO Mikey Shulman acknowledged that the company trains on copyrighted music, stating: “We train our models on medium- and high-quality music we can find on the open internet. Much of the open internet indeed contains copyrighted materials.”

Major record labels responded with landmark lawsuits in June 2024 against Suno and Udio, the two leading AI music generation platforms, seeking damages of up to $150,000 per infringed recording. The legal battle represents one of the most significant intellectual property disputes of the streaming era, with outcomes that could fundamentally reshape how AI companies source training data and how human creators are compensated when their work is used to train commercial AI systems.

This creates a paradox: AI systems that threaten human artists' livelihoods were made possible by consuming those artists' creative output without compensation. The US Copyright Office's May 2025 report provided significant guidance on this matter, finding that training and deploying generative AI systems using copyright-protected material involves multiple acts that could establish prima facie infringement. The report specifically noted that “the use of more creative or expressive works (such as novels, movies, art, or music) is less likely to be fair use than use of factual or functional works” and warned that “making commercial use of vast troves of copyrighted works to produce expressive content that competes with them in existing markets... goes beyond established fair use boundaries.” Yet legal resolution remains distant, and in the interim, AI platforms continue generating content that competes with the human artists whose work trained them.

When Victoria Monet confronted the existence of Xania Monet, an AI persona whose name, appearance, and vocal style bore resemblance to her own, she described an experiment: a friend typed the prompt “Victoria Monet making tacos” into an AI image generator, and the system produced visuals that looked uncannily similar to Xania Monet's promotional imagery.

Whether this reflects direct training on Victoria Monet's work or emergent patterns from broader R&B training data, the practical effect remains the same. An artist's distinctive identity becomes raw material for generating commercial competitors. The boundaries between inspiration, derivation, and extraction blur when machine learning systems can absorb and recombine stylistic elements at industrial scale.

Possible Reckonings and Plausible Futures

The situation the music industry faces is not one problem but many interconnected problems that compound each other. Commercial metrics have been detached from quality assessment. Gatekeeping institutions have lost their filtering function. Listener perception has become unreliable as a quality signal. Royalty economics are being undermined by content flooding. Training data extraction has turned human creativity against its creators. And different stakeholder groups operate according to incompatible success frameworks.

Could widespread AI chart performance actually force a reckoning with how the music industry measures and defines value itself? There are reasons for cautious optimism.

Deezer has positioned itself as the first streaming service to automatically label 100 per cent AI-generated tracks, removing them from algorithmic recommendations and editorial playlists. This represents an attempt to preserve human music's privileged position in the discovery ecosystem. If other platforms adopt similar approaches, AI content might be effectively segregated into a separate category that does not compete directly with human artists.

The EU's AI Act, which entered into force on 1 August 2024, mandates unprecedented transparency about training data. Article 53 requires providers of general-purpose AI models to publish sufficiently detailed summaries of their training data, including content protected by copyright, according to a template published by the European Commission's AI Office in July 2025. Compliance became applicable from 2 August 2025, with the AI Office empowered to verify compliance and issue corrective measures from August 2026, with potential fines reaching 15 million euros or 3 per cent of global annual revenue. The GPAI Code of Practice operationalises these requirements by mandating that providers maintain copyright policies, rely only on lawful data sources, respect machine-readable rights reservations, and implement safeguards against infringing outputs. This transparency requirement could make it harder for AI music platforms to operate without addressing rights holder concerns.

Human premium pricing may emerge as a market response. The survey finding that 96 per cent of music industry insiders would consider paying a premium for human-verified music services suggests latent demand for authenticated human creativity. If platforms can credibly certify human authorship, a tiered market could develop where human music commands higher licensing fees.

Institutional reform remains possible. Billboard could establish separate charts for AI-generated music, preserving the significance of its traditional rankings whilst acknowledging the new category of content. The Recording Academy's human authorship requirement for Grammy eligibility demonstrates that cultural institutions can draw principled distinctions. These distinctions may become more robust if validated by legal and regulatory frameworks.

But there are also reasons for pessimism. Market forces favour efficiency, and AI music production is dramatically more efficient than human creation. If listeners genuinely cannot distinguish AI from human music in typical consumption contexts, there may be insufficient consumer pressure to preserve human-created content.

The 0.5 per cent of streams that AI music currently represents on Deezer, despite comprising 34 per cent of uploads, suggests the content is not yet finding significant audiences. But this could change as AI capabilities improve.

The fragmentation of success definitions may prove permanent. If streaming platforms, financial investors, cultural institutions, and human artists cannot agree on what success means, each group may simply operate according to its own framework, acknowledging the others' legitimacy selectively or not at all.

A track could simultaneously be a chart success, a financial investment, an ineligible Grammy submission, and an object of contempt from human artists. The unified status hierarchy that once organised the music industry could dissolve into parallel status systems that rarely intersect.

What Commercial Metrics Cannot Capture

Perhaps what the AI chart success reveals most clearly is that commercial metrics have always been inadequate measures of what music means. They were useful proxies when the systems generating commercially successful music also contained human judgement, human creativity, and human emotional expression. When those systems can be bypassed by algorithmic optimisation, the metrics are exposed as measuring only engagement behaviours, not the qualities those behaviours were supposed to indicate.

The traditional understanding of musical success included dimensions that are difficult to quantify: the sense that an artist had something to say and found a compelling way to say it, the recognition that creative skill and emotional honesty had produced something of value, the feeling of connection between artist and audience based on shared human experience.

These dimensions were always in tension with commercial metrics, but they were present in the evaluative frameworks that shaped which music received investment and promotion.

AI-generated music can trigger engagement behaviours. It can accumulate streams, achieve chart positions, and generate revenue. What it cannot do is mean something in the way human creative expression means something. It cannot represent the authentic voice of an artist working through lived experience. It cannot reward careful listening with the sense of encountering another human consciousness.

Whether listeners actually care about these distinctions is an empirical question that the market will answer. The preliminary evidence is mixed. The 97 per cent of listeners who cannot identify AI-generated music in blind tests suggest that, in passive consumption contexts, meaning may not be the operative criterion.

But the 80 per cent who agree that AI-generated music should be clearly labelled suggest discomfort with being fooled. And the premium that industry professionals say they would pay for human-verified music suggests that at least some market segments value authenticity.

The reckoning, if it comes, will force the industry to articulate what it believes music is for. If music is primarily engagement content designed to fill attention and generate revenue, then AI-generated music is simply more efficient production of that content. If music is a form of human communication that derives meaning from its human origins, then AI-generated music is a category error masquerading as the real thing.

These are not technical questions that data can resolve. They are value questions that different stakeholders will answer differently.

What seems certain is that the status quo cannot hold. The same metrics that crown hits cannot simultaneously serve as quality filters when algorithmic output can game those metrics. The same gatekeeping institutions cannot simultaneously validate commercial success and preserve human authorship requirements when commercial success becomes achievable without human authorship. The same royalty pools cannot sustain human artists if flooded with AI content competing for the same finite attention and revenue.

The chart success of AI-generated music is not the end of human music. It is the beginning of a sorting process that will determine what human music is worth in a world where its commercial position can no longer be assumed. That process will reshape not just the music industry but our understanding of what distinguishes human creativity from its algorithmic simulation.

The answer we arrive at will say as much about what we value as listeners and as a culture as it does about the capabilities of the machines.

---

References and Sources

1. Billboard. “How Many AI Artists Have Debuted on Billboard's Charts?” https://www.billboard.com/lists/ai-artists-on-billboard-charts/

2. Billboard. “AI Artist Xania Monet Debuts on Adult R&B Airplay – a Radio Chart Breakthrough.” https://www.billboard.com/music/chart-beat/ai-artist-xania-monet-debut-adult-rb-airplay-chart-1236102665/

3. Billboard. “AI Music Artist Xania Monet Signs Multimillion-Dollar Record Deal.” https://www.billboard.com/pro/ai-music-artist-xania-monet-multimillion-dollar-record-deal/

4. Billboard. “The 10 Biggest AI Music Stories of 2025: Suno & Udio Settlements, AI on the Charts & More.” https://www.billboard.com/lists/biggest-ai-music-stories-2025-suno-udio-charts-more/

5. Billboard. “AI Music Artists Are on the Charts, But They Aren't That Popular – Yet.” https://www.billboard.com/pro/ai-music-artists-charts-popular/

6. Billboard. “Kehlani Slams AI Artist Xania Monet Over $3 Million Record Deal Offer.” https://www.billboard.com/music/music-news/kehlani-slams-ai-artist-xania-monet-million-record-deal-1236071158/

7. Bensound. “Human vs AI Music: Data, Emotion & Authenticity in 2025.” https://www.bensound.com/blog/human-generated-music-vs-ai-generated-music/

8. CBS News. “People can't tell AI-generated music from real thing anymore, survey shows.” https://www.cbsnews.com/news/ai-generated-music-real-thing-cant-tell/

9. CBS News. “New Grammy rule addresses artificial intelligence.” https://www.cbsnews.com/news/grammy-rule-artificial-intelligence-only-human-creators-eligible-awards/

10. CISAC. “Global economic study shows human creators' future at risk from generative AI.” https://www.cisac.org/Newsroom/news-releases/global-economic-study-shows-human-creators-future-risk-generative-ai

11. Deezer Newsroom. “Deezer and Ipsos study: AI fools 97% of listeners.” https://newsroom-deezer.com/2025/11/deezer-ipsos-survey-ai-music/

12. Deezer Newsroom. “Deezer: 28% of all delivered music is now fully AI-generated.” https://newsroom-deezer.com/2025/09/28-fully-ai-generated-music/

13. GOV.UK. “The impact of algorithmically driven recommendation systems on music consumption and production.” https://www.gov.uk/government/publications/research-into-the-impact-of-streaming-services-algorithms-on-music-consumption/

14. Hollywood Reporter. “Hallwood Media Signs Record Deal With an 'AI Music Designer.'” https://www.hollywoodreporter.com/music/music-industry-news/hallwood-inks-record-deal-ai-music-designer-imoliver-1236328964/

15. IFPI. “Global Music Report 2025.” https://globalmusicreport.ifpi.org/

16. Medium (Anoxia Lau). “The Human Premium: What 100 Music Insiders Reveal About the Real Value of Art in the AI Era.” https://anoxia2.medium.com/the-human-premium-what-100-music-insiders-reveal-about-the-real-value-of-art-in-the-ai-era-c4e12a498c4a

17. MIT Media Lab. “Exploring listeners' perceptions of AI-generated and human-composed music.” https://www.media.mit.edu/publications/exploring-listeners-perceptions-of-ai-generated-and-human-composed-music-for-functional-emotional-applications/

18. Music Ally. “UMG boss slams 'exponential growth of AI slop' on streaming services.” https://musically.com/2026/01/09/umg-boss-slams-exponential-growth-of-ai-slop-on-streaming-services/

19. Music Business Worldwide. “50,000 AI tracks flood Deezer daily.” https://www.musicbusinessworldwide.com/50000-ai-tracks-flood-deezer-daily-as-study-shows-97-of-listeners-cant-tell-the-difference-between-human-made-vs-fully-ai-generated-music/

20. Rap-Up. “Baby Tate & Muni Long Push Back Against AI Artist Xania Monet.” https://www.rap-up.com/article/baby-tate-muni-long-xania-monet-ai-artist-backlash

21. SAGE Journals (Bonini & Gandini). “First Week Is Editorial, Second Week Is Algorithmic: Platform Gatekeepers and the Platformization of Music Curation.” https://journals.sagepub.com/doi/full/10.1177/2056305119880006

22. Saving Country Music. “Billboard Must Address AI on the Charts NOW.” https://savingcountrymusic.com/billboard-must-address-ai-on-the-charts-now/

23. Spotify Engineering. “Humans + Machines: A Look Behind the Playlists Powered by Spotify's Algotorial Technology.” https://engineering.atspotify.com/2023/04/humans-machines-a-look-behind-spotifys-algotorial-playlists

24. TIME. “No, AI Artist Breaking Rust's 'Walk My Walk' Is Not a No. 1 Hit.” https://time.com/7333738/ai-country-song-breaking-rust-walk-my/

25. US Copyright Office. “Copyright and Artificial Intelligence Part 3: Generative AI Training.” https://www.copyright.gov/ai/

26. WIPO Magazine. “How AI-generated songs are fueling the rise of streaming farms.” https://www.wipo.int/en/web/wipo-magazine/articles/how-ai-generated-songs-are-fueling-the-rise-of-streaming-farms-74310

27. Yahoo Entertainment. “Kehlani, SZA Slam AI Artist Xania Monet's Multimillion-Dollar Record Deal.” https://www.yahoo.com/entertainment/music/articles/kehlani-sza-slam-ai-artist-203344886.html

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

The stablecoin transaction that moved $2 billion from Abu Dhabi to Binance in May 2025 looked nothing like what the cypherpunks imagined when they dreamed of digital money. There were no anonymous wallets, no cryptographic rituals, no ideological manifestos. MGX, a sovereign wealth vehicle backed by the United Arab Emirates, simply wired funds denominated in USD1, a stablecoin issued by World Liberty Financial, a company affiliated with the family of the sitting United States President. The transaction settled on blockchain rails that neither party needed to understand or even acknowledge. The technology had become invisible. The revolution had been absorbed.

This moment crystallises the central tension now confronting the cryptocurrency industry as it enters what many are calling its institutional era. Stablecoins processed over $46 trillion in transactions during 2025, rivalling Visa and PayPal in volume. BlackRock's Bitcoin ETF surpassed $100 billion in assets under management, accumulating over 800,000 BTC in less than two years. The GENIUS Act became the first major cryptocurrency legislation passed by Congress, establishing federal standards for stablecoin issuers. Tokenised real-world assets reached $33 billion, with projections suggesting the market could hit $16 trillion by 2030. By every conventional measure, cryptocurrency has succeeded beyond its founders' wildest projections.

Yet success has arrived through a mechanism that would have horrified many of those founders. Crypto went mainstream by becoming invisible, as the a16z State of Crypto 2025 report observed. The technology that was supposed to disintermediate banks now powers their backend operations. The protocol designed to resist surveillance now integrates with anti-money laundering systems. The culture that celebrated pseudonymity now onboards users through email addresses and social logins. The question is whether this represents maturation or betrayal, evolution or erasure.

The Infrastructure Thesis Ascendant

The economic evidence for the invisibility approach has become overwhelming. Stripe's $1.1 billion acquisition of Bridge in February 2025 represented the payments industry's first major acknowledgement that stablecoins could serve as mainstream infrastructure rather than speculative instruments. Within three months, Stripe launched Stablecoin Financial Accounts across 101 countries, enabling businesses to hold balances in USDC and USDB while transacting seamlessly across fiat and crypto rails. The blockchain was there, handling settlement. The users never needed to know.

This pattern has repeated across traditional finance. Visa partnered with Bridge to launch card-issuing products that let cardholders spend their stablecoin balances at any merchant accepting Visa, with automatic conversion to fiat happening invisibly in the background. Klarna announced plans to issue its own stablecoin through Bridge, aiming to reduce cross-border payment costs that currently total roughly $120 billion annually. The fintech giant would become the first bank to tap Stripe's stablecoin stack for blockchain-powered payments, without requiring its customers to understand or interact with blockchain technology directly.

BlackRock has been equally explicit about treating cryptocurrency as infrastructure rather than product. Larry Fink, the firm's chief executive, declared following the Bitcoin ETF approval that “every stock and bond would eventually live on a shared digital ledger.” The company's BUIDL fund, launched on Ethereum in March 2024, has grown to manage over $2 billion in tokenised treasury assets. BlackRock has announced plans to tokenise up to $10 trillion in assets, expanding across multiple blockchain networks including Arbitrum and Polygon. For institutional investors accessing these products, the blockchain is simply plumbing, no more visible or culturally significant than the TCP/IP protocols underlying their email.

The speed of this integration has astonished even bullish observers. Bitcoin and Ethereum spot ETFs accumulated $31 billion in net inflows while processing approximately $880 billion in trading volume during 2025. An estimated 716 million people now own digital assets globally, a 16 percent increase from the previous year. More than one percent of all US dollars now exist as stablecoins on public blockchains. The numbers describe a technology that has crossed from interesting experiment to systemic relevance.

The regulatory environment has reinforced this trajectory. The GENIUS Act, signed into law in July 2025, establishes stablecoin issuers as regulated financial entities subject to the Bank Secrecy Act, with mandatory anti-money laundering programmes, sanctions compliance, and customer identification requirements. Payment stablecoins issued under the framework are explicitly not securities or commodities, freeing them from SEC and CFTC oversight while embedding them within the traditional banking regulatory apparatus. The Act requires permitted issuers to maintain one-to-one reserves in US currency or similarly liquid assets and to publish monthly disclosure of reserve details. This is not the regulatory vacuum that early cryptocurrency advocates hoped would allow decentralised alternatives to flourish. It is integration, absorption, normalisation.

The Cultural Counter-Argument

Against this backdrop of institutional triumph, a parallel ecosystem continues to thrive on explicitly crypto-native principles. Pump.fun, the Solana memecoin launchpad, has facilitated the creation of over 13 million tokens since January 2024, generating more than $866 million in lifetime revenue by October 2025. At its peak, the platform accounted for nearly 90 percent of all token mints on Solana and over 80 percent of launchpad trading volume. Its July 2025 ICO raised $1.3 billion in combined private and public sales, with the $PUMP presale hauling in $500 million in minutes at a fully diluted valuation of approximately $4 billion.

This is not infrastructure seeking invisibility. This is spectacle, culture, community, identity. The meme coin total market capitalisation exceeded $78 billion in 2025, with projects like Fartcoin briefly reaching $2.5 billion in valuation. These assets have no intrinsic utility beyond their function as coordination mechanisms for communities united by shared jokes, aesthetics, and speculative conviction. They are pure culture, and their continued prominence suggests that crypto's cultural layer retains genuine economic significance even as institutional rails proliferate.

The mechanics of attention monetisation have evolved dramatically. In January 2025, a single social media post about the $TRUMP token, launched through a one-click interface on Solana, generated hundreds of millions in trading volume within hours. This represented something genuinely new: the near-instantaneous conversion of social attention into financial activity. The friction that once separated awareness from action has been reduced to a single tap.

Re7 Capital, a venture firm that has invested in Suno and other infrastructure projects, launched a $10 million SocialFi fund in 2025 specifically targeting this intersection of social platforms and blockchain participation. As Luc de Leyritz, the firm's general partner, explained: “For the first time in five years, we see a structural opportunity in early-stage crypto venture, driven by the convergence of attention, composability and capital flows in SocialFi.” The thesis is that platforms enabling rapid conversion of social attention into financial activity represent the next major adoption vector, one that preserves rather than erases crypto's cultural distinctiveness.

Farcaster exemplifies this approach. The decentralised social protocol, backed by $150 million from Paradigm and a16z, has grown to over 546,000 registered users with approximately 40,000 to 60,000 daily active users. Its defining innovation, Farcaster Frames, enables users to mint NFTs, execute trades, and claim tokens directly within social posts without leaving the application. This is not crypto becoming invisible; this is crypto becoming the medium of social interaction itself. The blockchain is not hidden infrastructure but visible identity, with on-chain activities serving as signals of community membership and cultural affiliation.

The tension between these approaches has become central to debates about crypto's future direction. Vitalik Buterin, Ethereum's co-founder, addressed this directly in a New Year's message urging the community to focus on building applications that are “truly decentralised and usable” rather than “winning the next meta.” He outlined practical tests for decentralisation: Can users keep their assets if the company behind an application disappears? How much damage can rogue insiders or compromised front-ends cause? How many lines of code must be trusted to protect users' funds?

These questions expose the gap between infrastructure and culture approaches. Invisible blockchain rails, by definition, rely on intermediaries that users must trust. When Stripe converts stablecoin balances to fiat for Visa transactions, when BlackRock custodies Bitcoin on behalf of ETF holders, when Klarna issues blockchain-powered payments, the technology may be decentralised but the user experience is not. The cypherpunk vision of individuals controlling their own keys, verifying their own transactions, and resisting surveillance has been traded for convenience and scale.

The Cypherpunk Inheritance

To understand what is at stake requires revisiting cryptocurrency's ideological origins. Bitcoin was not born in a vacuum; it emerged from decades of cypherpunk research, debate, and experimentation. The movement's core creed was simple: do not ask permission, build the system. Do not lobby politicians for privacy laws; create technologies that make surveillance impossible. Every point of centralisation was understood as a point of weakness, a chokepoint where power could be exercised by states or corporations against individuals.

Satoshi Nakamoto's 2008 whitepaper directly reflected these principles. By combining cryptography, decentralised consensus, and economic incentives, Bitcoin solved the double-spending problem without requiring a central authority. The vision was censorship-resistant money that allowed individuals to transact privately and securely without permission from governments or corporations. Self-custody was not merely an option but the point. The option to be your own bank, to verify rather than trust, remained open to anyone willing to exercise it.

The cypherpunks were deeply suspicious of any centralised authority, whether government agency or large bank. They saw the fight for freedom in the digital age as a technical problem, not merely a political one. Privacy, decentralisation, self-sovereignty, transparency through open-source code: these were not just preferences but foundational principles. Any compromise on these fronts represented potential capture by the very systems they sought to escape.

The success and commercialisation of Bitcoin has fractured this inheritance. Some argue that compliance with Know Your Customer requirements, integration with regulated exchanges, and accommodation of institutional custody represents necessary compromise to bring cryptocurrency to the masses and achieve mainstream legitimacy. Without these accommodations, Bitcoin would remain a niche asset forever locked out of the global financial system.

For the purist camp, this represents betrayal. Building on-ramps that require identity verification creates a surveillance network around technology designed to be pseudonymous. It links real-world identity to on-chain transactions, destroying privacy. The crypto space itself struggles with centralisation through major exchanges, custodial wallets, and regulatory requirements that conflict with the original vision.

By 2025, Bitcoin's price exceeded $120,000, driven substantially by institutional adoption through ETFs and a maturing investor base. BlackRock's IBIT has accumulated holdings representing 3.8 percent of Bitcoin's total 21 million supply. This is not the distributed ownership pattern the cypherpunks envisioned. Power has concentrated in new hands, different from but not obviously preferable to the financial institutions cryptocurrency was designed to circumvent.

Decentralised Social and the Identity Layer

If invisible infrastructure represents one future and pure speculation another, decentralised social platforms represent an attempt at synthesis. Lens Protocol, launched by the team behind the DeFi lending platform Aave, provides a social graph enabling developers to build applications with composable, user-owned content. Running on Polygon, Lens offers creators direct monetisation through subscriptions, fees from followers, and the ability to turn posts into tradable NFTs. Top users on the protocol average $1,300 monthly in creator earnings, demonstrating that blockchain participation can generate real economic value beyond speculation.

The proposition is that social identity becomes inseparable from on-chain identity. Your follower graph, your content, your reputation travel with you across applications built on the same underlying protocol. When you switch from one Lens-based application to another, you bring your audience and history. No platform can deplatform you because no platform owns your identity. This is decentralisation as lived experience rather than backend abstraction.

Farcaster offers a complementary model focused on protocol-level innovation. Three smart contracts on OP Mainnet handle security-critical functions: IdRegistry maps Farcaster IDs to Ethereum custody addresses, StorageRegistry tracks storage allocations, and KeyRegistry manages application permissions. The infrastructure is explicitly on-chain, but the user experience has been refined to approach consumer-grade accessibility. Account abstraction and social logins mean new users can start with just an email address, reducing time to first transaction from twenty minutes to under sixty seconds.

The platform's technical architecture reflects deliberate choices about where blockchain visibility matters. Storage costs approximately seven dollars per year for 5,000 posts plus reactions and follows, low enough to be accessible but high enough to discourage spam. The identity layer remains explicitly on-chain, ensuring that users maintain control over their credentials even as the application layer becomes increasingly polished.

The engagement metrics suggest these approaches resonate with users who value explicit blockchain participation. Farcaster's engagement rate of 29 interactions per user monthly compares favourably to Lens's 12, indicating higher-quality community even with smaller absolute numbers. The platform recently achieved a milestone of 100,000 funded wallets, driven partly by USDC deposit matching rewards that incentivise users to connect their financial identity to their social presence.

Yet the scale gap with mainstream platforms remains vast. Bluesky's 38 million users dwarf Farcaster's half million. Twitter's daily active users number in the hundreds of millions. For crypto-native social platforms to represent a meaningful alternative rather than a niche experiment, they must grow by orders of magnitude while preserving the properties that differentiate them. The question is whether those properties are features or bugs in the context of mainstream adoption.

The Stablecoin Standardisation

Stablecoins offer the clearest lens on how the invisibility thesis is playing out in practice. The market has concentrated heavily around two issuers: Tether's USDT holds approximately 60 percent market share with a capitalisation exceeding $183 billion, while Circle's USDC holds roughly 25 percent at $73 billion. Together, these two tokens account for over 80 percent of total stablecoin market capitalisation, though that share has declined slightly as competition intensifies.

Tether dominates trading volume, accounting for over 75 percent of stablecoin activity on centralised exchanges. It remains the primary trading pair in emerging markets and maintains higher velocity on exchanges. But USDC has grown faster in 2025, with its market cap climbing 72 percent compared to USDT's 32 percent growth. Analysts attribute this to USDC's better positioning for regulated markets, particularly after USDT faced delistings in Europe due to lack of MiCA authorisation.

Circle's billion-dollar IPO marked the arrival of stablecoin issuers as mainstream financial institutions. The company's aggressive expansion into regulated markets positions USDC as the stablecoin of choice for banks, payment processors, and fintech platforms seeking compliance clarity. This is crypto becoming infrastructure in the most literal sense: a layer enabling transactions that end users never need to understand or acknowledge.

The overall stablecoin supply hit $314 billion in 2025, with the category now comprising 30 percent of all on-chain crypto transaction volume. August 2025 recorded the highest annual volume to date, reaching over $4 trillion for the year, an 83 percent increase on the same period in 2024. Tether alone saw $10 billion in profit in the first three quarters of the year. These are not metrics of a speculative sideshow but of core financial infrastructure.

The emergence of USD1, the stablecoin issued by World Liberty Financial with Trump family involvement, demonstrates how completely stablecoins have departed from crypto's countercultural origins. The token reached $3 billion in circulating supply within six months of launch, integrated with major exchanges including Binance and Tron. Its largest transaction to date, the $2 billion MGX investment in Binance, involved sovereign wealth funds, presidential family businesses, and what senators have alleged are suspicious ties to sanctioned entities. This is not disruption of financial power structures; it is their reconfiguration under blockchain labels.

The GENIUS Act's passage has accelerated this normalisation. By establishing clear regulatory frameworks, the legislation removes uncertainty that previously discouraged traditional financial institutions from engaging with stablecoins. But it also embeds stablecoins within the surveillance and compliance infrastructure that cryptocurrency was originally designed to escape. Issuers must implement anti-money laundering programmes, verify sanctions lists, and identify customers. The anonymous, permissionless transactions that defined early Bitcoin are not merely discouraged but legally prohibited for regulated stablecoin issuers.

The Tokenisation Transformation

Real-world asset tokenisation extends the invisibility thesis from currency into securities. BlackRock's BUIDL fund demonstrated that tokenised treasury assets could attract institutional capital at scale. By year-end 2025, the tokenised RWA market had grown to approximately $33 billion, with the majority concentrated in private credit and US Treasuries representing nearly 90 percent of tokenised value. The market has grown fivefold in two years, crossing from interesting experiment to systemic relevance.

The projections are staggering. A BCG-Ripple report forecasts the tokenised asset market growing from $0.6 trillion to $18.9 trillion by 2033. Animoca Brands research suggests tokenisation could eventually tap into the $400 trillion traditional finance market. Franklin Templeton, Fidelity, and other major asset managers have moved beyond pilots into production-level tokenisation of treasury products.

For institutional investors, the value proposition is efficiency: faster settlement, lower costs, continuous trading availability, fractional ownership. None of these benefits require understanding or caring about blockchain technology. The distributed ledger is simply superior infrastructure for recording ownership and executing transfers. It replaces databases, not ideologies.

This creates an interesting inversion of the original cryptocurrency value proposition. Bitcoin promised to separate money from state control. Tokenisation of real-world assets brings state-sanctioned securities onto blockchain rails, with all their existing regulatory requirements, reporting obligations, and institutional oversight intact. The technology serves traditional finance rather than replacing it.

Major financial institutions including JPMorgan, Goldman Sachs, and BNY Mellon are actively engaging in real-world asset tokenisation. Banks treat blockchain not as novelty but as infrastructure, part of the normal toolkit for financial services. Fintech companies supply connective logic between traditional systems and decentralised networks. Stablecoins, once regarded as a temporary bridge, now operate as permanent fixtures of the financial order.

The Dual Economy

What emerges from this analysis is not a single trajectory but a bifurcation. Two distinct crypto economies now operate in parallel, occasionally intersecting but fundamentally different in their relationship to culture, identity, and visibility.

The institutional economy treats blockchain as infrastructure. Its participants include BlackRock, Fidelity, Stripe, Visa, JPMorgan, and the growing ecosystem of regulated stablecoin issuers and tokenisation platforms. Value accrues through efficiency gains, cost reductions, and access to previously illiquid assets. Users of these products may never know they are interacting with blockchain technology. The culture is that of traditional finance: compliance-focused, institution-mediated, invisible.

The crypto-native economy treats blockchain as culture. Its participants include memecoin traders, decentralised social network users, DeFi power users, and communities organised around specific protocols and tokens. Value accrues through attention, community formation, and speculative conviction. Users of these products explicitly identify with blockchain participation, often displaying on-chain activity as markers of identity and affiliation. The culture is distinctively countercultural: permissionless, community-driven, visible.

DeFi total value locked surged 41 percent in Q3 2025, surpassing $160 billion for the first time since May 2022. Ethereum led growth with TVL jumping from $54 billion in July to $96.5 billion by September. Aave became the largest DeFi lending protocol with over $41 billion in TVL, growing nearly 58 percent since July. Lido ranked second with nearly $39 billion in liquid staking deposits. These are substantial numbers, demonstrating that crypto-native applications retain significant capital commitment even as institutional alternatives proliferate.

The question is whether these economies can coexist indefinitely or whether one will eventually absorb the other. The institutional thesis holds that crypto-native culture is a transitional phenomenon, the early-adopter enthusiasm that accompanies any new technology before it matures into invisible utility. By this view, memecoin speculation and decentralised social experiments are the equivalent of early internet flame wars and personal homepage culture: interesting historical artefacts that give way to professionally operated services as the technology scales.

The counter-thesis holds that crypto-native culture provides irreplaceable competitive advantages. Community formation around tokens creates user loyalty that traditional products cannot match. On-chain identity enables new forms of coordination, reputation, and governance. The transparency of blockchain operations enables trustlessness that opaque corporate structures cannot replicate. By this view, invisible infrastructure misses the point entirely, stripping away the properties that make cryptocurrency distinctive and valuable.

Evaluating Maturation

The debate ultimately hinges on what one considers maturation. If maturation means achieving mainstream adoption, measurable in transaction volumes, market capitalisation, and institutional participation, then the invisibility approach has clearly succeeded. Stablecoins rival Visa in volume. Bitcoin ETFs hold hundreds of billions in assets. Regulated tokenisation platforms are processing institutional-scale transactions. By these metrics, cryptocurrency has grown up.

But maturation can also mean the development of distinctive capabilities rather than assimilation into existing paradigms. By this measure, invisibility represents not maturation but abandonment. The technology that was supposed to disrupt financial intermediation has instead been adopted by intermediaries. The protocol designed to resist censorship integrates with surveillance systems. The culture celebrating individual sovereignty has been absorbed into institutional custody arrangements.

Vitalik Buterin's tests for decentralisation offer a framework for evaluating these competing claims. The walk-away test asks whether users keep their assets if the company behind an application disappears. For BlackRock ETF holders, the answer is clearly no; they hold shares in a fund that custodies assets on their behalf. For self-custody Bitcoin holders, the answer is yes by design. The insider attack test asks how much damage rogue insiders or compromised front-ends can cause. Invisible infrastructure necessarily involves more trusted intermediaries and therefore more potential attack surfaces.

The trusted computing base question asks how many lines of code must be trusted to protect users. Institutional products layer complexity upon complexity: custody arrangements, trading interfaces, fund structures, regulatory compliance systems. Each layer requires trust. The original Bitcoin thesis was that you needed to trust only the protocol itself, verifiable through open-source code and distributed consensus.

Yet crypto-native applications are not immune from these concerns. DeFi protocols have suffered billions in losses through exploits, rug pulls, and governance attacks. Memecoin platforms like Pump.fun face class-action lawsuits alleging manipulation. Decentralised social networks struggle with spam, harassment, and content moderation challenges that their permissionless architecture makes difficult to address. The choice is not between trustless perfection and trusted compromise but between different configurations of trust, risk, and capability.

The Cultural Residue

Perhaps the most honest assessment is that crypto culture will persist as aesthetic residue even as the technology becomes invisible infrastructure. Early-adopter communities will continue to celebrate on-chain participation as identity markers, much as vintage computing enthusiasts celebrate command-line interfaces in an era of graphical operating systems. The technical capability for self-custody and trustless verification will remain available to those who value it, even as the overwhelming majority of users interact through intermediated products that abstract away complexity.

This is not necessarily a tragedy. Other technologies have followed similar trajectories. The internet began as a countercultural space where early adopters celebrated decentralisation and resisted commercialisation. Today, most users access the internet through devices and services controlled by a handful of corporations, but the underlying protocols remain open and the option for direct participation persists for those motivated to exercise it.

The question is whether this residual option matters. If only a tiny fraction of users ever exercise self-custody or participate in decentralised governance, does the theoretical availability of these options provide meaningful protection against centralised control? Or does the concentration of practical usage in institutional channels create the same capture risks that cryptocurrency was designed to prevent?

The $2 billion stablecoin transaction from MGX to Binance suggests an answer that satisfies neither purists nor institutionalists. The technology worked exactly as designed: value transferred across borders instantly and irrevocably, settled on a distributed ledger that neither party needed to understand. But the participants were sovereign wealth funds and exchange conglomerates, the transaction enabled by presidential family connections, and the regulatory framework that of traditional anti-money laundering compliance. This is not what the cypherpunks imagined, but it is what cryptocurrency has become.

Whether that represents maturation or abandonment depends entirely on what one hoped cryptocurrency would achieve. If the goal was efficient global payments infrastructure, the invisible approach has delivered. If the goal was liberation from institutional financial control, the invisible approach has failed precisely by succeeding. The technology escaped the sandbox of speculation and entered the real world, but the real world captured it in return.

The builders who will succeed in this environment are likely those who understand both economies and can navigate between them. Stripe's acquisition of Bridge demonstrates that institutional players recognise the value of crypto infrastructure even when stripped of cultural signifiers. Pump.fun's billion-dollar raise demonstrates that crypto-native culture retains genuine economic value even when disconnected from institutional approval. The most durable projects may be those that maintain optionality: invisible enough to achieve mainstream adoption, crypto-native enough to retain community loyalty, flexible enough to serve users with radically different relationships to the underlying technology.

The original vision has not been abandoned so much as refracted. It persists in self-custody options that most users ignore, in decentralised protocols that institutions build upon, in cultural communities that thrive in parallel with institutional rails. Cryptocurrency did not mature into a single thing. It matured into multiple things simultaneously, serving different purposes for different participants, with different relationships to the values that animated its creation.

Whether the cultural layer remains competitive advantage or becomes mere nostalgia will be determined not by technology but by the choices users make about what they value. If convenience consistently trumps sovereignty, the invisible approach will dominate and crypto culture will become historical curiosity. If enough users continue to prioritise decentralisation, self-custody, and explicit blockchain participation, the cultural layer will persist as more than aesthetic. The technology enables both futures. The question is which one we will choose.

---

References and Sources

1. a16z crypto. “State of Crypto 2025: The year crypto went mainstream.” October 2025. https://a16zcrypto.com/posts/article/state-of-crypto-report-2025/

2. Re7 Capital. “The Future of Crypto is Social.” https://re7.capital/blog/the-future-of-crypto-is-social/

3. The Block. “Re7 Capital bets on SocialFi with a $10 million fund targeting around 30 startups.” 2025. https://www.theblock.co/post/352562/re7-capital-socialfi-fund-crypto

4. CNBC. “Stripe closes $1.1 billion Bridge deal, prepares for aggressive stablecoin push.” February 2025. https://www.cnbc.com/2025/02/04/stripe-closes-1point1-billion-bridge-deal-prepares-for-stablecoin-push-.html

5. Stripe Newsroom. “Introducing Stablecoin Financial Accounts in 101 countries.” 2025. https://stripe.com/blog/introducing-stablecoin-financial-accounts

6. The White House. “Fact Sheet: President Donald J. Trump Signs GENIUS Act into Law.” July 2025. https://www.whitehouse.gov/fact-sheets/2025/07/fact-sheet-president-donald-j-trump-signs-genius-act-into-law/

7. Morgan Lewis. “GENIUS Act Passes in US Congress: A Breakdown of the Landmark Stablecoin Law.” July 2025. https://www.morganlewis.com/pubs/2025/07/genius-act-passes-in-us-congress-a-breakdown-of-the-landmark-stablecoin-law

8. Business Wire. “World Liberty Financial's Stablecoin $USD1 Crosses $3 Billion in Market Capitalization.” December 2025. https://www.businesswire.com/news/home/20251225249806/en/World-Liberty-Financials-Stablecoin-USD1-Crosses-3-Billion-in-Market-Capitalization

9. CNBC. “Trump's World Liberty Financial jumps into stablecoin game with USD1 reveal.” March 2025. https://www.cnbc.com/2025/03/25/trumps-world-liberty-financial-jumps-into-stablecoin-game-with-usd1-reveal.html

10. The Block. “BlackRock's bitcoin ETF surpasses 800,000 BTC in assets under management after $4 billion inflow streak.” 2025. https://www.theblock.co/post/373966/blackrock-bitcoin-etf-ibit-800000-btc-aum

11. CoinDesk. “RWA Tokenization Is Going to Trillions Much Faster Than You Think.” February 2025. https://www.coindesk.com/opinion/2025/02/07/rwa-tokenization-is-going-to-trillions-much-faster-than-you-think

12. The Block. “Pump.fun surpasses $800 million in lifetime revenue as Solana memecoin launchpad competition heats up.” 2025. https://www.theblock.co/post/367585/pump-fun-surpasses-800-million-in-lifetime-revenue-as-solana-memecoin-launchpad-competition-heats-up

13. CoinDesk. “Vitalik Buterin: Ethereum at Risk If Decentralization Is Just a Catchphrase.” July 2025. https://www.coindesk.com/tech/2025/07/02/vitalik-buterin-ethereum-at-risk-if-decentralization-is-just-a-catchphrase

14. CryptoSlate. “10 stories that rewired digital finance in 2025 – the year crypto became infrastructure.” 2025. https://cryptoslate.com/10-stories-that-rewired-digital-finance-in-2025-the-year-crypto-became-infrastructure/

15. BlockEden. “Farcaster in 2025: The Protocol Paradox.” October 2025. https://blockeden.xyz/blog/2025/10/28/farcaster-in-2025-the-protocol-paradox/

16. Crystal Intelligence. “USDT vs USDC Q3 2025: Market Share & Dominance Analysis.” 2025. https://crystalintelligence.com/thought-leadership/usdt-maintains-dominance-while-usdc-faces-headwinds/

17. CoinDesk. “Tether and Circle's Dominance Is Being Put to the Test.” October 2025. https://www.coindesk.com/opinion/2025/10/11/tether-and-circle-s-dominance-is-being-put-to-the-test

18. The Defiant. “DeFi TVL Surges 41% in Q3 to Three-Year High.” 2025. https://thedefiant.io/news/defi/defi-tvl-surges-41-in-q3-to-three-year-high

19. PYMNTS. “Making Sense of Meme Coins, Digital Assets and Crypto's Future.” 2025. https://www.pymnts.com/cryptocurrency/2025/making-sense-meme-coins-digital-assets-crypto-future/

20. D-Central. “Bitcoin and the Cypherpunks – A Journey Towards Decentralisation and Privacy.” https://d-central.tech/bitcoin-and-the-cypherpunks/

21. World Economic Forum. “How will the GENIUS Act work in the US and impact the world?” July 2025. https://www.weforum.org/stories/2025/07/stablecoin-regulation-genius-act/

22. Andreessen Horowitz. “What Stripe's Acquisition of Bridge Means for Fintech and Stablecoins.” April 2025. https://a16z.com/newsletter/what-stripes-acquisition-of-bridge-means-for-fintech-and-stablecoins-april-2025-fintech-newsletter/

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

In November 2025, Grammy-winning artist Victoria Monet sat for an interview with Vanity Fair and confronted something unprecedented in her fifteen-year career. Not a rival artist. Not a legal dispute over songwriting credits. Instead, she faced an algorithmic apparition: an AI-generated persona called Xania Monet, whose name, appearance, and vocal style bore an uncanny resemblance to her own. “It's hard to comprehend that, within a prompt, my name was not used for this artist to capitalise on,” Monet told the magazine. “I don't support that. I don't think that's fair.”

The emergence of Xania Monet, who secured a $3 million deal with Hallwood Media and became the first AI artist to debut on a Billboard radio chart, represents far more than a curiosity of technological progress. It exposes fundamental inadequacies in how intellectual property law conceives of artistic identity, and it reveals the emergence of business models specifically designed to exploit zones of legal ambiguity around voice, style, and likeness. The question is no longer whether AI can approximate human creativity. The question is what happens when that approximation becomes indistinguishable enough to extract commercial value from an artist's foundational assets while maintaining plausible deniability about having done so.

The controversy arrives at a moment when the music industry is already grappling with existential questions about AI. Major record labels have filed landmark lawsuits against AI music platforms. European courts have issued rulings that challenge the foundations of how AI companies operate. Congress is debating legislation that would create the first federal right of publicity in American history. And streaming platforms face mounting evidence that AI-generated content is flooding their catalogues, diluting the royalty pool that sustains human artists. Xania Monet sits at the intersection of all these forces, a test case for whether our existing frameworks can protect artistic identity in an age of sophisticated machine learning.

The Anatomy of Approximation

Victoria Monet's concern centres on something that existing copyright law struggles to address: the space between direct copying and inspired derivation. Copyright protects specific expressions of ideas, not the ideas themselves. It cannot protect a vocal timbre, a stylistic approach to melody, or the ineffable quality that makes an artist recognisable across their catalogue. You can copyright a particular song, but you cannot copyright the essence of how Victoria Monet sounds.

This legal gap has always existed, but it mattered less when imitation required human effort and inevitably produced human variation. A singer influenced by Monet would naturally develop their own interpretations, their own quirks, their own identity over time. But generative AI systems can analyse thousands of hours of an artist's work and produce outputs that capture stylistic fingerprints with unprecedented fidelity. The approximation can be close enough to trigger audience recognition without being close enough to constitute legal infringement.

The technical process behind this approximation involves training neural networks on vast corpora of existing music. These systems learn to recognise patterns across multiple dimensions simultaneously: harmonic progressions, rhythmic structures, timbral characteristics, production techniques, and vocal stylings. The resulting model does not store copies of the training data in any conventional sense. Instead, it encodes statistical relationships that allow it to generate new outputs exhibiting similar characteristics. This architecture creates a genuine conceptual challenge for intellectual property frameworks designed around the notion of copying specific works.

Xania Monet exemplifies this phenomenon. The vocals and instrumental music released under her name are created using Suno, the AI music generation platform. The lyrics come from Mississippi poet and designer Telisha Jones, who serves as the creative force behind the virtual persona. But the sonic character, the R&B vocal stylings, the melodic sensibilities that drew comparisons to Victoria Monet, emerge from an AI system trained on vast quantities of existing music. In an interview with Gayle King, Jones defended her creative role, describing Xania Monet as “an extension of myself” and framing AI as simply “a tool, an instrument” to be utilised.

Victoria Monet described a telling experiment: a friend typed the prompt “Victoria Monet making tacos” into ChatGPT's image generator, and the system produced visuals that looked uncannily similar to Xania Monet's promotional imagery. Whether this reflects direct training on Victoria Monet's work or the emergence of stylistic patterns from broader R&B training data, the practical effect remains the same. An artist's distinctive identity becomes raw material for generating commercial competitors.

The precedent for this kind of AI-mediated imitation emerged dramatically in April 2023, when a song called “Heart on My Sleeve” appeared on streaming platforms. Created by an anonymous producer using the pseudonym Ghostwriter977, the track featured AI-generated vocals designed to sound like Drake and the Weeknd. Neither artist had any involvement in its creation. Universal Music Group quickly filed takedown notices citing copyright violation, but the song had already gone viral, demonstrating how convincingly AI could approximate celebrity vocal identities. Ghostwriter later revealed that the actual composition was entirely human-created, with only the vocal filters being AI-generated. The Recording Academy initially considered the track for Grammy eligibility before determining that the AI voice modelling made it ineligible.

The Training Data Black Box

At the heart of these concerns lies a fundamental opacity: the companies building generative AI systems have largely refused to disclose what training data their models consumed. This deliberate obscurity creates a structural advantage. When provenance cannot be verified, liability becomes nearly impossible to establish. When the creative lineage of an AI output remains hidden, artists cannot prove that their work contributed to the system producing outputs that compete with them.

The major record labels, Universal Music Group, Sony Music Entertainment, and Warner Music Group, recognised this threat early. In June 2024, they filed landmark lawsuits against Suno and Udio, the two leading AI music generation platforms, accusing them of “willful copyright infringement at an almost unimaginable scale.” The Recording Industry Association of America alleged that Udio's system had produced outputs with striking similarities to specific protected recordings, including songs by Michael Jackson, the Beach Boys, ABBA, and Mariah Carey. The lawsuits sought damages of up to $150,000 per infringed recording, potentially amounting to hundreds of millions of dollars.

Suno's defence hinged on a revealing argument. CEO Mikey Shulman acknowledged that the company trains on copyrighted music, stating, “We train our models on medium- and high-quality music we can find on the open internet. Much of the open internet indeed contains copyrighted materials.” But he argued this constitutes fair use, comparing it to “a kid writing their own rock songs after listening to the genre.” In subsequent legal filings, Suno claimed that none of the millions of tracks generated on its platform “contain anything like a sample” of existing recordings.

This argument attempts to draw a bright line between the training process and the outputs it produces. Even if the model learned from copyrighted works, Suno contends, the music it generates represents entirely new creations. The analogy to human learning, however, obscures a crucial difference: when humans learn from existing music, they cannot perfectly replicate the statistical patterns of that music's acoustic characteristics. AI systems can. And the scale differs by orders of magnitude. A human musician might absorb influences from hundreds or thousands of songs over a lifetime. An AI system can process millions of tracks and encode their patterns with mathematical precision.

The United States Copyright Office weighed in on this debate with a 108-page report published in May 2025, concluding that using copyrighted materials to train AI models may constitute prima facie infringement and warning that transformative arguments are not inherently valid. Where AI-generated outputs demonstrate substantial similarity to training data inputs, the report suggested, the model weights themselves may infringe reproduction and derivative work rights. The report also noted that the transformative use doctrine was never intended to permit wholesale appropriation of creative works for commercial AI development.

Separately, the Copyright Office had addressed the question of AI authorship. In a January 2025 decision, the office stated that AI-generated work can receive copyright protection “when and if it embodies meaningful human authorship.” This creates an interesting dynamic: the outputs of AI music generation may be copyrightable by the humans who shaped them, even as the training process that made those outputs possible may itself constitute infringement of others' copyrights.

The Personality Protection Gap

The Xania Monet controversy illuminates why copyright law alone cannot protect artists in the age of generative AI. Even if the major label lawsuits succeed in establishing that AI companies must license training data, this would not necessarily protect individual artists from having their identities approximated.

Consider what Victoria Monet actually lost in this situation. The AI persona did not copy any specific song she recorded. It did not sample her vocals. What it captured, or appeared to capture, was something more fundamental: the quality of her artistic presence, the characteristics that make audiences recognise her work. This touches on what legal scholars call the right of publicity, the right to control commercial use of one's name, image, and likeness.

But here the legal landscape becomes fragmented and inadequate. In the United States, there is no federal right of publicity law. Protection varies dramatically by state, with around 30 states providing statutory rights and others relying on common law protections. All 50 states recognise some form of common law rights against unauthorised use of a person's name, image, or likeness, but the scope and enforceability of these protections differ substantially across jurisdictions.

Tennessee's ELVIS Act, which took effect on 1 July 2024, became the first state legislation specifically designed to protect musicians from unauthorised AI replication of their voices. Named in tribute to Elvis Presley, whose estate had litigated to control his posthumous image rights, the law explicitly includes voice as protected property, defining it to encompass both actual voice and AI-generated simulations. The legislation passed unanimously in both chambers of the Tennessee legislature, with 93 ayes in the House and 30 in the Senate, reflecting bipartisan recognition of the threat AI poses to the state's music industry.

Notably, the ELVIS Act contains provisions targeting not just those who create deepfakes without authorisation but also the providers of the systems used to create them. The law allows lawsuits against any person who “makes available an algorithm, software, tool, or other technology, service, or device” whose “primary purpose or function” is creating unauthorised voice recordings. This represents a significant expansion of liability that could potentially reach AI platform developers themselves.

California followed with its own protective measures. In September 2024, Governor Gavin Newsom signed AB 2602, which requires contracts specifying the use of AI-generated digital replicas of a performer's voice or likeness to include specific consent and professional representation during negotiations. The law defines a “digital replica” as a “computer-generated, highly realistic electronic representation that is readily identifiable as the voice or visual likeness of an individual.” AB 1836 prohibits creating or distributing digital replicas of deceased personalities without permission from their estates, extending these protections beyond the performer's lifetime.

Yet these state-level protections remain geographically limited and inconsistently applied. An AI artist created using platforms based outside these jurisdictions, distributed through global streaming services, and promoted through international digital channels exists in a regulatory grey zone. The Copyright Office's July 2024 report on digital replicas concluded there was an urgent need for federal right of publicity legislation protecting all people from unauthorised use of their likeness and voice, noting that the current patchwork of state laws creates “gaps and inconsistencies” that are “far too inconsistent to remedy generative AI commercial appropriation.”

The NO FAKES Act, first introduced in Congress in July 2024 by a bipartisan group of senators including Chris Coons, Marsha Blackburn, Amy Klobuchar, and Thom Tillis, represents the most comprehensive attempt to address this gap at the federal level. The legislation would establish the first federal right of publicity in the United States, providing a national standard to protect creators' likenesses from unauthorised use while allowing control over digital personas for 70 years after death. The reintroduction in April 2025 gained support from an unusual coalition including major record labels, SAG-AFTRA, Google, and OpenAI. Country music artist Randy Travis, whose voice was digitally recreated using AI after a stroke left him unable to sing, appeared at the legislation's relaunch.

But even comprehensive right of publicity protection faces a fundamental challenge: proving that a particular AI persona was specifically created to exploit another artist's identity. Xania Monet's creators have not acknowledged any intention to capitalise on Victoria Monet's identity. The similarity in names could be coincidental. The stylistic resemblances could emerge organically from training on R&B music generally. Without transparency about training data composition, artists face the impossible task of proving a negative.

The Business Logic of Ambiguity

What makes the Xania Monet case particularly significant is what it reveals about emerging business models in AI music. This is not an accidental byproduct of technological progress. It represents a deliberate commercial strategy that exploits the gap between what AI can approximate and what law can protect.

Hallwood Media, the company that signed Xania Monet to her $3 million deal, is led by Neil Jacobson, formerly president of Geffen Records. Hallwood operates as a multi-faceted music company servicing talent through recording, management, publishing, distribution, and merchandising divisions. The company had already invested in Suno and, in July 2025, signed imoliver, described as the top-streaming “music designer” on Suno, in what was billed as the first traditional label signing of an AI music creator. Jacobson positioned these moves as embracing innovation, stating that imoliver “represents the future of our medium. He's a music designer who stands at the intersection of craftwork and taste.”

The distinction between imoliver and Xania Monet is worth noting. Hallwood describes imoliver as a real human creator who uses AI tools, whereas Xania Monet is presented as a virtual artist persona. But in both cases, the commercial model extracts value from AI's ability to generate music at scale with reduced human labour costs.

The economics are straightforward. An AI artist requires no rest, no touring support, no advance payments against future royalties, no management of interpersonal conflicts or creative disagreements. Victoria Monet herself articulated this asymmetry: “It definitely puts creators in a dangerous spot because our time is more finite. We have to rest at night. So, the eight hours, nine hours that we're resting, an AI artist could potentially still be running, studying, and creating songs like a machine.”

Xania Monet's commercial success demonstrates the model's viability. Her song “How Was I Supposed to Know” reached number one on R&B Digital Song Sales and number three on R&B/Hip-Hop Digital Song Sales. Her catalogue accumulated 9.8 million on-demand streams in the United States, with 5.4 million coming in a single tracking week. She became the first AI artist to debut on a Billboard radio chart, entering the Adult R&B Airplay chart at number 30. Her song “Let Go, Let God” debuted at number 21 on Hot Gospel Songs.

For investors and labels, this represents an opportunity to capture streaming revenue without many of the costs associated with human artists. For human artists, it represents an existential threat: the possibility that their own stylistic innovations could be extracted, aggregated, and turned against them in the form of competitors who never tire, never renegotiate contracts, and never demand creative control. The music industry has long relied on finding and developing talent, but AI offers a shortcut that could fundamentally alter how value is created and distributed.

The Industry Response and Its Limits

Human artists have pushed back against AI music with remarkable consistency across genres and career levels. Kehlani took to TikTok to express her frustration about Xania Monet's deal, stating, “There is an AI R&B artist who just signed a multi-million-dollar deal, and has a Top 5 R&B album, and the person is doing none of the work.” She declared that “nothing and no one on Earth will ever be able to justify AI to me.”

SZA expressed environmental and ethical concerns, posting on Instagram that AI technology causes “harm” to marginalised neighbourhoods and asking fans not to create AI images or songs using her likeness. Baby Tate criticised Xania Monet's creator for lacking creativity and authenticity in her music process. Muni Long questioned why AI artists appeared to be gaining acceptance in R&B specifically, asking, “It wouldn't be allowed to happen in country or pop.” She also noted that Xania Monet's Apple Music biography listed her, Keyshia Cole, and K. Michelle as references, adding, “I'm not happy about it at all. Zero percent.”

Beyonce reportedly expressed fear after hearing an AI version of her own voice, highlighting how even artists at the highest commercial tier feel vulnerable to this technology.

This criticism highlights an uncomfortable pattern: the AI music entities gaining commercial traction have disproportionately drawn comparisons to Black R&B artists. Whether this reflects biases in training data composition, market targeting decisions, or coincidental emergence, the effect raises questions about which artistic communities bear the greatest risks from AI appropriation. The history of American popular music includes numerous examples of Black musical innovations being appropriated by white artists and industry figures. AI potentially automates and accelerates this dynamic.

The creator behind Xania Monet has not remained silent. In December 2025, the AI artist released a track titled “Say My Name With Respect,” which directly addressed critics including Kehlani. While the song does not mention Kehlani by name, the accompanying video displayed screenshots of her previous statements about AI alongside comments from other detractors.

The major labels' lawsuits against Suno and Udio remain ongoing, though Universal Music Group announced in 2025 that it had settled with Udio and struck a licensing deal, following similar action by Warner Music Group. These settlements suggest that large rights holders may secure compensation and control over how their catalogues are used in AI training. But individual artists, particularly those not signed to major labels, may find themselves excluded from whatever protections these arrangements provide.

The European Precedent

While American litigation proceeds through discovery and motions, Europe has produced the first major judicial ruling holding an AI developer liable for copyright infringement related to training. On 11 November 2025, the Munich Regional Court ruled largely in favour of GEMA, the German collecting society representing songwriters, in its lawsuit against OpenAI.

The case centred on nine songs whose lyrics ChatGPT could reproduce almost verbatim in response to simple user prompts. The songs at issue included well-known German tracks such as “Atemlos” and “Wie schon, dass du geboren bist.” The court accepted GEMA's argument that training data becomes embedded in model weights and remains retrievable, a phenomenon researchers call “memorisation.” Even a 15-word passage was sufficient to establish infringement, the court found, because such specific text would not realistically be generated from scratch.

Crucially, the court rejected OpenAI's attempt to benefit from text and data mining exceptions applicable to non-profit research. OpenAI argued that while some of its legal entities pursue commercial objectives, the parent company was founded as a non-profit. Presiding Judge Dr Elke Schwager dismissed this argument, stating that to qualify for research exemptions, OpenAI would need to prove it reinvests 100 percent of profits in research and development or operates with a governmentally recognised public interest mandate.

The ruling ordered OpenAI to cease storing unlicensed German lyrics on infrastructure in Germany, provide information about the scope of use and related revenues, and pay damages. The court also ordered that the judgment be published in a local newspaper. Finding that OpenAI had acted with at minimum negligence, the court denied the company a grace period for making the necessary changes. OpenAI announced plans to appeal, and the judgment may ultimately reach the Court of Justice of the European Union. But as the first major European decision holding an AI developer liable for training on protected works, it establishes a significant precedent.

GEMA is pursuing parallel action against Suno in another lawsuit, with a hearing expected before the Munich Regional Court in January 2026. If European courts continue to reject fair use-style arguments for AI training, companies may face a choice between licensing music rights or blocking access from EU jurisdictions entirely.

The Royalty Dilution Problem

Beyond the question of training data rights lies another structural threat to human artists: the dilution of streaming royalties by AI-generated content flooding platforms. Streaming services operate on pro-rata payment models where subscription revenue enters a shared pool divided according to total streams. When more content enters the system, the per-stream value for all creators decreases.

In April 2025, streaming platform Deezer estimated that 18 percent of content uploaded daily, approximately 20,000 tracks, is AI-generated. This influx of low-cost content competes for the same finite pool of listener attention and royalty payments that sustains human artists. In 2024, Spotify alone paid out $10 billion to the music industry, with independent artists and labels collectively generating more than $5 billion from the platform. But this revenue gets divided among an ever-expanding universe of content, much of it now machine-generated.

The problem extends beyond legitimate AI music releases to outright fraud. In a notable case, musician Michael Smith allegedly extracted more than $10 million in royalty payments by uploading hundreds of thousands of AI-generated songs and using bots to artificially inflate play counts. According to fraud detection firm Beatdapp, streaming fraud removes approximately $1 billion annually from the royalty pool.

A global study commissioned by CISAC, the international confederation representing over 5 million creators, projected that while generative AI providers will experience dramatic revenue growth, music creators will see approximately 24 percent of their revenues at risk of loss by 2028. Audiovisual creators face a similar 21 percent risk. This represents a fundamental redistribution of value from human creators to technology platforms, enabled by the same legal ambiguities that allow AI personas to approximate existing artists without liability.

The market for AI in music is expanding rapidly. Global AI in music was valued at $2.9 billion in 2024, with projections suggesting growth to $38.7 billion by 2033 at a compound annual growth rate of 25.8 percent. Musicians are increasingly adopting the technology, with approximately 60 percent utilising AI tools in their projects and 36.8 percent of producers integrating AI into their workflows. But this adoption occurs in the context of profound uncertainty about how AI integration will affect long-term career viability.

The Question of Disclosure

Victoria Monet proposed a simple reform that might partially address these concerns: requiring clear labelling of AI-generated music, similar to how food products must disclose their ingredients. “I think AI music, as it is released, needs to be disclosed more,” she told Vanity Fair. “Like on food, we have labels for organic and artificial so that we can make an informed decision about what we consume.”

This transparency principle has gained traction among legislators. In April 2024, California Representative Adam Schiff introduced the Generative AI Copyright Disclosure Act, which would require AI firms to notify the Copyright Office of copyrighted works used in training at least 30 days before publicly releasing a model. Though the bill did not become law, it reflected growing consensus that the opacity of training data represents a policy problem requiring regulatory intervention.

The music industry's lobbying priorities have coalesced around three demands: permission, payment, and transparency. Rights holders want AI companies to seek permission before training on copyrighted music. They want to be paid for such use through licensing deals. And they want transparency about what data sets models actually use, without which the first two demands cannot be verified or enforced.

But disclosure requirements face practical challenges. How does one audit training data composition at scale? How does one verify that an AI system was not trained on particular artists when the systems themselves may not retain explicit records of their training data? The technical architecture of neural networks does not readily reveal which inputs influenced which outputs. Proving that Victoria Monet's recordings contributed to Xania Monet's stylistic character may be technically impossible even with full disclosure of training sets.

Redefining Artistic Value

Perhaps the most profound question raised by AI music personas is not legal but cultural: what do we value about human artistic creation, and can those values survive technological displacement?

Human music carries meanings that transcend sonic characteristics. When Victoria Monet won three Grammy Awards in 2024, including Best New Artist after fifteen years of working primarily as a songwriter for other performers, that recognition reflected not just the quality of her album Jaguar II but her personal journey, her persistence through years when labels declined to spotlight her, her evolution from writing hits for Ariana Grande to commanding her own audience. “This award was a 15-year pursuit,” she said during her acceptance speech. Her work with Ariana Grande had already earned her three Grammy nominations in 2019, including for Album of the Year for Thank U, Next, but her own artistic identity had taken longer to establish. These biographical dimensions inform how listeners relate to her work.

An AI persona has no such biography. Xania Monet cannot discuss the personal experiences that shaped her lyrics because those lyrics emerge from prompts written by Telisha Jones and processed through algorithmic systems. The emotional resonance of human music often derives from audiences knowing that another human experienced something and chose to express it musically. Can AI-generated music provide equivalent emotional value, or does it offer only a simulation of feeling, convincing enough to capture streams but hollow at its core?

The market appears agnostic on this question, at least in the aggregate. Xania Monet's streaming numbers suggest that significant audiences either do not know or do not care that her music is AI-generated. This consumer indifference may represent the greatest long-term threat to human artists: not that AI music will be legally prohibited, but that it will become commercially indistinguishable from human music in ways that erode the premium audiences currently place on human creativity.

Navigating Forward Without a Map

The emergence of AI personas that approximate existing artists reveals that our legal and cultural frameworks for artistic identity were built for a world that no longer exists. Copyright law assumed that copying required access to specific works and that derivation would be obvious. Right of publicity law assumed that commercial exploitation of identity would involve clearly identifiable appropriation. The economics of music assumed that creating quality content would always require human labour that commands payment.

Each of these assumptions has been destabilised by generative AI systems that can extract stylistic essences without copying specific works, create virtual identities that approximate real artists without explicit acknowledgment, and produce unlimited content at marginal costs approaching zero.

The solutions being proposed represent necessary but insufficient responses. Federal right of publicity legislation, mandatory training data disclosure, international copyright treaty updates, and licensing frameworks for AI training may constrain the most egregious forms of exploitation while leaving the fundamental dynamic intact: AI systems can transform human creativity into training data, extract commercially valuable patterns, and generate outputs that compete with human artists in ways that existing law struggles to address.

Victoria Monet's experience with Xania Monet may become the template for a new category of artistic grievance: the sense of being approximated, of having one's creative identity absorbed into a system and reconstituted as competition. Whether law and culture can evolve quickly enough to protect against this form of extraction remains uncertain. What is certain is that the question can no longer be avoided. The ghost has emerged from the machine, and it wears a familiar face.

---

References and Sources

1. Face2Face Africa. “Victoria Monet criticizes AI artist Xania Monet, suggests it may have been created using her likeness.” https://face2faceafrica.com/article/victoria-monet-criticizes-ai-artist-xania-monet-suggests-it-may-have-been-created-using-her-likeness

2. TheGrio. “Victoria Monet sounds the alarm on Xania Monet: 'I don't support that. I don't think that's fair.'” https://thegrio.com/2025/11/18/victoria-monet-reacts-to-xania-monet/

3. Billboard. “AI Music Artist Xania Monet Signs Multimillion-Dollar Record Deal.” https://www.billboard.com/pro/ai-music-artist-xania-monet-multimillion-dollar-record-deal/

4. Boardroom. “Xania Monet's $3 Million Record Deal Sparks AI Music Debate.” https://boardroom.tv/xania-monet-ai-music-play-by-play/

5. Music Ally. “Hallwood Media sees chart success with AI artist Xania Monet.” https://musically.com/2025/09/18/hallwood-media-sees-chart-success-with-ai-artist-xania-monet/

6. RIAA. “Record Companies Bring Landmark Cases for Responsible AI Against Suno and Udio.” https://www.riaa.com/record-companies-bring-landmark-cases-for-responsible-ai-againstsuno-and-udio-in-boston-and-new-york-federal-courts-respectively/

7. Rolling Stone. “RIAA Sues AI Music Generators For Copyright Infringement.” https://www.rollingstone.com/music/music-news/record-labels-sue-music-generators-suno-and-udio-1235042056/

8. TechCrunch. “AI music startup Suno claims training model on copyrighted music is 'fair use.'” https://techcrunch.com/2024/08/01/ai-music-startup-suno-response-riaa-lawsuit/

9. Skadden. “Copyright Office Weighs In on AI Training and Fair Use.” https://www.skadden.com/insights/publications/2025/05/copyright-office-report

10. U.S. Copyright Office. “Copyright and Artificial Intelligence.” https://www.copyright.gov/ai/

11. Wikipedia. “ELVIS Act.” https://en.wikipedia.org/wiki/ELVIS_Act

12. Tennessee Governor's Office. “Tennessee First in the Nation to Address AI Impact on Music Industry.” https://www.tn.gov/governor/news/2024/1/10/tennessee-first-in-the-nation-to-address-ai-impact-on-music-industry.html

13. ASCAP. “ELVIS Act Signed Into Law in Tennessee To Protect Music Creators from AI Impersonation.” https://www.ascap.com/news-events/articles/2024/03/elvis-act-tn

14. California Governor's Office. “Governor Newsom signs bills to protect digital likeness of performers.” https://www.gov.ca.gov/2024/09/17/governor-newsom-signs-bills-to-protect-digital-likeness-of-performers/

15. Manatt, Phelps & Phillips. “California Enacts a Suite of New AI and Digital Replica Laws.” https://www.manatt.com/insights/newsletters/client-alert/california-enacts-a-host-of-new-ai-and-digital-rep

16. Congress.gov. “NO FAKES Act of 2025.” https://www.congress.gov/bill/119th-congress/house-bill/2794/text

17. Billboard. “NO FAKES Act Returns to Congress With Support From YouTube, OpenAI for AI Deepfake Bill.” https://www.billboard.com/pro/no-fakes-act-reintroduced-congress-support-ai-deepfake-bill/

18. Hollywood Reporter. “Hallwood Media Signs Record Deal With an 'AI Music Designer.'” https://www.hollywoodreporter.com/music/music-industry-news/hallwood-inks-record-deal-ai-music-designer-imoliver-1236328964/

19. Billboard. “Hallwood Signs 'AI Music Designer' imoliver to Record Deal, a First for the Music Business.” https://www.billboard.com/pro/ai-music-creator-imoliver-record-deal-hallwood/

20. Complex. “Kehlani Blasts AI Musician's $3 Million Record Deal.” https://www.complex.com/music/a/jadegomez510/kehlani-xenia-monet-ai

21. Billboard. “Kehlani Slams AI Artist Xania Monet Over $3 Million Record Deal Offer.” https://www.billboard.com/music/music-news/kehlani-slams-ai-artist-xania-monet-million-record-deal-1236071158/

22. Rap-Up. “Baby Tate & Muni Long Push Back Against AI Artist Xania Monet.” https://www.rap-up.com/article/baby-tate-muni-long-xania-monet-ai-artist-backlash

23. Bird & Bird. “Landmark ruling of the Munich Regional Court (GEMA v OpenAI) on copyright and AI training.” https://www.twobirds.com/en/insights/2025/landmark-ruling-of-the-munich-regional-court-(gema-v-openai)-on-copyright-and-ai-training

24. Billboard. “German Court Rules OpenAI Infringed Song Lyrics in Europe's First Major AI Music Ruling.” https://www.billboard.com/pro/gema-ai-music-copyright-case-open-ai-chatgpt-song-lyrics/

25. Norton Rose Fulbright. “Germany delivers landmark copyright ruling against OpenAI: What it means for AI and IP.” https://www.nortonrosefulbright.com/en/knowledge/publications/656613b2/germany-delivers-landmark-copyright-ruling-against-openai-what-it-means-for-ai-and-ip

26. CISAC. “Global economic study shows human creators' future at risk from generative AI.” https://www.cisac.org/Newsroom/news-releases/global-economic-study-shows-human-creators-future-risk-generative-ai

27. WIPO Magazine. “How AI-generated songs are fueling the rise of streaming farms.” https://www.wipo.int/en/web/wipo-magazine/articles/how-ai-generated-songs-are-fueling-the-rise-of-streaming-farms-74310

28. Grammy.com. “2024 GRAMMYs: Victoria Monet Wins The GRAMMY For Best New Artist.” https://www.grammy.com/news/2024-grammys-victoria-monet-best-new-artist-win

29. Billboard. “Victoria Monet Wins Best New Artist at 2024 Grammys: 'This Award Was a 15-Year Pursuit.'” https://www.billboard.com/music/awards/victoria-monet-grammy-2024-best-new-artist-1235598716/

30. Harvard Law School. “AI created a song mimicking the work of Drake and The Weeknd. What does that mean for copyright law?” https://hls.harvard.edu/today/ai-created-a-song-mimicking-the-work-of-drake-and-the-weeknd-what-does-that-mean-for-copyright-law/

31. Variety. “AI-Generated Fake 'Drake'/'Weeknd' Collaboration, 'Heart on My Sleeve,' Delights Fans and Sets Off Industry Alarm Bells.” https://variety.com/2023/music/news/fake-ai-generated-drake-weeknd-collaboration-heart-on-my-sleeve-1235585451/

32. ArtSmart. “AI in Music Industry Statistics 2025: Market Growth & Trends.” https://artsmart.ai/blog/ai-in-music-industry-statistics/

33. Rimon Law. “U.S. Copyright Office Will Accept AI-Generated Work for Registration When and if It Embodies Meaningful Human Authorship.” https://www.rimonlaw.com/u-s-copyright-office-will-accept-ai-generated-work-for-registration-when-and-if-it-embodies-meaningful-human-authorship/

34. Billboard. “AI Artist Xania Monet Fires Back at Kehlani & AI Critics on Prickly 'Say My Name With Respect' Single.” https://www.billboard.com/music/rb-hip-hop/xania-monet-kehlani-ai-artist-say-my-name-with-respect-1236142321/

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

In February 2025, artificial intelligence researcher Andrej Karpathy, co-founder of OpenAI and former AI leader at Tesla, posted a provocative observation on social media. “There's a new kind of coding I call 'vibe coding',” he wrote, “where you fully give in to the vibes, embrace exponentials, and forget that the code even exists.” By November of that year, Collins Dictionary had named “vibe coding” its Word of the Year, recognising how the term had come to encapsulate a fundamental shift in humanity's relationship with technology. As Alex Beecroft, managing director of Collins, explained: “The selection of 'vibe coding' as Collins' Word of the Year perfectly captures how language is evolving alongside technology.”

The concept is beguilingly simple. Rather than writing code line by line, users describe what they want in plain English, and large language models generate the software. Karpathy himself described the workflow with disarming candour: “I just talk to Composer with SuperWhisper so I barely even touch the keyboard. I ask for the dumbest things like 'decrease the padding on the sidebar by half' because I'm too lazy to find it. I 'Accept All' always, I don't read the diffs anymore.” Or, as he put it more succinctly: “The hottest new programming language is English.”

For newsrooms, this represents both an extraordinary opportunity and a profound challenge. The Generative AI in the Newsroom project, a collaborative effort examining when and how to use generative AI in news production, has been tracking these developments closely. Their assessment suggests that 2026's most significant newsroom innovation will not emerge from development teams but from journalists who can now create their own tools. The democratisation of software development promises to unlock creativity and efficiency at unprecedented scale. But it also threatens to expose news organisations to security vulnerabilities, regulatory violations, and ethical failures that could undermine public trust in an industry already battling credibility challenges.

The stakes could hardly be higher. Journalism occupies a unique position in the information ecosystem, serving as a watchdog on power while simultaneously handling some of society's most sensitive information. From whistleblower communications to investigative documents, from source identities to personal data about vulnerable individuals, newsrooms are custodians of material that demands the highest standards of protection. When the barriers to building software tools collapse, the question becomes urgent: how do organisations ensure that the enthusiasm of newly empowered creators does not inadvertently compromise the very foundations of trustworthy journalism?

The Democratisation Revolution

Kerry Oslund, vice president of AI strategy at The E.W. Scripps Company, captured the zeitgeist at a recent industry panel when he declared: “This is the revenge of the English major.” His observation points to a fundamental inversion of traditional power structures in newsrooms. For decades, journalists with story ideas requiring custom tools had to queue for limited development resources, often watching their visions wither in backlogs or emerge months later in compromised form. Vibe coding tools like Lovable, Claude, Bubble AI, and Base44 have shattered that dependency.

The practical implications are already visible. At Scripps, the organisation has deployed over 300 AI “agents” handling complex tasks that once required significant human oversight. Oslund described “agent swarms” where multiple AI agents pass tasks to one another, compiling weekly reports, summarising deltas, and building executive dashboards without human intervention until the final review. The cost savings are tangible: “We eliminated all third-party voice actors and now use synthetic voice with our own talent,” Oslund revealed at a TV News Check panel.

During the same industry gathering, leaders from Gray Media, Reuters, and Stringr discussed similar developments. Gray Media is using AI to increase human efficiency in newsrooms, allowing staff to focus on higher-value journalism while automated systems handle routine tasks.

For community journalism, the potential is even more transformative. The Nieman Journalism Lab's predictions for 2026 emphasise how vibe coding tools have lowered the cost and technical expertise required to build prototypes, creating space for community journalists to experiment with new roles and collaborate with AI specialists. By translating their understanding of audience needs into tangible prototypes, journalists can instruct large language models on the appearance, features, and data sources they require for new tools.

One prominent data journalist, quoted in coverage of the vibe coding phenomenon, expressed the reaction of many practitioners: “Oh my God, this vibe coding thing is insane. If I had this during our early interactive news days, it would have been a godsend. Once you get the hang of it, it's like magic.”

But magic, as any journalist knows, demands scrutiny. As programmer Simon Willison clarified in his analysis: “If an LLM wrote every line of your code, but you've reviewed, tested, and understood it all, that's not vibe coding in my book. That's using an LLM as a typing assistant.” The distinction matters enormously. True vibe coding, where users accept AI-generated code without fully comprehending its functionality, introduces risks that newsrooms must confront directly.

The Security Imperative and Shadow AI

The IBM 2025 Cost of Data Breach Report revealed statistics that should alarm every news organisation considering rapid AI tool adoption. Thirteen percent of organisations reported breaches of AI models or applications, and of those compromised, a staggering 97% reported lacking AI access controls. Perhaps most troubling: one in five organisations reported breaches due to shadow AI, the unsanctioned use of AI tools by employees outside approved governance frameworks.

The concept of shadow AI represents an evolution of the “shadow IT” problem that has plagued organisations for decades. As researchers documented in Strategic Change journal, the progression from shadow IT to shadow AI introduces new threat vectors. AI systems possess intrinsic security vulnerabilities, from the potential compromising of training data to the exploitation of AI models and networks. When employees use AI tools without organisational oversight, these vulnerabilities multiply.

For newsrooms, the stakes are uniquely high. Journalists routinely handle information that could endanger lives if exposed: confidential sources, whistleblower identities, leaked documents revealing government or corporate malfeasance. The 2014 Sony Pictures hack demonstrated how devastating breaches can be, with hackers releasing salaries of employees and Hollywood executives alongside sensitive email traffic. Data breaches in media organisations are particularly attractive to malicious actors because they often contain not just personal information but intelligence with political or financial value.

The Gartner research firm predicts that by 2027, more than 40% of AI-related data breaches will be caused by improper use of generative AI across borders. The swift adoption of generative AI technologies by end users has outpaced the development of data governance and security measures. According to the Cloud Security Alliance, only 57% of organisations have acceptable use policies for AI tools, and fewer still have implemented access controls for AI agents and models, activity logging and auditing, or identity governance for AI entities.

The media industry's particular vulnerability compounds these concerns. As authentication provider Auth0 documented in an analysis of major data breaches affecting media companies: “Data breaches have become commonplace, and the media industry is notorious for being a magnet for cyberthieves.” With billions of users consuming news online, the attack surface for criminals continues to expand. Media companies frequently rely on external vendors, making it difficult to track third-party security practices even when internal processes are robust.

Liability in the Age of AI-Generated Code

When software fails, who bears responsibility? This question becomes extraordinarily complex when the code was generated by an AI and deployed by someone with no formal engineering training. The legal landscape remains unsettled, but concerning patterns are emerging.

Traditional negligence and product liability principles still apply, but courts have yet to clarify how responsibility should be apportioned between AI tool developers and the organisations utilising these tools. Most AI providers prominently display warnings such as “AI can make mistakes and verify the output” while including warranty disclaimers that push due diligence burdens back onto the businesses integrating AI-generated code. The RAND Corporation's analysis of liability for AI system harms notes that “AI developers might also be held liable for malpractice should courts find there to be a recognised professional standard of care that a developer then violated.”

Copyright and intellectual property considerations add further complexity. In the United States, copyright protection hinges on human authorship. Both case law and the U.S. Copyright Office agree that copyright protection is available only for works created through human creativity. When code is produced solely by an AI without meaningful human authorship, it is not eligible for copyright protection.

Analysis by the Software Freedom Conservancy found that approximately 35% of AI-generated code samples contained licensing irregularities, potentially exposing organisations to significant legal liabilities. This “licence contamination” problem has already forced several high-profile product delays and at least two complete codebase rewrites at major corporations. In the United States, a lawsuit against GitHub Copilot (Doe v. GitHub, Inc.) argues that the tool suggests code without including necessary licence attributions. As of spring 2025, litigation continued.

For news organisations, the implications extend beyond licensing. In journalism, tools frequently interact with personal data protected under frameworks like the General Data Protection Regulation. Article 85 of the GDPR requires Member States to adopt exemptions balancing data protection with freedom of expression, but these exemptions are not blanket protections. The Austrian Constitutional Court declared the Austrian journalistic exemption unconstitutional, ruling that it was illegitimate to entirely exclude media data processing from data protection provisions. When Romanian journalists published videos and documents for an investigation, the data protection authority asked for information that could reveal sources, under threat of penalties reaching 20 million euros.

A tool built through vibe coding that inadvertently logs source communications or retains metadata could expose a news organisation to regulatory action and, more critically, endanger the individuals who trusted journalists with sensitive information.

Protecting Vulnerable Populations and Investigative Workflows

Investigative journalism depends on systems of trust that have been carefully constructed over decades. Sources risk their careers, freedom, and sometimes lives to expose wrongdoing. The Global Investigative Journalism Network's guidance emphasises that “most of the time, sources or whistleblowers do not understand the risks they might be taking. Journalists should help them understand this, so they are fully aware of how publication of the information they have given could impact them.”

Digital security has become integral to this protective framework. SecureDrop, an open-source platform for operating whistleblowing systems, has become standard in newsrooms committed to source protection. Encrypted messaging applications like Signal offer end-to-end protection. These tools emerged from years of security research and have been vetted by experts who understand both the technical vulnerabilities and the human factors that can compromise even robust systems.

When a journalist vibe codes a tool for an investigation, they may inadvertently undermine these protections without recognising the risk. As journalist James Risen of The Intercept observed: “We're being forced to act like spies, having to learn tradecraft and encryption and all the new ways to protect sources. So, there's going to be a time when you might make a mistake or do something that might not perfectly protect a source. This is really hard work.”

The Perugia Principles for Journalists, developed in partnership with 20 international journalists and experts, establish twelve principles for working with whistleblowers in the digital age. First among them: “First, protect your sources. Defend anonymity when it is requested. Provide safe ways for sources to make 'first contact' with you, where possible.” A vibe-coded tool, built without understanding of metadata, logging, or network traffic patterns, could create exactly the kind of traceable communication channel that puts sources at risk.

Research from the Center for News, Technology and Innovation documents how digital security threats have become more important than ever for global news media. Journalists and publishers have become high-profile targets for malware, spyware, and digital surveillance. These threats risk physical safety, privacy, and mental health while undermining whistleblower protection and source confidentiality.

The resource disparity across the industry compounds these challenges. News organisations in wealthier settings are generally better resourced and more able to adopt protective technologies. Smaller, independent, and freelance journalists often lack the means to defend against threats. Vibe coding might seem to level this playing field by enabling under-resourced journalists to build their own tools, but without security expertise, it may instead expose them to greater risk.

Governance Frameworks for Editorial and Technical Leadership

The challenge for news organisations is constructing governance frameworks that capture the benefits of democratised development while mitigating its risks. Research on AI guidelines and policies from 52 media organisations worldwide, analysed by journalism researchers and published through Journalist's Resource, offers insights into emerging best practices.

The findings emphasise the need for human oversight throughout AI-assisted processes. As peer-reviewed analysis notes: “The maintenance of a 'human-in-the-loop' principle, where human judgment, creativity, and editorial oversight remain central to the journalistic process, is vital.” The Guardian requires senior editor approval for significant AI-generated content. The CBC has committed not to use AI-powered identification tools for investigative journalism without proper permissions.

The NIST AI Risk Management Framework provides a structured approach applicable to newsroom contexts. It guides organisations through four repeatable actions: identifying how AI systems are used and where risks may appear (Map), evaluating risks using defined metrics (Measure), applying controls to mitigate risks (Manage), and establishing oversight structures to ensure accountability (Govern). The accompanying AI RMF Playbook offers practical guidance that organisations can adapt to their specific needs.

MIT Sloan researchers have proposed a “traffic light” framework for categorising AI use cases by risk level. Red-light use cases are prohibited entirely. Green-light use cases, such as chatbots for general customer service, present low risk and can proceed with minimal oversight. Yellow-light use cases, which comprise most AI applications, require enhanced review and human judgment at critical decision points.

For newsrooms, this framework might translate as follows:

Green-light applications might include internal productivity tools, calendar management systems, or draft headline generators where errors create inconvenience rather than harm.

Yellow-light applications would encompass data visualisations for publication, interactive features using public datasets, and transcription tools for interviews with non-sensitive subjects. These require review by someone with technical competence before deployment.

Red-light applications would include anything touching source communications, whistleblower data, investigative documents, or personal information about vulnerable individuals. These should require professional engineering oversight and security review regardless of how they were initially prototyped.

Building Decision Trees for Non-Technical Staff

Operationalising these distinctions requires clear decision frameworks that non-technical staff can apply independently. The Poynter Institute's guidance on newsroom AI ethics policies emphasises the need for organisations to create AI committees and designate senior staff to lead ongoing governance efforts. “This step is critical because the technology is going to evolve, the tools are going to multiply and the policy will not keep up unless it is routinely revised.”

A practical decision tree for vibe-coded projects might begin with a series of questions:

First, does this tool handle any data that is not already public? If so, escalate to technical review.

Second, could a malfunction in this tool result in publication of incorrect information, exposure of source identity, or violation of individual privacy? If yes, professional engineering oversight is required.

Third, will this tool be used by anyone other than its creator, or persist beyond a single use? Shared tools and long-term deployments require enhanced scrutiny.

Fourth, does this tool connect to external services, databases, or APIs? External connections introduce security considerations that require expert evaluation.

Fifth, would failure of this tool create legal liability, regulatory exposure, or reputational damage? Legal and compliance review should accompany technical review for such applications.

The Cloud Security Alliance's Capabilities-Based Risk Assessment framework offers additional granularity, suggesting that organisations apply proportional safeguards based on risk classification. Low-risk AI applications receive lightweight controls, medium-risk applications get enhanced monitoring, and high-risk applications require full-scale governance including regular audits.

Bridging the Skills Gap Without Sacrificing Speed

The tension at the heart of vibe coding governance is balancing accessibility against accountability. The speed and democratisation that make vibe coding attractive would be undermined by bureaucratic review processes that reimpose the old bottlenecks. Yet the alternative, allowing untrained staff to deploy tools handling sensitive information, creates unacceptable risks.

Several approaches can help navigate this tension.

Tiered review processes can match the intensity of oversight to the risk level of the application. Simple internal tools might require only a checklist review by the creator themselves. Published tools or those handling non-public data might need peer review by a designated “AI champion” with intermediate technical knowledge. Tools touching sensitive information would require full security review by qualified professionals.

Pre-approved templates and components can provide guardrails that reduce the scope for dangerous errors. News organisations can work with their development teams to create vetted building blocks: secure form handlers, properly configured database connections, privacy-compliant analytics modules. Journalists can be directed to incorporate these components rather than generating equivalent functionality from scratch.

Sandboxed development environments can allow experimentation without production risk. Vibe-coded prototypes can be tested and evaluated in isolated environments before any decision about broader deployment. This preserves the creative freedom that makes vibe coding valuable while creating a checkpoint before tools reach users or sensitive data.

Mandatory training programmes should ensure that all staff using vibe coding tools understand basic security concepts, data handling requirements, and the limitations of AI-generated code. This training need not make everyone a programmer, but it should cultivate healthy scepticism about what AI tools produce and awareness of the questions to ask before deployment.

The Emerging Regulatory Landscape

News organisations cannot develop governance frameworks in isolation from the broader regulatory environment. The European Union's AI Act, adopted in 2024, establishes requirements that will affect media organisations using AI tools. While journalism itself is not classified as high-risk under the Act, AI systems used in media that could manipulate public opinion or spread disinformation face stricter oversight. AI-generated content, including synthetic media, must be clearly labelled.

The Dynamic Coalition on the Sustainability of Journalism and News Media released its 2024-2025 Annual Report on AI and Journalism, calling for shared strategies to safeguard journalism's integrity in an AI-driven world. The report urges decision-makers to “move beyond reactive policy-making and invest in forward-looking frameworks that place human rights, media freedom, and digital inclusion at the centre of AI governance.”

In the United States, the regulatory landscape is more fragmented. More than 1,000 AI-related bills have been introduced across state legislatures in 2024-2025. California, Colorado, New York, and Illinois have adopted or proposed comprehensive AI and algorithmic accountability laws addressing transparency, bias mitigation, and sector-specific safeguards. News organisations operating across multiple jurisdictions must navigate a patchwork of requirements.

The Center for News, Technology and Innovation's review of 188 national and regional AI strategies found that regulatory attempts rarely directly address journalism and vary dramatically in their frameworks, enforcement capacity, and international coordination. This uncertainty places additional burden on news organisations to develop robust internal governance rather than relying on external regulatory guidance.

Cultural Transformation and Organisational Learning

Technical governance alone cannot address the challenges of democratised development. Organisations must cultivate cultures that balance innovation with responsibility.

IBM's research on shadow AI governance emphasises that employees should be “encouraged to disclose how they use AI, confident that transparency will be met with guidance, not punishment. Leadership, in turn, should celebrate responsible experimentation as part of organisational learning.” Punitive approaches to unsanctioned AI use tend to drive it underground, where it becomes invisible to governance processes.

News organisations have particular cultural advantages in addressing these challenges. Journalism is built on verification, scepticism, and accountability. The same instincts that lead journalists to question official sources and demand evidence should be directed at AI-generated outputs. Newsroom cultures that emphasise “trust but verify” can extend this principle to tools and code as readily as to sources and documents.

The Scripps approach, which Oslund described as starting with “guardrails and guidelines to prevent missteps,” offers a model. “It all starts with public trust,” Oslund emphasised, noting Scripps' commitment to accuracy and human oversight of AI outputs. Embedding AI governance within broader commitments to editorial integrity may prove more effective than treating it as a separate technical concern.

The Accountability Question

When something goes wrong with a vibe-coded tool, who is responsible? This question resists easy answers but demands organisational clarity.

The journalist who created the tool bears some responsibility, but their liability should be proportional to what they could reasonably have been expected to understand. An editor who approved deployment shares accountability, as does any technical reviewer who cleared the tool. The organisation itself, having enabled vibe coding without adequate governance, may bear ultimate responsibility.

Clear documentation of decision-making processes becomes essential. When a tool is deployed, records should capture: who created it, what review it received, who approved it, what data it handles, and what risk assessment was performed. This documentation serves both as a protection against liability and as a learning resource when problems occur.

As professional standards for AI governance in journalism emerge, organisations that ignore them may face enhanced liability exposure. The development of industry norms creates benchmarks against which organisational practices will be measured.

Recommendations for News Organisations

Based on the analysis above, several concrete recommendations emerge for news organisations navigating the vibe coding revolution.

Establish clear acceptable use policies for AI development tools, distinguishing between permitted, restricted, and prohibited use cases. Make these policies accessible and understandable to non-technical staff.

Create tiered review processes that match oversight intensity to risk level. Not every vibe-coded tool needs security audit, but those handling sensitive data or reaching public audiences require appropriate scrutiny.

Designate AI governance leadership within the organisation, whether through an AI committee, a senior editor with oversight responsibility, or a dedicated role. This leadership should have authority to pause or prohibit deployments that present unacceptable risk.

Invest in training that builds basic security awareness and AI literacy across editorial staff. Training should emphasise the limitations of AI-generated code and the questions to ask before deployment.

Develop pre-approved components for common functionality, allowing vibe coders to build on vetted foundations rather than generating security-sensitive code from scratch.

Implement sandbox environments for development and testing, creating separation between experimentation and production systems handling real data.

Maintain documentation of all AI tool deployments, including creation, review, approval, and risk assessment records.

Conduct regular audits of deployed tools, recognising that AI-generated code may contain latent vulnerabilities that only become apparent over time.

Engage with regulatory developments at national and international levels, ensuring that internal governance anticipates rather than merely reacts to legal requirements.

Foster cultural change that treats AI governance as an extension of editorial integrity rather than a constraint on innovation.

Navigating the New Landscape

Vibe coding represents neither utopia nor dystopia for newsrooms. It is a powerful capability that, like any technology, will be shaped by the choices organisations make about its use. The democratisation of software development can expand what journalism is capable of achieving, empowering practitioners to create tools tailored to their specific needs and audiences. But this empowerment carries responsibility.

The distinction between appropriate prototyping and situations requiring professional engineering oversight is not always obvious. Decision frameworks and governance structures can operationalise this distinction, but they require ongoing refinement as technology evolves and organisational learning accumulates. Liability, compliance, and ethical accountability gaps are real, particularly where published tools interface with sensitive data, vulnerable populations, or investigative workflows.

Editorial and technical leadership must work together to ensure that speed and accessibility gains do not inadvertently expose organisations to data breaches, regulatory violations, or reputational damage. The journalists building tools through vibe coding are not the enemy; they are practitioners seeking to serve their audiences and advance their craft. But good intentions are insufficient protection against technical vulnerabilities or regulatory requirements.

As the Generative AI in the Newsroom project observes, the goal is “collaboratively figuring out how and when (or when not) to use generative AI in news production.” That collaborative spirit, extending across editorial and technical domains, offers the best path forward. Newsrooms that get this balance right will harness vibe coding's transformative potential while maintaining the trust that makes journalism possible. Those that do not may find that the magic of democratised development comes with costs their organisations, their sources, and their audiences cannot afford.

---

References and Sources

1. Karpathy, A. (2025). “Vibe Coding.” X (formerly Twitter). https://x.com/karpathy/status/1886192184808149383

2. Collins Dictionary. (2025). “Word of the Year 2025: Vibe Coding.” https://www.collinsdictionary.com/us/woty

3. CNN. (2025). “'Vibe coding' named Collins Dictionary's Word of the Year.” https://www.cnn.com/2025/11/06/tech/vibe-coding-collins-word-year-scli-intl

4. Generative AI in the Newsroom. (2025). “Vibe Coding for Newsrooms.” https://generative-ai-newsroom.com/vibe-coding-for-newsrooms-6848b17dac99

5. Nieman Journalism Lab. (2025). “Rise of the vibecoding journalists.” https://www.niemanlab.org/2025/12/rise-of-the-vibecoding-journalists/

6. TV News Check. (2025). “Agent Swarms And Vibe Coding: Inside The New Operational Reality Of The Newsroom.” https://tvnewscheck.com/ai/article/agent-swarms-and-vibe-coding-inside-the-new-operational-reality-of-the-newsroom/

7. The E.W. Scripps Company. (2024). “Scripps creates AI team to lead strategy, business development and operations across company.” https://scripps.com/press-releases/scripps-creates-ai-team-to-lead-strategy-business-development-and-operations-across-company/

8. IBM Newsroom. (2025). “IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications.” https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications

9. Gartner. (2025). “Gartner Predicts 40% of AI Data Breaches Will Arise from Cross-Border GenAI Misuse by 2027.” https://www.gartner.com/en/newsroom/press-releases/2025-02-17-gartner-predicts-forty-percent-of-ai-data-breaches-will-arise-from-cross-border-genai-misuse-by-2027

10. Auth0. (2024). “11 of the Worst Data Breaches in Media.” https://auth0.com/blog/11-of-the-worst-data-breaches-in-media/

11. Threatrix. (2025). “Software Liability in 2025: AI-Generated Code Compliance & Regulatory Risks.” https://threatrix.io/blog/threatrix/software-liability-in-2025-ai-generated-code-compliance-regulatory-risks/

12. MBHB. (2025). “Navigating the Legal Landscape of AI-Generated Code: Ownership and Liability Challenges.” https://www.mbhb.com/intelligence/snippets/navigating-the-legal-landscape-of-ai-generated-code-ownership-and-liability-challenges/

13. European Data Journalism Network. (2024). “Data protection in journalism: a practical handbook.” https://datavis.europeandatajournalism.eu/obct/data-protection-handbook/gdpr-applied-to-journalism.html

14. Global Investigative Journalism Network. (2025). “Expert Advice to Keep Your Sources and Whistleblowers Safe.” https://gijn.org/stories/gijc25-tips-keep-sources-whistleblowers-safe/

15. Journalist's Resource. (2024). “Researchers compare AI policies and guidelines at 52 news organizations.” https://journalistsresource.org/home/generative-ai-policies-newsrooms/

16. SAGE Journals. (2024). “AI Ethics in Journalism (Studies): An Evolving Field Between Research and Practice.” https://journals.sagepub.com/doi/10.1177/27523543241288818

17. Poynter Institute. (2024). “Your newsroom needs an AI ethics policy. Start here.” https://www.poynter.org/ethics-trust/2024/how-to-create-newsroom-artificial-intelligence-ethics-policy/

18. Center for News, Technology and Innovation. (2024). “Journalism's New Frontier: An Analysis of Global AI Policy Proposals and Their Impacts on Journalism.” https://cnti.org/reports/journalisms-new-frontier-an-analysis-of-global-ai-policy-proposals-and-their-impacts-on-journalism/

19. Media Rights Agenda. (2025). “DC-Journalism Launches 2024/2025 Annual Report on Artificial Intelligence, Journalism.” https://mediarightsagenda.org/dc-journalism-launches-2024-2025-annual-report-on-artificial-intelligence-journalism/

20. NIST. (2024). “AI Risk Management Framework.” https://www.nist.gov/itl/ai-risk-management-framework

21. Cloud Security Alliance. (2025). “Capabilities-Based AI Risk Assessment (CBRA) for AI Systems.” https://cloudsecurityalliance.org/artifacts/capabilities-based-risk-assessment-cbra-for-ai-systems

22. Palo Alto Networks. (2025). “What Is Shadow AI? How It Happens and What to Do About It.” https://www.paloaltonetworks.com/cyberpedia/what-is-shadow-ai

23. IBM. (2025). “What Is Shadow AI?” https://www.ibm.com/think/topics/shadow-ai

24. Help Net Security. (2025). “Shadow AI risk: Navigating the growing threat of ungoverned AI adoption.” https://www.helpnetsecurity.com/2025/11/12/delinea-shadow-ai-governance/

25. Wikipedia. (2025). “Vibe coding.” https://en.wikipedia.org/wiki/Vibe_coding

26. Simon Willison. (2025). “Not all AI-assisted programming is vibe coding (but vibe coding rocks).” https://simonwillison.net/2025/Mar/19/vibe-coding/

27. RAND Corporation. (2024). “Liability for Harms from AI Systems: The Application of U.S. Tort Law.” https://www.rand.org/pubs/research_reports/RRA3243-4.html

28. Center for News, Technology and Innovation. (2024). “Journalists & Cyber Threats.” https://innovating.news/article/journalists-cyber-threats/

29. USC Center for Health Journalism. (2025). “An early AI pioneer shares how the 'vibe coding' revolution could reshape data journalism.” https://centerforhealthjournalism.org/our-work/insights/early-ai-pioneer-shares-how-vibe-coding-revolution-could-reshape-data-journalism

30. Wiley Online Library. (2024). “From Shadow IT to Shadow AI: Threats, Risks and Opportunities for Organizations.” Strategic Change. https://onlinelibrary.wiley.com/doi/10.1002/jsc.2682

31. U.S. Copyright Office. (2024). “Copyright and Artificial Intelligence.” https://www.copyright.gov/ai/

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

The promise was seductive: AI that writes code faster than any human, accelerating development cycles and liberating engineers from tedious boilerplate. The reality, as thousands of development teams have discovered, is considerably more complicated. According to the JetBrains State of Developer Ecosystem 2025 survey of nearly 25,000 developers, 85% now regularly use AI tools for coding and development. Yet Stack Overflow's 2025 Developer Survey reveals that only 33% of developers trust the accuracy of AI output, down from 43% in 2024. More developers actively distrust AI tools (46%) than trust them.

This trust deficit tells a story that productivity metrics alone cannot capture. While GitHub reports developers code 55% faster with Copilot and McKinsey studies suggest tasks can be completed twice as quickly with generative AI assistance, GitClear's analysis of 211 million changed lines of code reveals a troubling counter-narrative. The percentage of code associated with refactoring has plummeted from 25% in 2021 to less than 10% in 2024. Duplicated code blocks increased eightfold. For the first time in GitClear's measurement history, copy-pasted lines exceeded refactored lines.

The acceleration is real. So is the architectural degradation it enables.

What emerges from this data is not a simple story of AI success or failure. It is a more nuanced picture of tools that genuinely enhance productivity when deployed with discipline but create compounding problems when adopted without appropriate constraints. The developers and organisations navigating this landscape successfully share a common understanding: AI coding assistants require guardrails, architectural oversight, and deliberate workflow design to deliver sustainable value.

The Feature Creep Accelerator

Feature creep has plagued software development since the industry's earliest days. Wikipedia defines it as the excessive ongoing expansion or addition of new features beyond the original scope, often resulting in software bloat and over-complication rather than simple design. It is considered the most common source of cost and schedule overruns and can endanger or even kill products and projects. What AI coding assistants have done is not create this problem, but radically accelerate its manifestation.

Consider the mechanics. A developer prompts an AI assistant to add a user authentication feature. The AI generates functional code within seconds. The developer, impressed by the speed and apparent correctness, accepts the suggestion. Then another prompt, another feature, another quick acceptance. The velocity feels exhilarating. The Stack Overflow survey confirms this pattern: 84% of developers now use or plan to use AI tools in their development process. The JetBrains survey reports that 74% cite increased productivity as AI's primary benefit, with 73% valuing faster completion of repetitive tasks.

But velocity without direction creates chaos. Google's 2024 DORA report found that while AI adoption increased individual output by 21% more tasks completed and 98% more pull requests merged, organisational delivery metrics remained flat. More alarmingly, AI adoption correlated with a 7.2% reduction in delivery stability. The 2025 DORA report confirms this pattern persists: AI adoption continues to have a negative relationship with software delivery stability. As the DORA researchers concluded, speed without stability is accelerated chaos.

The mechanism driving this instability is straightforward. AI assistants optimise for immediate task completion. They generate code that works in isolation but lacks awareness of broader architectural context. Each generated component may function correctly yet contradict established patterns elsewhere in the codebase. One function uses promises, another async/await, a third callbacks. Database queries are parameterised in some locations and concatenated strings in others. Error handling varies wildly between endpoints.

This is not a failing of AI intelligence. It reflects a fundamental mismatch between how AI assistants operate and how sustainable software architecture develops. The Qodo State of AI Code Quality report identifies missing context as the top issue developers face, reported by 65% during refactoring and approximately 60% during test generation and code review. Only 3.8% of developers report experiencing both low hallucination rates and high confidence in shipping AI-generated code without human review.

Establishing Effective Guardrails

The solution is not to abandon AI assistance but to contain it within structures that preserve architectural integrity. CodeScene's research demonstrates that unhealthy code exhibits 15 times more defects, requires twice the development time, and creates 10 times more delivery uncertainty compared to healthy code. Their approach involves implementing guardrails across three dimensions: code quality, code familiarity, and test coverage.

The first guardrail dimension addresses code quality directly. Every line of code, whether AI-generated or handwritten, undergoes automated review against defined quality standards. CodeScene's CodeHealth Monitor detects over 25 code smells including complex methods and God functions. When AI or human introduces issues, the monitor flags them instantly before the code reaches the main branch. This creates a quality gate that treats AI-generated code with the same scrutiny applied to human contributions.

The quality dimension requires teams to define their code quality standards explicitly and automate enforcement via pull request reviews. A 2023 study found that popular AI assistants generate correct code in only 31.1% to 65.2% of cases. Similarly, CodeScene's Refactoring vs. Refuctoring study found that AI breaks code in two out of three refactoring attempts. These statistics make quality gates not optional but essential.

The second dimension concerns code familiarity. Research from the 2024 DORA report reveals that 39% of respondents reported little to no trust in AI-generated code. This distrust correlates with experience level: senior developers show the lowest “highly trust” rate at 2.6% and the highest “highly distrust” rate at 20%. These experienced developers have learned through hard experience that AI suggestions require verification. Guardrails should institutionalise this scepticism by requiring review from developers familiar with affected areas before AI-generated changes merge.

The familiarity dimension serves another purpose: knowledge preservation. When AI generates code that bypasses human understanding, organisations lose institutional knowledge about how their systems work. When something breaks at 3 a.m. and the code was generated by an AI six months ago, can the on-call engineer actually understand what is failing? Can they trace through the logic and implement a meaningful fix without resorting to trial and error?

The third dimension emphasises test coverage. The Ox Security report titled “Army of Juniors: The AI Code Security Crisis” identified 10 architecture and security anti-patterns commonly found in AI-generated code. Comprehensive test suites serve as executable documentation of expected behaviour. When AI-generated code breaks tests, the violation becomes immediately visible. When tests pass, developers gain confidence that at least basic correctness has been verified.

Enterprise adoption requires additional structural controls. The 2026 regulatory landscape, with the EU AI Act's high-risk provisions taking effect in August and penalties reaching 35 million euros or 7% of global revenue, demands documented governance. AI governance committees have become standard in mid-to-large enterprises, with structured intake processes covering security, privacy, legal compliance, and model risk.

Preventing Architectural Drift

Architectural coherence presents a distinct challenge from code quality. A codebase can pass all quality metrics while still representing a patchwork of inconsistent design decisions. The term “vibe coding” has emerged to describe an approach where developers accept AI-generated code without fully understanding it, relying solely on whether the code appears to work.

The consequences of architectural drift compound over time. A September 2025 Fast Company report quoted senior software engineers describing “development hell” when working with AI-generated code. One developer's experience became emblematic: “Random things are happening, maxed out usage on API keys, people bypassing the subscription.” Eventually: “Cursor keeps breaking other parts of the code,” and the application was permanently shut down.

Research examining ChatGPT-generated code found that only five out of 21 programs were initially secure when tested across five programming languages. Missing input sanitisation emerged as the most common flaw, while Cross-Site Scripting failures occurred 86% of the time and Log Injection vulnerabilities appeared 88% of the time. These are not obscure edge cases but fundamental security flaws that any competent developer should catch during code review.

Preventing this drift requires explicit architectural documentation that AI assistants can reference. A recommended approach involves creating a context directory containing specialised documents: a Project Brief for core goals and scope, Product Context for user experience workflows and business logic, System Patterns for architecture decisions and component relationships, Tech Context for the technology stack and dependencies, and Progress Tracking for working features and known issues.

This Memory Bank approach addresses AI's fundamental limitation: forgetting implementation choices made earlier when working on large projects. AI assistants lose track of architectural decisions, coding patterns, and overall project structure, creating inconsistency as project complexity increases. By maintaining explicit documentation that gets fed into every AI interaction, teams can maintain consistency even as AI generates new code.

The human role in this workflow resembles a navigator in pair programming. The navigator directs overall development strategy, makes architectural decisions, and reviews AI-generated code. The AI functions as the driver, generating code implementations and suggesting refactoring opportunities. The critical insight is treating AI as a junior developer beside you: capable of producing drafts, boilerplate, and solid algorithms, but lacking the deep context of your project.

Breaking Through Repetitive Problem-Solving Patterns

Every developer who has used AI coding assistants extensively has encountered the phenomenon: the AI gets stuck in a loop, generating the same incorrect solution repeatedly, each attempt more confidently wrong than the last. The 2025 Stack Overflow survey captures this frustration, with 66% of developers citing “AI solutions that are almost right, but not quite” as their top frustration. Meanwhile, 45% report that debugging AI-generated code takes more time than expected. These frustrations have driven 35% of developers to turn to Stack Overflow specifically after AI-generated code fails.

The causes of these loops are well documented. VentureBeat's analysis of why AI coding agents are not production-ready identifies brittle context windows, broken refactors, and missing operational awareness as primary culprits. When AI exceeds its context limit, it loses track of previous attempts and constraints. It regenerates similar solutions because the underlying prompt and available context have not meaningfully changed.

Several strategies prove effective for breaking these loops. The first involves starting fresh with new context. Opening a new chat session can help the AI think more clearly without the baggage of previous failed attempts in the prompt history. This simple reset often proves more effective than continued iteration within a corrupted context.

The second strategy involves switching to analysis mode. Rather than asking the AI to fix immediately, developers describe the situation and request diagnosis and explanation. By doing this, the AI outputs analysis or planning rather than directly modifying code. This shift in mode often reveals the underlying issue that prevented the AI from generating a correct solution.

Version control provides the third strategy. Committing a working state before adding new features or accepting AI fixes creates reversion points. When a loop begins, developers can quickly return to the last known good version rather than attempting to untangle AI-generated complexity. Frequent checkpointing makes the decision between fixing forward and reverting backward much easier.

The fourth strategy acknowledges when manual intervention becomes necessary. One successful workaround involves instructing the agent not to read the file and instead requesting it to provide the desired configuration, with the developer manually adding it. This bypasses whatever confusion the AI has developed about the file's current state.

The fifth strategy involves providing better context upfront. Developers should always copy-paste the exact error text or describe the wrong behaviour precisely. Giving all relevant errors and output to the AI leads to more direct fixes, whereas leaving it to infer the issue can lead to loops.

These strategies share a common principle: recognising when AI assistance has become counterproductive and knowing when to take manual control. The 90/10 rule offers useful guidance. AI currently excels at planning architectures and writing code blocks but struggles with debugging real systems and handling edge cases. When projects reach 90% completion, switching from building mode to debugging mode leverages human strengths rather than fighting AI limitations.

Leveraging Complementary AI Models

The 2025 AI landscape has matured beyond questions of whether to use AI assistance toward more nuanced questions of which AI model best serves specific tasks. Research published on ResearchGate comparing Gemini 2.5, Claude 4, LLaMA 4, GPT-4.5, and DeepSeek V3.1 concludes that no single model excels at everything. Each has distinct strengths and weaknesses. Rather than a single winner, the 2025 landscape shows specialised excellence.

Professional developers increasingly adopt multi-model workflows that leverage each AI's advantages while avoiding their pitfalls. The recommended approach matches tasks to model strengths: Gemini for deep reasoning and multimodal analysis, GPT series for balanced performance and developer tooling, Claude for long coding sessions requiring memory of previous context, and specialised models for domain-specific requirements.

Orchestration platforms have emerged to manage these multi-model workflows. They provide the integration layer that routes requests to appropriate models, retrieves relevant knowledge, and monitors performance across providers. Rather than committing to a single AI vendor, organisations deploy multiple models strategically, routing queries to the optimal model per task type.

This multi-model approach proves particularly valuable for breaking through architectural deadlocks. When one model gets stuck in a repetitive pattern, switching to a different model often produces fresh perspectives. The models have different training data, different architectural biases, and different failure modes. What confuses one model may be straightforward for another.

The competitive advantage belongs to developers who master multi-model workflows rather than committing to a single platform. This represents a significant shift in developer skills. Beyond learning specific AI tools, developers must develop meta-skills for evaluating which AI model suits which task and when to switch between them.

Mandatory Architectural Review Before AI Implementation

Enterprise teams have discovered that AI output velocity can exceed review capacity. Qodo's analysis observes that AI coding agents increased output by 25-35%, but most review tools do not address the widening quality gap. The consequences include larger pull requests, architectural drift, inconsistent standards across multi-repository environments, and senior engineers buried in validation work instead of system design. Leaders frequently report that review capacity, not developer output, is the limiting factor in delivery.

The solution emerging across successful engineering organisations involves mandatory architectural review before AI implements major changes. The most effective teams have shifted routine review load off senior engineers by automatically approving small, low-risk, well-scoped changes while routing schema updates, cross-service changes, authentication logic, and contract modifications to human reviewers.

AI review systems must therefore categorise pull requests by risk and flag unrelated changes bundled in the same pull request. Selective automation of approvals under clearly defined conditions maintains velocity for routine changes while ensuring human judgment for consequential decisions. AI-assisted development now accounts for nearly 40% of all committed code, making these review processes critical to organisational health.

The EU AI Act's requirements make this approach not merely advisable but legally necessary for certain applications. Enterprises must demonstrate full data lineage tracking knowing exactly what datasets contributed to each model's output, human-in-the-loop checkpoints for workflows impacting safety, rights, or financial outcomes, and risk classification tags labelling each model with its risk level, usage context, and compliance status.

The path toward sustainable AI-assisted development runs through consolidation and discipline. Organisations that succeed will be those that stop treating AI as a magic solution for software development and start treating it as a rigorous engineering discipline requiring the same attention to process and quality as any other critical capability.

Safeguarding Against Hidden Technical Debt

The productivity paradox of AI-assisted development becomes clearest when examining technical debt accumulation. An HFS Research and Unqork study found that while 84% of organisations expect AI to reduce costs and 80% expect productivity gains, 43% report that AI will create new technical debt. Top concerns include security vulnerabilities at 59%, legacy integration complexity at 50%, and loss of visibility at 42%.

The mechanisms driving this debt accumulation differ from traditional technical debt. AI technical debt compounds through three primary vectors. Model versioning chaos results from the rapid evolution of code assistant products. Code generation bloat emerges as AI produces more code than necessary. Organisation fragmentation develops as different teams adopt different AI tools and workflows. These vectors, coupled with the speed of AI code generation, interact to cause exponential growth.

SonarSource's August 2025 analysis of thousands of programming tasks completed by leading language models uncovered what researchers describe as a systemic lack of security awareness. The Ox Security report found AI-generated code introduced 322% more privilege escalation paths and 153% more design flaws compared to human-written code. AI-generated code is highly functional but systematically lacking in architectural judgment.

The financial implications are substantial. By 2025, CISQ estimates nearly 40% of IT budgets will be spent maintaining technical debt. A Stripe report found developers spend, on average, 42% of their work week dealing with technical debt and bad code. AI assistance that accelerates code production without corresponding attention to code quality simply accelerates technical debt accumulation.

The State of Software Delivery 2025 report by Harness found that contrary to perceived productivity benefits, the majority of developers spend more time debugging AI-generated code and more time resolving security vulnerabilities than before AI adoption. This finding aligns with GitClear's observation that code churn, defined as the percentage of code discarded less than two weeks after being written, has nearly doubled from 3.1% in 2020 to 5.7% in 2024.

Safeguarding against this hidden debt requires continuous measurement and explicit debt budgeting. Teams should track not just velocity metrics but also code health indicators. The refactoring rate, clone detection, code churn within two weeks of commit, and similar metrics reveal whether AI assistance is building sustainable codebases or accelerating decay. If the current trend continues, GitClear believes it could soon bring about a phase change in how developer energy is spent, with defect remediation becoming the leading day-to-day developer responsibility rather than developing new features.

Structuring Developer Workflows for Multi-Model Effectiveness

Effective AI-assisted development requires restructuring workflows around AI capabilities and limitations rather than treating AI as a drop-in replacement for human effort. The Three Developer Loops framework published by IT Revolution provides useful structure: a tight inner loop of coding and testing, a middle loop of integration and review, and an outer loop of planning and architecture.

AI excels in the inner loop. Code generation, test creation, documentation, and similar tasks benefit from AI acceleration without significant risk. Development teams spend nearly 70% of their time on repetitive tasks instead of creative problem-solving, and AI handles approximately 40% of the time developers previously spent on boilerplate code. The middle loop requires more careful orchestration. AI can assist with code review and integration testing, but human judgment must verify that generated code aligns with architectural intentions. The outer loop remains primarily human territory. Planning, architecture, and strategic decisions require understanding of business context, user needs, and long-term maintainability that AI cannot provide.

The workflow implications are significant. Rather than using AI continuously throughout development, effective developers invoke AI assistance at specific phases while maintaining manual control at others. During initial planning and architecture, AI might generate options for human evaluation but should not make binding decisions. During implementation, AI can accelerate code production within established patterns. During integration and deployment, AI assistance should be constrained by automated quality gates that verify generated code meets established standards.

Context management becomes a critical developer skill. The METR 2025 study that found developers actually take 19% longer when using AI tools attributed this primarily to context management overhead. The study examined 16 experienced open-source developers with an average of five years of prior experience with the mature projects they worked on. Before completing tasks, developers predicted AI would speed them up by 24%. After experiencing the slowdown firsthand, they still reported believing AI had improved their performance by 20%. The objective measurement showed the opposite.

The context directory approach described earlier provides one structural solution. Alternative approaches include using version-controlled markdown files to track AI interactions and decisions, employing prompt templates that automatically include relevant context, and establishing team conventions for what context AI should receive for different task types. The specific approach matters less than having a systematic approach that the team follows consistently.

Real-World Implementation Patterns

The theoretical frameworks for AI guardrails translate into specific implementation patterns that teams can adopt immediately. The first pattern involves pre-commit hooks that validate AI-generated code against quality standards before allowing commits. These hooks can verify formatting consistency, run static analysis, check for known security vulnerabilities, and enforce architectural constraints. When violations occur, the commit is rejected with specific guidance for resolution.

The second pattern involves staged code review with AI assistance. Initial review uses AI tools to identify obvious issues like formatting violations, potential bugs, or security vulnerabilities. Human reviewers then focus on architectural alignment, business logic correctness, and long-term maintainability. This two-stage approach captures AI efficiency gains while preserving human judgment for decisions requiring context that AI lacks.

The third pattern involves explicit architectural decision records that AI must reference. When developers prompt AI for implementation, they include references to relevant decision records. The AI then generates code that respects documented constraints. This requires discipline in maintaining decision records but provides concrete guardrails against architectural drift.

The fourth pattern involves regular architectural retrospectives that specifically examine AI-generated code. Teams review samples of AI-generated commits to identify patterns of architectural violation, code quality degradation, or security vulnerability. These retrospectives inform adjustments to guardrails, prompt templates, and review processes.

The fifth pattern involves model rotation for complex problems. When one AI model gets stuck, teams switch to a different model rather than continuing to iterate with the stuck model. This requires access to multiple AI providers and skills in prompt translation between models.

Measuring Success Beyond Velocity

Traditional development metrics emphasise velocity: lines of code, commits, pull requests merged, features shipped. AI assistance amplifies these metrics while potentially degrading unmeasured dimensions like code quality, architectural coherence, and long-term maintainability. Sustainable AI-assisted development requires expanding measurement to capture these dimensions.

The DORA framework has evolved to address this gap. The 2025 report introduced rework rate as a fifth core metric precisely because AI shifts where development time gets spent. Teams produce initial code faster but spend more time reviewing, validating, and correcting it. Monitoring cycle time, code review patterns, and rework rates reveals the true productivity picture that perception surveys miss.

Code health metrics provide another essential measurement dimension. GitClear's analysis tracks refactoring rate, code clone frequency, and code churn. These indicators reveal whether codebases are becoming more or less maintainable over time. When refactoring declines and clones increase, as GitClear's data shows has happened industry-wide, the codebase is accumulating debt regardless of how quickly features appear to ship. The percentage of moved or refactored lines decreased dramatically from 24.1% in 2020 to just 9.5% in 2024, while lines classified as copy-pasted or cloned rose from 8.3% to 12.3% in the same period.

Security metrics deserve explicit attention given AI's documented tendency to generate vulnerable code. The Georgetown University Centre for Security and Emerging Technology identified three broad risk categories: models generating insecure code, models themselves being vulnerable to attack and manipulation, and downstream cybersecurity impacts including feedback loops where insecure AI-generated code gets incorporated into training data for future models.

Developer experience metrics capture dimensions that productivity metrics miss. The Stack Overflow survey finding that 45% of developers report debugging AI-generated code takes more time than expected suggests that velocity gains may come at the cost of developer satisfaction and cognitive load. Sustainable AI adoption requires monitoring not just what teams produce but how developers experience the production process.

The Discipline That Enables Speed

The paradox of AI-assisted development is that achieving genuine productivity gains requires slowing down in specific ways. Establishing guardrails, maintaining context documentation, implementing architectural review, and measuring beyond velocity all represent investments that reduce immediate output. Yet without these investments, the apparent gains from AI acceleration prove illusory as technical debt accumulates, architectural coherence degrades, and debugging time compounds.

The organisations succeeding with AI coding assistance share common characteristics. They maintain rigorous code review regardless of code origin. They invest in automated testing proportional to development velocity. They track quality metrics alongside throughput metrics. They train developers to evaluate AI suggestions critically rather than accepting them reflexively.

These organisations have learned that AI coding assistants are powerful tools requiring skilled operators. In the hands of experienced developers who understand both AI capabilities and limitations, they genuinely accelerate delivery. Applied without appropriate scaffolding, they create technical debt faster than any previous development approach. Companies implementing comprehensive AI governance frameworks report 60% fewer hallucination-related incidents compared to those using AI tools without oversight controls.

The 19% slowdown documented by the METR study represents one possible outcome, not an inevitable one. But achieving better outcomes requires abandoning the comfortable perception that AI automatically makes development faster. It requires embracing the more complex reality that speed and quality require continuous, deliberate balancing.

The future belongs to developers and organisations that treat AI assistance not as magic but as another engineering discipline requiring its own skills, processes, and guardrails. The best developers of 2025 will not be the ones who generate the most lines of code with AI, but the ones who know when to trust it, when to question it, and how to integrate it responsibly. The tools are powerful. The question is whether we have the discipline to wield them sustainably.

---

References and Sources

• JetBrains (2025). “The State of Developer Ecosystem 2025: Coding in the Age of AI.” https://blog.jetbrains.com/research/2025/10/state-of-developer-ecosystem-2025/
• Stack Overflow (2025). “2025 Stack Overflow Developer Survey: AI Section.” https://survey.stackoverflow.co/2025/ai
• GitClear (2025). “AI Copilot Code Quality: 2025 Data Suggests 4x Growth in Code Clones.” https://www.gitclear.com/ai_assistant_code_quality_2025_research
• Google DORA (2024). “DORA Report 2024.” https://dora.dev/research/2024/dora-report/
• Google DORA (2025). “State of AI-assisted Software Development 2025.” https://dora.dev/research/2025/dora-report/
• Qodo (2025). “State of AI Code Quality Report.” https://www.qodo.ai/reports/state-of-ai-code-quality/
• CodeScene (2025). “AI Code Guardrails: Validate and Quality-Gate GenAI Code.” https://codescene.com/resources/use-cases/prevent-ai-generated-technical-debt
• Ox Security (2025). “Army of Juniors: The AI Code Security Crisis.” Referenced via InfoQ.
• Georgetown University CSET (2024). “Cybersecurity Risks of AI-Generated Code.” https://cset.georgetown.edu/publication/cybersecurity-risks-of-ai-generated-code/
• McKinsey (2024). “Unleashing Developer Productivity with Generative AI.” https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/unleashing-developer-productivity-with-generative-ai
• IT Revolution (2025). “The Three Developer Loops: A New Framework for AI-Assisted Coding.” https://itrevolution.com/articles/the-three-developer-loops-a-new-framework-for-ai-assisted-coding/
• METR (2025). “Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity.” https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/
• HFS Research (2025). “AI Won't Save Enterprises from Tech Debt Unless They Change the Architecture First.” https://www.hfsresearch.com/press-release/ai-wont-save-enterprises-from-tech-debt-unless-they-change-the-architecture-first/
• VentureBeat (2025). “Why AI Coding Agents Aren't Production-Ready.” https://venturebeat.com/ai/why-ai-coding-agents-arent-production-ready-brittle-context-windows-broken
• SonarSource (2025). Research on AI-generated code security. Referenced via DevOps.com.
• ResearchGate (2025). “The Most Advanced AI Models of 2025: Comparative Analysis.” https://www.researchgate.net/publication/392160200
• EU AI Act (2024). High-risk provisions effective August 2026. https://natlawreview.com/article/2026-outlook-artificial-intelligence
• Faros AI (2025). “DORA Report 2025 Key Takeaways.” https://www.faros.ai/blog/key-takeaways-from-the-dora-report-2025
• LeadDev (2025). “How AI Generated Code Compounds Technical Debt.” https://leaddev.com/software-quality/how-ai-generated-code-accelerates-technical-debt
• MIT Sloan Management Review (2025). “The Hidden Costs of Coding With Generative AI.” https://sloanreview.mit.edu/article/the-hidden-costs-of-coding-with-generative-ai/
• Harness (2025). “State of Software Delivery 2025.” Referenced via DevOps.com.
• Fast Company (2025). “Development Hell: Senior Engineers and AI-Generated Code.” September 2025.

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

The promotional materials are breathtaking. Artificial intelligence systems that can analyse medical scans with superhuman precision, autonomous vehicles that navigate complex urban environments, and vision-language models that understand images with the fluency of a seasoned art critic. The benchmark scores are equally impressive: 94% accuracy here, state-of-the-art performance there, human-level capabilities across dozens of standardised tests.

Then reality intrudes. A robotaxi in San Francisco fails to recognise a pedestrian trapped beneath its chassis and drags her twenty feet before stopping. An image recognition system confidently labels photographs of Black individuals as gorillas. A frontier AI model, asked to count the triangles in a simple geometric image, produces answers that would embarrass a primary school student. These are not edge cases or adversarial attacks designed to break the system. They represent the routine failure modes of technologies marketed as transformative advances in machine intelligence.

The disconnect between marketed performance and actual user experience has become one of the defining tensions of the artificial intelligence era. It raises uncomfortable questions about how we measure machine intelligence, what incentives shape the development and promotion of AI systems, and whether the public has been sold a vision of technological capability that fundamentally misrepresents what these systems can and cannot do. Understanding this gap requires examining the architecture of how AI competence is assessed, the economics that drive development priorities, and the cognitive science of what these systems actually understand about the world they purport to perceive.

The Benchmark Mirage

To understand why AI systems that excel on standardised tests can fail so spectacularly in practice, one must first examine how performance is measured. The Stanford AI Index Report 2025 documented a striking phenomenon: many benchmarks that researchers use to evaluate AI capabilities have become “saturated,” meaning systems score so high that the tests are no longer useful for distinguishing between models. This saturation has occurred across domains including general knowledge, reasoning about images, mathematics, and coding. The Visual Question Answering Challenge, for instance, now sees top-performing models achieving 84.3% accuracy, while the human baseline sits at approximately 80%.

The problem runs deeper than simple test exhaustion. Research conducted by MIT's Computer Science and Artificial Intelligence Laboratory revealed that “traditionally, object recognition datasets have been skewed towards less-complex images, a practice that has led to an inflation in model performance metrics, not truly reflective of a model's robustness or its ability to tackle complex visual tasks.” The researchers developed a new metric called “minimum viewing time” which quantifies the difficulty of recognising an image based on how long a person needs to view it before making a correct identification. When researchers at MIT developed ObjectNet, a dataset comprising images collected from real-life settings rather than curated repositories, they discovered substantial performance gaps between laboratory conditions and authentic deployment scenarios.

This discrepancy reflects a phenomenon that economists have studied for decades: Goodhart's Law, which states that when a measure becomes a target, it ceases to be a good measure. A detailed 68-page analysis from researchers at Cohere, Stanford, MIT, and the Allen Institute for AI documented systematic distortions in how companies approach AI evaluation. The researchers found that major technology firms including Meta, OpenAI, Google, and Amazon were able to “privately pit many model versions in the Arena and then only publish the best results.” This practice creates a misleading picture of consistent high performance rather than the variable and context-dependent capabilities that characterise real AI systems.

The problem of data contamination compounds these issues. When testing GPT-4 on benchmark problems from Codeforces in 2023, researchers found the model could regularly solve problems classified as easy, provided they had been added before September 2021. For problems added later, GPT-4 could not solve a single question correctly. The implication is stark: the model had memorised questions and answers from its training data rather than developing genuine problem-solving capabilities. As one research team observed, the “AI industry has turned benchmarks into targets, and now those benchmarks are failing us.”

The consequence of this gaming dynamic extends beyond misleading metrics. It shapes the entire trajectory of AI development, directing research effort toward whatever narrow capabilities will boost leaderboard positions rather than toward the robust, generalisable intelligence that practical applications require.

Counting Failures and Compositional Collapse

Perhaps nothing illustrates the gap between benchmark performance and real-world competence more clearly than the simple task of counting objects in an image. Research published in late 2024 introduced VLMCountBench, a benchmark testing vision-language models on counting tasks using only basic geometric shapes such as triangles and circles. The findings were revealing: while these sophisticated AI systems could count reliably when only one shape type was present, they exhibited substantial failures when multiple shape types were combined. This phenomenon, termed “compositional counting failure,” suggests that these systems lack the discrete object representations that make counting trivial for humans.

This limitation has significant implications for practical applications. A study using Bongard problems, visual puzzles that test pattern recognition and abstraction, found that humans achieved an 84% success rate on average, while the best-performing vision-language model, GPT-4o, managed only 17%. The researchers noted that “even elementary concepts that may seem trivial to humans, such as simple spirals, pose significant challenges” for these systems. They observed that “most models misinterpreted or failed to count correctly, suggesting challenges in AI's visual counting capabilities.”

Text-to-image generation systems demonstrate similar limitations. Research on the T2ICountBench benchmark revealed that “all state-of-the-art diffusion models fail to generate the correct number of objects, with accuracy dropping significantly as the number of objects increases.” When asked to generate an image of ten oranges, these systems frequently produce either substantially more or fewer items than requested. The failure is not occasional or marginal but systematic and predictable. As one research paper noted, “depicting a specific number of objects in the image with text conditioning often fails to capture the exact quantity of details.”

These counting failures point to a more fundamental issue in how current AI architectures process visual information. Unlike human cognition, which appears to involve discrete object representations and symbolic reasoning about quantities, large vision-language models operate on statistical patterns learned from training data. They can recognise that images containing many objects of a certain type tend to have particular visual characteristics, but they lack what researchers call robust “world models” that would allow them to track individual objects and their properties reliably.

The practical implications extend far beyond academic curiosity. Consider an AI system deployed to monitor inventory in a warehouse, assess damage after a natural disaster, or count cells in a medical sample. Systematic failures in numerical accuracy would render such applications unreliable at best and dangerous at worst.

The Architectural Divide

The question of whether these failures represent fundamental limitations of current AI architectures or merely training deficiencies remains actively debated. Gary Marcus, professor emeritus of psychology and neural science at New York University and author of the 2024 book “Taming Silicon Valley: How We Can Ensure That AI Works for Us,” has argued consistently that neural networks face inherent constraints in tasks requiring abstraction and symbolic reasoning.

Marcus has pointed to a problem he first demonstrated in 1998: neural networks trained on even numbers could generalise to some new even numbers, but when tested on odd numbers, they would systematically fail. He concluded that “these tools are good at interpolating functions, but not very good at extrapolating functions.” This distinction between interpolation within known patterns and extrapolation to genuinely novel situations lies at the heart of the benchmark-reality gap.

Marcus characterises current large language models as systems that “work at the extensional level, but they don't work at the intentional level. They are not getting the abstract meaning of anything.” The chess-playing failures of models like ChatGPT, which Marcus has documented attempting illegal moves such as having a Queen jump over a knight, illustrate how systems can “approximate the game of chess, but can't play it reliably because it never induces a proper world model of the board and the rules.” He has emphasised that these systems “still fail at abstraction, at reasoning, at keeping track of properties of individuals. I first wrote about hallucinations in 2001.”

Research on transformer architectures, the technical foundation underlying most modern AI systems, has identified specific limitations in spatial reasoning. A 2024 paper titled “On Limitations of the Transformer Architecture” identified “fundamental incompatibility with the Transformer architecture for certain problems, suggesting that some issues should not be expected to be solvable in practice indefinitely.” The researchers documented that “when prompts involve spatial information, transformer-based systems appear to have problems with composition.” Simple cases where temporal composition fails cause all state-of-the-art models to return incorrect answers.

The limitations extend to visual processing as well. Research has found that “ViT learns long-range dependencies via self-attention between image patches to understand global context, but the patch-based positional encoding mechanism may miss relevant local spatial information and usually cannot attain the performance of CNNs on small-scale datasets.” This architectural limitation has been highlighted particularly in radiology applications where critical findings are often minute and contained within small spatial locations.

Melanie Mitchell, professor at the Santa Fe Institute whose research focuses on conceptual abstraction and analogy-making in artificial intelligence, has offered a complementary perspective. Her recent work includes a 2025 paper titled “Do AI models perform human-like abstract reasoning across modalities?” which examines whether these systems engage in genuine reasoning or sophisticated pattern matching. Mitchell has argued that “there's a lot of evidence that LLMs aren't reasoning abstractly or robustly, and often over-rely on memorised patterns in their training data, leading to errors on 'out of distribution' problems.”

Mitchell identifies a crucial gap in current AI systems: the absence of “rich internal models of the world.” As she notes, “a tenet of modern cognitive science is that humans are not simply conditioned-reflex machines; instead, we have inside our heads abstracted models of the physical and social worlds that reflect the causes of events rather than merely correlations among them.” Current AI systems, despite their impressive performance on narrow benchmarks, appear to lack this causal understanding.

An alternative view holds that these limitations may be primarily a consequence of training data rather than architectural constraints. Some researchers hypothesise that “the limited spatial reasoning abilities of current VLMs is not due to a fundamental limitation of their architecture, but rather is a limitation in common datasets available at scale on which such models are trained.” This perspective suggests that co-training multimodal models on synthetic spatial data could potentially address current weaknesses. Additionally, researchers note that “VLMs' limited spatial reasoning capability may be due to the lack of 3D spatial knowledge in training data.”

When Failures Cause Harm

The gap between benchmark performance and real-world capability becomes consequential when AI systems are deployed in high-stakes domains. The case of autonomous vehicles provides particularly sobering examples. According to data compiled by researchers at Craft Law Firm, between 2021 and 2024, there were 3,979 incidents involving autonomous vehicles in the United States, resulting in 496 reported injuries and 83 fatalities. The Stanford AI Index Report 2025 noted that the AI Incidents Database recorded 233 incidents in 2024, a 56.4% increase compared to 2023, marking a record high.

In May 2025, Waymo recalled over 1,200 robotaxis following disclosure of a software flaw that made vehicles prone to colliding with certain stationary objects, specifically “thin or suspended barriers like chains, gates, and even utility poles.” These objects, which human drivers would navigate around without difficulty, apparently fell outside the patterns the perception system had learned to recognise. Investigation revealed failures in the system's ability to properly classify and respond to stationary objects under certain lighting and weather conditions. As of April 2024, Tesla's Autopilot system had been involved in at least 13 fatal crashes according to NHTSA data, with Tesla's Full Self-Driving system facing fresh regulatory scrutiny in January 2025.

The 2018 Uber fatal accident in Tempe, Arizona, illustrated similar limitations. The vehicle's sensors detected a pedestrian, but the AI system failed to classify her accurately as a human, leading to a fatal collision. The safety driver was distracted by a mobile device and did not intervene in time. As researchers have noted, “these incidents reveal a fundamental problem with current AI systems: they excel at pattern recognition in controlled environments but struggle with edge cases that human drivers handle instinctively.” The failure to accurately classify the pedestrian as a human being highlighted a critical weakness in object recognition capabilities, particularly in low-light conditions and complex environments.

A particularly disturbing incident involved General Motors' Cruise robotaxi in San Francisco, where the vehicle struck a pedestrian who had been thrown into its path by another vehicle, then dragged her twenty feet before stopping. The car's AI systems failed to recognise that a human being was trapped underneath the vehicle. When the system detected an “obstacle,” it continued to move, causing additional severe injuries.

These cases highlight how AI systems that perform admirably on standardised perception benchmarks can fail catastrophically when encountering situations not well-represented in their training data. The gap between laboratory performance and deployment reality is not merely academic; it translates directly into physical harm.

The Gorilla Problem That Never Went Away

One of the most persistent examples of AI visual recognition failure involves the 2015 incident in which Google Photos labelled photographs of Black individuals as “gorillas.” In that incident, a Black software developer tweeted that Google Photos had labelled images of him with a friend as “gorillas.” The incident exposed how image recognition algorithms trained on biased data can produce racist outputs. Google's response was revealing: rather than solving the underlying technical problem, the company blocked the words “gorilla,” “chimpanzee,” “monkey,” and related terms from the system entirely.

Nearly a decade later, that temporary fix remains in place. By censoring these searches, the service can no longer find primates such as “gorilla,” “chimp,” “chimpanzee,” or “monkey.” Despite enormous advances in AI technology since 2015, Google Photos still refuses to label images of gorillas. This represents a tacit acknowledgement that the fundamental problem has not been solved, only circumvented. The workaround creates a peculiar situation where one of the world's most advanced image recognition systems cannot identify one of the most recognisable animals on Earth. As one analysis noted, “Apple learned from Google's mistake and simply copied their fix.”

The underlying issue extends beyond a single company's product. Research has consistently documented that commercially available facial recognition technologies perform far worse on darker-skinned individuals, particularly women. Three commercially available systems made by Microsoft, IBM, and Megvii misidentified darker female faces nearly 35% of the time while achieving near-perfect accuracy (99%) on white men.

These biases have real consequences. Cases such as Ousmane Bah, a teenager wrongly accused of theft at an Apple Store because of faulty face recognition, and Amara K. Majeed, wrongly accused of participating in the 2019 Sri Lanka bombings after her face was misidentified, demonstrate how AI failures disproportionately harm marginalised communities. The technology industry's approach of deploying these systems despite known limitations and then addressing failures reactively raises serious questions about accountability and the distribution of risk.

The Marketing Reality Gap

The discrepancy between how AI capabilities are marketed and how they perform in practice reflects a broader tension in the technology industry. A global study led by Professor Nicole Gillespie at Melbourne Business School surveying over 48,000 people across 47 countries between November 2024 and January 2025 found that although 66% of respondents already use AI with some regularity, less than half (46%) are willing to trust it. Notably, this represents a decline in trust compared to surveys conducted prior to ChatGPT's release in 2022. People have become less trusting and more worried about AI as adoption has increased.

The study found that consumer distrust is growing significantly: 63% of consumers globally do not trust AI with their data, up from 44% in 2024. In the United Kingdom, the situation is even starker, with 76% of shoppers feeling uneasy about AI handling their information. Research from the Nuremberg Institute for Market Decisions showed that only 21% of respondents trust AI companies and their promises, and only 20% trust AI itself. These findings reveal “a notable gap between general awareness of AI in marketing and a deeper understanding or trust in its application.”

Emily Bender, professor of linguistics at the University of Washington and one of the authors of the influential 2021 “stochastic parrots” paper, has been a prominent voice challenging AI hype. Bender was recognised in TIME Magazine's first 100 Most Influential People in Artificial Intelligence and is the author of the upcoming book “The AI Con: How to Fight Big Tech's Hype and Create the Future We Want.” She has argued that “so much of what we read about language technology and other things that get called AI makes the technology sound magical. It makes it sound like it can do these impossible things, and that makes it that much easier for someone to sell a system that is supposedly objective but really just reproduces systems of oppression.”

The practical implications of this marketing-reality gap are significant. A McKinsey global survey in early 2024 found that 65% of respondents said their organisations use generative AI in some capacity, nearly double the share from ten months prior. However, despite widespread experimentation, “comprehensive integration of generative AI into core business operations remains limited.” A 2024 Deloitte study noted that “organisational change only happens so fast” despite rapid AI advances, meaning many companies are deliberately testing in limited areas before scaling up.

The gap is particularly striking in mental health applications. Despite claims that AI is replacing therapists, only 21% of the 41% of adults who sought mental health support in the past six months turned to AI, representing only 9% of the total population. The disconnect between hype and actual behaviour underscores how marketing narratives can diverge sharply from lived reality.

Hallucinations and Multimodal Failures

The problem of AI systems generating plausible but incorrect outputs, commonly termed “hallucinations,” extends beyond text into visual domains. Research published in 2024 documented that multimodal large language models “often generate outputs that are inconsistent with the visual content, a challenge known as hallucination, which poses substantial obstacles to their practical deployment and raises concerns regarding their reliability in real-world applications.”

Object hallucination represents a particularly problematic failure mode, occurring when models identify objects that do not exist in an image. Researchers have developed increasingly sophisticated benchmarks to evaluate these failures. ChartHal, a benchmark featuring a taxonomy of hallucination scenarios in chart understanding, demonstrated that “state-of-the-art LVLMs suffer from severe hallucinations” when interpreting visual data.

The VHTest benchmark introduced in 2024 comprises 1,200 diverse visual hallucination instances across eight modes. Medical imaging presents particular risks: the MediHall Score benchmark was developed specifically to assess hallucinations in medical contexts through a hierarchical scoring system. When AI systems hallucinate in clinical settings, the consequences can be life-threatening.

Mitigation efforts have shown some promise. One recent framework operating entirely with frozen, pretrained vision-language models and requiring no gradient updates “reduces hallucination rates by 9.8 percentage points compared to the baseline, while improving object existence accuracy by 4.7 points on adversarial splits.” Research by Yu et al. (2023) explored human error detection to mitigate hallucinations, successfully reducing them by 44.6% while maintaining competitive performance.

However, Gary Marcus has argued that there is “no principled solution to hallucinations in systems that traffic only in the statistics of language without explicit representation of facts and explicit tools to reason over those facts.” This perspective suggests that hallucinations are not bugs to be fixed but fundamental characteristics of current architectural approaches. He advocates for neurosymbolic AI, which would combine neural networks with symbolic AI, making an analogy to Daniel Kahneman's System One and System Two thinking.

The ARC Challenge and the Limits of Pattern Matching

Francois Chollet, the creator of Keras, an open-source deep learning library adopted by over 2.5 million developers, introduced the Abstraction and Reasoning Corpus (ARC) in 2019 as a benchmark designed to measure fluid intelligence rather than narrow task performance. ARC consists of 800 puzzle-like tasks designed as grid-based visual reasoning problems. These tasks, trivial for humans but challenging for machines, typically provide only a small number of example input-output pairs, usually around three.

What makes ARC distinctive is its focus on measuring the ability to “generalise from limited examples, interpret symbolic meaning, and flexibly apply rules in varying contexts.” Unlike benchmarks that can be saturated through extensive training on similar problems, ARC tests precisely the kind of novel reasoning that current AI systems struggle to perform. The benchmark “requires the test taker to deduce underlying rules through abstraction, inference, and prior knowledge rather than brute-force or extensive training.”

From its introduction in 2019 until late 2024, ARC remained essentially unsolved by AI systems, maintaining its reputation as one of the toughest benchmarks available for general intelligence. The ARC Prize competition, co-founded by Mike Knoop and Francois Chollet, saw 1,430 teams submit 17,789 entries in 2024. The state-of-the-art score on the ARC private evaluation set increased from 33% to 55.5% during the competition period, propelled by techniques including deep learning-guided program synthesis and test-time training. More than $125,000 in prizes were awarded across top papers and top scores.

While this represents meaningful progress, it remains far below human performance and the 85% threshold set for the $500,000 grand prize. The persistent difficulty of ARC highlights a crucial distinction: current AI systems excel at tasks that can be solved through pattern recognition and interpolation within training distributions but struggle with the kind of abstract reasoning that humans perform effortlessly.

Trust Erosion and the Normalisation of Failure

Research on human-AI interaction has documented asymmetric trust dynamics: building trust in AI takes more time compared to building trust in humans, but when AI encounters problems, trust loss occurs more rapidly. Studies have found that simpler tasks show greater degradation of trust following errors, suggesting that failures on tasks perceived as easy may be particularly damaging to user confidence.

This pattern reflects what researchers term “perfect automation schema,” the tendency for users to expect flawless performance from AI systems and interpret any deviation as evidence of fundamental inadequacy rather than normal performance variation. The marketing of AI as approaching or exceeding human capabilities may inadvertently amplify this effect by setting unrealistic expectations.

Research comparing early and late errors found that initial errors affect trust development more negatively than late ones in some studies, while others found that trust dropped most for late mistakes. The explanation may be that early mistakes allow people to adjust expectations over time, whereas trust damaged at a later stage proves more difficult to repair. Research has found that “explanations that combine causal attribution (explaining why the error occurred) with boundary specification (identifying system limitations) prove most effective for competence-based trust repair.”

The normalisation of AI failures presents a concerning trajectory. If users come to expect that AI systems will periodically produce nonsensical or harmful outputs, they may either develop excessive caution that undermines legitimate use cases or, alternatively, become desensitised to failures in ways that increase risk. Neither outcome serves the goal of beneficial AI deployment.

Measuring Intelligence or Measuring Training

The fundamental question underlying these failures concerns what benchmarks actually measure. The dramatic improvement in AI performance on new benchmarks shortly after their introduction, documented by the Stanford AI Index, suggests that current systems are exceptionally effective at optimising for whatever metrics researchers define. In 2023, AI systems could solve just 4.4% of coding problems on SWE-bench. By 2024, this figure had jumped to 71.7%. Performance on MMMU and GPQA saw gains of 18.8 and 48.9 percentage points respectively.

This pattern of rapid benchmark saturation has led some researchers to question whether improvements reflect genuine capability gains or increasingly sophisticated ways of matching test distributions. The Stanford report noted that despite strong benchmark performance, “AI models excel at tasks like International Mathematical Olympiad problems but still struggle with complex reasoning benchmarks like PlanBench. They often fail to reliably solve logic tasks even when provably correct solutions exist.”

The narrowing performance gaps between models further complicate the picture. According to the AI Index, the Elo score difference between the top and tenth-ranked model on the Chatbot Arena Leaderboard was 11.9% in 2023. By early 2025, this gap had narrowed to just 5.4%. Similarly, the difference between the top two models shrank from 4.9% in 2023 to just 0.7% in 2024.

The implications for AI development are significant. If benchmarks are increasingly unreliable guides to real-world performance, the incentive structure for AI research may be misaligned with the goal of building genuinely capable systems. Companies optimising for benchmark rankings may invest disproportionately in test-taking capabilities at the expense of robustness and reliability in deployment.

Francois Chollet has framed this concern explicitly, arguing that ARC-style tasks test “the ability to generalise from limited examples, interpret symbolic meaning, and flexibly apply rules in varying contexts” rather than the ability to recognise patterns encountered during training. The distinction matters profoundly for understanding what current AI systems can and cannot do.

Reshaping Expectations and Rebuilding Trust

Addressing the gap between marketed performance and actual capability will require changes at multiple levels. Researchers have begun developing dynamic benchmarks that are regularly updated to prevent data contamination. LiveBench, for example, is updated with new questions monthly, many from recently published sources, ensuring that performance cannot simply reflect memorisation of training data. This approach represents “a close cousin of the private benchmark” that keeps benchmarks fresh without worrying about contamination.

Greater transparency about the conditions under which AI systems perform well or poorly would help users develop appropriate expectations. OpenAI's documentation acknowledges that their models struggle with “tasks requiring precise spatial localisation, such as identifying chess positions” and “may generate incorrect descriptions or captions in certain scenarios.” Such candour, while not universal in the industry, represents a step toward more honest communication about system limitations.

The AI Incidents Database, maintained by the Partnership on AI, and the AIAAIC Repository provide systematic tracking of AI failures. The AIAAIC documented that in 2024, while incidents declined to 187 compared to the previous year, issues surged to 188, the highest number recorded, totalling 375 occurrences, ten times more than in 2016. Accuracy and reliability and safety topped the list of incident categories. OpenAI, Tesla, Google, and Meta account for the highest number of AI-related incidents in the repository.

Academic researchers have proposed that evaluation frameworks should move beyond narrow task performance to assess broader capabilities including robustness to distribution shift, calibration of confidence, and graceful degradation when facing unfamiliar inputs. Melanie Mitchell has argued that “AI systems ace benchmarks yet stumble in the real world, and it's time to rethink how we probe intelligence in machines.”

Mitchell maintains that “just scaling up these same kinds of models will not solve these problems. Some new approach has to be created, as there are basic capabilities that current architectures and training methods aren't going to overcome.” She notes that current models “are not learning from their mistakes in any long-term sense. They can't carry learning from one session to another. They also have no 'episodic memory,' unlike humans who learn from experiences, mistakes, and successes.”

The gap between benchmark performance and real-world capability is not simply a technical problem awaiting a technical solution. It reflects deeper questions about how we define and measure intelligence, what incentives shape technology development, and how honest we are prepared to be about the limitations of systems we deploy in consequential domains. The answers to these questions will shape not only the trajectory of AI development but also the degree to which public trust in these technologies can be maintained or rebuilt.

For now, the most prudent stance may be one of calibrated scepticism: appreciating what AI systems can genuinely accomplish while remaining clear-eyed about what they cannot. The benchmark scores may be impressive, but the measure of a technology's value lies not in how it performs in controlled conditions but in how it serves us in the messy, unpredictable complexity of actual use.

---

References and Sources

• Stanford Human-Centered AI. (2025). “The 2025 AI Index Report: Technical Performance.” https://hai.stanford.edu/ai-index/2025-ai-index-report/technical-performance
• Stanford HAI. (2025). “AI Benchmarks Hit Saturation.” https://hai.stanford.edu/news/ai-benchmarks-hit-saturation
• MIT News. (2023). “Image recognition accuracy: An unseen challenge confounding today's AI.” https://news.mit.edu/2023/image-recognition-accuracy-minimum-viewing-time-metric-1215
• Collinear AI. (2024). “Gaming the System: Goodhart's Law Exemplified in AI Leaderboard Controversy.” https://blog.collinear.ai/p/gaming-the-system-goodharts-law-exemplified-in-ai-leaderboard-controversy
• Marcus, G. (2025). “Generative AI's crippling and widespread failure to induce robust models of the world.” https://garymarcus.substack.com/p/generative-ais-crippling-and-widespread
• Marcus, G. (2024). “Taming Silicon Valley: How We Can Ensure That AI Works for Us.” MIT Press.
• Mitchell, M. (2025). “AI's challenge of understanding the world.” Science. https://www.science.org/doi/10.1126/science.adm8175
• Mitchell, M. (2025). “The LLM Reasoning Debate Heats Up.” https://aiguide.substack.com/p/the-llm-reasoning-debate-heats-up
• AIAAIC Repository. (2025). “AI, algorithmic, and automation incidents.” https://www.aiaaic.org/aiaaic-repository
• AI Incident Database. (2025). Partnership on AI. https://incidentdatabase.ai/
• Craft Law Firm. (2024). “Data Analysis: Self-Driving Car Accidents [2019-2024].” https://www.craftlawfirm.com/autonomous-vehicle-accidents-2019-2024-crash-data/
• Responsible AI Labs. (2025). “AI Safety Incidents of 2024: Lessons from Real-World Failures.” https://responsibleailabs.ai/knowledge-hub/articles/ai-safety-incidents-2024
• AlgorithmWatch. (2020). “Google apologizes after its Vision AI produced racist results.” https://algorithmwatch.org/en/google-vision-racism/
• KPMG/University of Melbourne. (2025). “Trust, attitudes and use of artificial intelligence: A global study 2025.” https://kpmg.com/xx/en/our-insights/ai-and-technology/trust-attitudes-and-use-of-ai.html
• Nuremberg Institute for Market Decisions. (2024). “Consumer attitudes toward AI-generated marketing content.” https://www.nim.org/en/publications/detail/transparency-without-trust
• Bender, E. et al. (2021). “On the Dangers of Stochastic Parrots: Can Language Models Be Too Big?” ACM Conference on Fairness, Accountability, and Transparency.
• Chollet, F. (2019). “On the Measure of Intelligence.” arXiv:1911.01547. https://arxiv.org/abs/1911.01547
• ARC Prize Foundation. (2024). “ARC Prize 2024: Technical Report.” https://arcprize.org/media/arc-prize-2024-technical-report.pdf
• The Debrief. (2024). “AI's Puzzle-Solving Limitations: Vision-Language Models Struggle with Human-Like Pattern Recognition.” https://thedebrief.org/29289-2-vision-language-models/
• arXiv. (2024). “On Limitations of the Transformer Architecture.” https://arxiv.org/html/2402.08164v1
• arXiv. (2024). “Hallucination of Multimodal Large Language Models: A Survey.” https://arxiv.org/abs/2404.18930
• arXiv. (2024). “Your Vision-Language Model Can't Even Count to 20.” https://arxiv.org/abs/2510.04401v1
• Frontiers in Psychology. (2024). “Developing trustworthy artificial intelligence: insights from research on interpersonal, human-automation, and human-AI trust.” https://www.frontiersin.org/journals/psychology/articles/10.3389/fpsyg.2024.1382693/full
• OpenAI. (2024). “GPT-4o System Card.” https://cdn.openai.com/gpt-4o-system-card.pdf
• Deloitte. (2024). “Earning trust as gen AI takes hold: 2024 Connected Consumer Survey.” https://www.deloitte.com/us/en/insights/industry/telecommunications/connectivity-mobile-trends-survey/2024.html
• IEEE Spectrum. (2025). “The State of AI 2025: 12 Eye-Opening Graphs.” https://spectrum.ieee.org/ai-index-2025

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

Somewhere in a data warehouse, a customer record sits incomplete. A postcode field contains only the first half of its expected value. An email address lacks its domain. A timestamp references a date that never existed. These fragments of broken data might seem trivial in isolation, but multiply them across millions of records and the consequences become staggering. According to Gartner research, poor data quality costs organisations an average of $12.9 million annually, whilst MIT Sloan Management Review research with Cork University Business School found that companies lose 15 to 25 percent of revenue each year due to data quality failures.

The challenge facing modern enterprises is not merely detecting these imperfections but deciding what to do about them. Should a machine learning algorithm guess at the missing values? Should a rule-based system fill gaps using statistical averages? Or should a human being review each problematic record individually? The answer, as it turns out, depends entirely on what you are trying to protect and what you can afford to lose.

The Anatomy of Broken Content

Before examining solutions, it is worth understanding what breaks and why. Content can fail in countless ways: fields left empty during data entry, format inconsistencies introduced during system migrations, encoding errors from international character sets, truncation from legacy database constraints, and corruption from network transmission failures. Each failure mode demands a different repair strategy.

The taxonomy of data quality dimensions provides a useful framework. Researchers have identified core metrics including accuracy, completeness, consistency, timeliness, validity, availability, and uniqueness. A missing value represents a completeness failure. A postcode that does not match its corresponding city represents a consistency failure. A price expressed in pounds where euros were expected represents a validity failure. Each dimension requires different detection logic and repair approaches.

The scale of these problems is often underestimated. A systematic survey of software tools dedicated to data quality identified 667 distinct platforms, reflecting the enormity of the challenge organisations face. Traditional approaches relied on manually generated criteria to identify issues, a process that was both time-consuming and resource-intensive. Newer systems leverage machine learning to automate rule creation and error identification, producing more consistent and accurate outputs.

Modern data quality tools have evolved to address these varied failure modes systematically. Platforms such as Great Expectations, Monte Carlo, Anomalo, and dbt have emerged as industry standards for automated detection. Great Expectations, an open-source Python library, allows teams to define validation rules and run them continuously across data pipelines. The platform supports schema validation to ensure data conforms to specified structures, value range validation to confirm data falls within expected bounds, and row count validation to verify record completeness. This declarative approach to data quality has gained significant traction, with the tool now integrating seamlessly with Apache Airflow, Apache Spark, dbt, and cloud platforms including Snowflake and BigQuery.

Monte Carlo has taken a different approach, pioneering what the industry calls data observability. The platform uses unsupervised machine learning to detect anomalies across structured, semi-structured, and unstructured data without requiring manual configuration. According to Gartner estimates, by 2026, 50 percent of enterprises implementing distributed data architectures will adopt data observability tools, up from less than 20 percent in 2024. This projection reflects a fundamental shift in how organisations think about data quality: from reactive firefighting to proactive monitoring. The company, having raised $200 million in Series E funding at a $3.5 billion valuation, counts organisations including JetBlue and Nasdaq among its enterprise customers.

The Three Pillars of Automated Repair

Once malformed content is detected, organisations face a crucial decision: how should it be repaired? Three distinct approaches have emerged, each with different risk profiles, resource requirements, and accuracy characteristics.

Heuristic Imputation: The Statistical Foundation

The oldest and most straightforward approach to data repair relies on statistical heuristics. When a value is missing, replace it with the mean, median, or mode of similar records. When a format is inconsistent, apply a transformation rule. When a constraint is violated, substitute a default value. These methods are computationally cheap, easy to understand, and broadly applicable.

Mean imputation, for instance, calculates the average of all observed values for a given field and uses that figure to fill gaps. If customer ages range from 18 to 65 with an average of 42, every missing age field receives the value 42. This approach maintains the overall mean of the dataset but introduces artificial clustering around that central value, distorting the true distribution of the data. Analysts working with mean-imputed data may draw incorrect conclusions about population variance and make flawed predictions as a result.

Regression imputation offers a more sophisticated alternative. Rather than using a single value, regression models predict missing values based on relationships with other variables. A missing salary figure might be estimated from job title, years of experience, and geographic location. This preserves some of the natural variation in the data but assumes linear relationships that may not hold in practice. When non-linear relationships exist between variables, linear regression-based imputation performs poorly, creating systematic errors that propagate through subsequent analyses.

Donor-based imputation, used extensively by statistical agencies including Statistics Canada, the U.S. Bureau of Labor Statistics, and the U.S. Census Bureau, takes values from similar observed records and applies them to incomplete ones. For each recipient with a missing value, a donor is identified based on similarity across background characteristics. This approach preserves distributional properties more effectively than mean imputation but requires careful matching criteria to avoid introducing bias.

The fundamental limitation of all heuristic methods is their reliance on assumptions. Mean imputation assumes values cluster around a central tendency. Regression imputation assumes predictable relationships between variables. Donor imputation assumes that similar records should have similar values. When these assumptions fail, the repairs introduce systematic errors that compound through downstream analyses.

Machine Learning Inference: The Algorithmic Frontier

Machine learning approaches to data repair represent a significant evolution from statistical heuristics. Rather than applying fixed rules, ML algorithms learn patterns from the data itself and use those patterns to generate contextually appropriate repairs.

K-nearest neighbours (KNN) imputation exemplifies this approach. The algorithm identifies records most similar to the incomplete one across multiple dimensions, then uses values from those neighbours to fill gaps. Research published in BMC Medical Informatics found that KNN algorithms demonstrated the overall best performance as assessed by mean squared error, with results independent from the mechanism of randomness and applicable to both Missing at Random (MAR) and Missing Completely at Random (MCAR) data. Due to its simplicity, comprehensibility, and relatively high accuracy, the KNN approach has been successfully deployed in real data processing applications at major statistical agencies.

However, the research revealed an important trade-off. While KNN with higher k values (more neighbours) reduced imputation errors, it also distorted the underlying data structure. The use of three neighbours in conjunction with feature selection appeared to provide the best balance between imputation accuracy and preservation of data relationships. This finding underscores a critical principle: repair methods must be evaluated not only on how accurately they fill gaps but on how well they preserve the analytical value of the dataset. Research on longitudinal prenatal data found that using five nearest neighbours with appropriate temporal segmentation provided imputed values with the least error, with no difference between actual and predicted values for 64 percent of deleted segments.

MissForest, an iterative imputation method based on random forests, has emerged as a particularly powerful technique for complex datasets. By averaging predictions across many decision trees, the algorithm handles mixed data types and captures non-linear relationships that defeat simpler methods. Original evaluations showed missForest reducing imputation error by more than 50 percent compared to competing approaches, particularly in datasets with complex interactions. The algorithm uses built-in out-of-bag error estimates to assess imputation accuracy without requiring separate test sets, enabling continuous quality monitoring during the imputation process.

Yet missForest is not without limitations. Research published in BMC Medical Research Methodology found that while the algorithm achieved high predictive accuracy for individual missing values, it could produce severely biased regression coefficient estimates when imputed variables were used in subsequent statistical analyses. The algorithm's tendency to predict toward variable means introduced systematic distortions that accumulated through downstream modelling. This finding led researchers to conclude that random forest-based imputation should not be indiscriminately used as a universal solution; correct analysis requires careful assessment of the missing data mechanism and the interrelationships between variables.

Multiple Imputation by Chained Equations (MICE), sometimes called fully conditional specification, represents another sophisticated ML-based approach. Rather than generating a single imputed dataset, MICE creates multiple versions, each with different plausible values for missing entries. This technique accounts for statistical uncertainty in the imputations and has emerged as a standard method in statistical research. The MICE algorithm, first appearing in 2000 as an S-PLUS library and subsequently as an R package in 2001, can impute mixes of continuous, binary, unordered categorical, and ordered categorical data whilst maintaining consistency through passive imputation. The approach preserves variable distributions and relationships between variables more effectively than univariate imputation methods, though it requires significant computational resources and expertise to implement correctly. Generally, ten cycles are performed during imputation, though research continues on identifying optimal iteration counts under different conditions.

The general consensus from comparative research is that ML-based methods preserve data distribution better than simple imputations, whilst hybrid techniques combining multiple approaches yield the most robust results. Optimisation-based imputation methods have demonstrated average reductions in mean absolute error of 8.3 percent against the best cross-validated benchmark methods across diverse datasets. Studies have shown that the choice of imputation method directly influences how machine learning models interpret and rank features; proper feature importance analysis ensures models rely on meaningful predictors rather than artefacts of data preprocessing.

Human Review: The Accuracy Anchor

Despite advances in automation, human review remains essential for certain categories of data repair. The reason is straightforward: humans can detect subtle, realistic-sounding failure cases that automated systems routinely miss. A machine learning model might confidently predict a plausible but incorrect value. A human reviewer can recognise contextual signals that indicate the prediction is wrong. Humans can distinguish between technically correct responses and actually helpful responses, a distinction that proves critical when measuring user satisfaction, retention, or trust.

Field studies have demonstrated that human-in-the-loop approaches can maintain accuracy levels of 87 percent whilst reducing annotation costs by 62 percent and time requirements by a factor of three. The key is strategic allocation of human effort. Automated systems handle routine cases whilst human experts focus on ambiguous, complex, or high-stakes situations. One effective approach combines multiple prompts or multiple language models and calculates the entropy of predictions to determine whether automated annotation is reliable enough or requires human review.

Research on automated program repair in software engineering has illuminated the trust dynamics at play. Studies found that whether code repairs were produced by humans or automated systems significantly influenced trust perceptions and intentions. The research also discovered that test suite provenance, whether tests were written by humans or automatically generated, had a significant effect on patch quality, with developer-written tests typically producing higher-quality repairs. This finding extends to data repair: organisations may be more comfortable deploying automated repairs for low-risk fields whilst insisting on human review for critical business data.

Combined human-machine systems have demonstrated superior performance in domains where errors carry serious consequences. Medical research has shown that collaborative approaches outperform both human-only and ML-only systems in tasks such as identifying breast cancer from medical imaging. The principle translates directly to data quality: neither humans nor machines should work alone.

The optimal hybrid approach involves iterative annotation. Human annotators initially label a subset of problematic records, the automated system learns from these corrections and makes predictions on new records, human annotators review and correct errors, and the cycle repeats. Uncertainty sampling focuses human attention on cases where the automated system has low confidence, maximising the value of human expertise whilst minimising tedious review of straightforward cases. This approach allows organisations to manage costs while maintaining efficiency by strategically allocating human involvement.

Matching Methods to Risk Profiles

The choice between heuristic, ML-based, and human-mediated repair depends critically on the risk profile of the data being repaired. Three factors dominate the decision.

Consequence of Errors: What happens if a repair is wrong? For marketing analytics, an incorrectly imputed customer preference might result in a slightly suboptimal campaign. For financial reporting, an incorrectly imputed transaction amount could trigger regulatory violations. For medical research, an incorrectly imputed lab value could lead to dangerous treatment decisions. The higher the stakes, the stronger the case for human review.

Volume and Velocity: How much data requires repair, and how quickly must it be processed? Human review scales poorly. A team of analysts might handle hundreds of records per day; automated systems can process millions. Real-time pipelines using technologies such as Apache Kafka and Apache Spark Streaming demand automated approaches simply because human review cannot keep pace. These architectures handle millions of messages per second with built-in fault tolerance and horizontal scalability.

Structural Complexity: How complicated are the relationships between variables? Simple datasets with independent fields can be repaired effectively using basic heuristics. Complex datasets with intricate interdependencies between variables require sophisticated ML approaches that can model those relationships. Research consistently shows that missForest and similar algorithms excel when complex interactions and non-linear relations are present.

A practical framework emerges from these considerations. Low-risk, high-volume data with simple structure benefits from heuristic imputation: fast, cheap, good enough. Medium-risk data with moderate complexity warrants ML-based approaches: better accuracy, acceptable computational cost. High-risk data, regardless of volume or complexity, requires human review: slower and more expensive, but essential for protecting critical business processes.

Enterprise Toolchains in Practice

The theoretical frameworks for data repair translate into concrete toolchains that enterprises deploy across their data infrastructure. Understanding these implementations reveals how organisations balance competing demands for speed, accuracy, and cost.

Detection Layer: Modern toolchains begin with continuous monitoring. Great Expectations provides declarative validation rules that run against data as it flows through pipelines. Teams define expectations such as column values should be unique, values should fall within specified ranges, or row counts should match expected totals. The platform generates validation reports and can halt pipeline execution when critical checks fail. Data profiling capabilities generate detailed summaries including statistical measures, distributions, and patterns that can be compared over time to identify changes indicating potential issues.

dbt (data build tool) has emerged as a complementary technology, with over 60,000 teams worldwide relying on it for data transformation and testing. The platform includes built-in tests for common quality checks: unique values, non-null constraints, accepted value ranges, and referential integrity between tables. About 40 percent of dbt projects run tests each week, reflecting the integration of quality checking into routine data operations. The tool has been recognised as both Snowflake Data Cloud Partner of the Year and Databricks Customer Impact Partner of the Year, reflecting its growing enterprise importance.

Monte Carlo and Anomalo represent the observability layer, using machine learning to detect anomalies that rule-based systems miss. These platforms monitor for distribution drift, schema changes, volume anomalies, and freshness violations. When anomalies are detected, automated alerts trigger investigation workflows. Executive-level dashboards present key metrics including incident frequency, mean time to resolution, platform adoption rates, and overall system uptime with automated updates.

Repair Layer: Once issues are detected, repair workflows engage. ETL platforms such as Oracle Data Integrator and Talend provide error handling within transformation layers. Invalid records can be redirected to quarantine areas for later analysis, ensuring problematic data does not contaminate target systems whilst maintaining complete data lineage. When completeness failures occur, graduated responses match severity to business impact: minor gaps generate warnings for investigation, whilst critical missing data that would corrupt financial reporting halts pipeline processing entirely.

AI-powered platforms have begun automating repair decisions. These systems detect and correct incomplete, inconsistent, and incorrect records in real time, reducing manual effort by up to 50 percent according to vendor estimates. The most sophisticated implementations combine rule-based repairs for well-understood issues with ML-based imputation for complex cases and human escalation for high-risk or ambiguous situations.

Orchestration Layer: Apache Airflow, Prefect, and similar workflow orchestration tools coordinate the components. A typical pipeline might ingest data from source systems, run validation checks, route records to appropriate repair workflows based on error types and risk levels, apply automated corrections where confidence is high, queue uncertain cases for human review, and deliver cleansed data to target systems.

Schema registries, particularly in Kafka-based architectures, enforce data contracts at the infrastructure level. Features include schema compatibility checking, versioning support, and safe evolution of data structures over time. This proactive approach prevents many quality issues before they occur, ensuring data compatibility across distributed systems.

Measuring Business Impact

Deploying sophisticated toolchains is only valuable if organisations can demonstrate meaningful business outcomes. The measurement challenge is substantial: unlike traditional IT projects with clear cost-benefit calculations, data quality initiatives produce diffuse benefits that are difficult to attribute. Research has highlighted organisational and managerial challenges in realising value from analytics, including cultural resistance, poor data quality, and the absence of clear goals.

Discovery Improvements

One of the most tangible benefits of improved data quality is enhanced data discovery. When data is complete, consistent, and well-documented, analysts can find relevant datasets more quickly and trust what they find. Organisations implementing data governance programmes have reported researchers locating relevant datasets 60 percent faster, with report errors reduced by 35 percent and exploratory analysis time cut by 45 percent.

Data discoverability metrics assess how easily users can find specific datasets within data platforms. Poor discoverability, such as a user struggling to locate sales data for a particular region, indicates underlying quality and metadata problems. Improvements in these metrics directly translate to productivity gains as analysts spend less time searching and more time analysing.

The measurement framework should track throughput (how quickly users find data) and quality (accuracy and completeness of search results). Time metrics focus on the speed of accessing data and deriving insights. Relevancy metrics evaluate whether data is fit for its intended purpose. Additional metrics include the number of data sources identified, the percentage of sensitive data classified, the frequency and accuracy of discovery scans, and the time taken to remediate privacy issues.

Analytics Fidelity

Poor data quality undermines the reliability of analytical outputs. When models are trained on incomplete or inconsistent data, their predictions become unreliable. When dashboards display metrics derived from flawed inputs, business decisions suffer. Gartner reports that only nine percent of organisations rate themselves at the highest analytics maturity level, with 87 percent demonstrating low business intelligence maturity.

Research from BARC found that more than 40 percent of companies do not trust the outputs of their AI and ML models, whilst more than 45 percent cite data quality as the top obstacle to AI success. These statistics highlight the direct connection between data quality and analytical value. Global spending on big data analytics is projected to reach $230.6 billion by 2025, with spending on analytics, AI, and big data platforms expected to surpass $300 billion by 2030. This investment amplifies the importance of ensuring that underlying data quality supports reliable outcomes.

Measuring analytics fidelity requires tracking model performance over time. Are prediction errors increasing? Are dashboard metrics drifting unexpectedly? Are analytical conclusions being contradicted by operational reality? These signals indicate data quality degradation that toolchains should detect and repair.

Data observability platforms provide executive-level dashboards presenting key metrics including incident frequency, mean time to resolution, platform adoption rates, and overall system uptime. These operational metrics enable continuous improvement by letting organisations track trends over time, spot degradation early, and measure the impact of improvements.

Return on Investment

The financial case for data quality investment is compelling but requires careful construction. Gartner research indicates poor data quality costs organisations an average of $12.9 to $15 million annually. IBM research published in Harvard Business Review estimated poor data quality cost the U.S. economy $3.1 trillion per year. McKinsey Global Institute found that poor-quality data leads to 20 percent decreases in productivity and 30 percent increases in costs. Additionally, 20 to 30 percent of enterprise revenue is lost due to data inefficiencies.

Against these costs, the returns from data quality toolchains can be substantial. Data observability implementations have demonstrated ROI percentages ranging from 25 to 87.5 percent. Cost savings for addressing issues such as duplicate new user orders and improving fraud detection can reach $100,000 per issue annually, with potential savings from enhancing analytics dashboard accuracy reaching $150,000 per year.

One organisation documented over $2.3 million in cost savings and productivity improvements directly attributable to their governance initiative within six months. Companies with mature data governance and quality programmes experience 45 percent lower data breach costs, according to IBM's Cost of a Data Breach Report, which found average breach costs reached $4.88 million in 2024.

The ROI calculation should incorporate several components. Direct savings from reduced error correction effort (data teams spend 50 percent of their time on remediation according to Ataccama research) represent the most visible benefit. Revenue protection from improved decision-making addresses the 15 to 25 percent revenue loss that MIT research associates with poor quality. Risk reduction from fewer compliance violations and security breaches provides insurance value. Opportunity realisation from enabled analytics and AI initiatives captures upside potential. Companies with data governance programmes report 15 to 20 percent higher operational efficiency according to McKinsey research.

A holistic ROI formula considers value created, impact of quality issues, and total investment. Data downtime, when data is unavailable or inaccurate, directly impacts initiative value. Including downtime in ROI calculations reveals hidden costs and encourages investment in quality improvement.

The Emerging Landscape

Several trends are reshaping how organisations approach content repair and quality measurement.

AI-Native Quality Tools: The integration of artificial intelligence into data quality platforms is accelerating. Unsupervised machine learning detects anomalies without manual configuration. Natural language interfaces allow business users to query data quality without technical expertise. Generative AI is beginning to suggest repair strategies and explain anomalies in business terms. The Stack Overflow 2024 Developer Survey shows 76 percent of developers using or planning to use AI tools in their workflows, including data engineering tasks.

According to Gartner, by 2028, 33 percent of enterprise applications will include agentic AI, up from less than 1 percent in 2024. This shift will transform data quality from a technical discipline into an embedded capability of data infrastructure.

Proactive Quality Engineering: Great Expectations represents an advanced approach to quality management, moving governance from reactive, post-error correction to proactive systems of assertions, continuous validation, and instant feedback. The practice of analytics engineering, as articulated by dbt Labs, believes data quality testing should be integrated throughout the transformation process, not bolted on at the end.

This philosophy is gaining traction. Data teams increasingly test raw data upon warehouse arrival, validate transformations as business logic is applied, and verify quality before production deployment. Quality becomes a continuous concern rather than a periodic audit.

Consolidated Platforms: The market is consolidating around integrated platforms. The announced merger between dbt Labs and Fivetran signals a trend toward end-to-end solutions that handle extraction, transformation, and quality assurance within unified environments. IBM has been recognised as a Leader in Gartner Magic Quadrants for Augmented Data Quality Solutions, Data Integration Tools, and Data and Analytics Governance Platforms for 17 consecutive years, reflecting the value of comprehensive capabilities.

Trust as Competitive Advantage: Consumer trust research shows 75 percent of consumers would not purchase from organisations they do not trust with their data, according to Cisco's 2024 Data Privacy Benchmark Study. This finding elevates data quality from an operational concern to a strategic imperative. Organisations that demonstrate data stewardship through quality and governance programmes build trust that translates to market advantage.

The Human Element

Despite technological sophistication, the human element remains central to effective data repair. Competitive advantage increasingly depends on data quality rather than raw computational power. Organisations with superior training data and more effective human feedback loops will build more capable AI systems than competitors relying solely on automated approaches.

The most successful implementations strategically allocate human involvement, using AI to handle routine cases whilst preserving human input for complex, ambiguous, or high-stakes situations. Uncertainty sampling allows automated systems to identify cases where they lack confidence, prioritising these for human review and focusing expert attention where it adds most value.

Building effective human review processes requires attention to workflow design, expertise cultivation, and feedback mechanisms. Reviewers need context about why records were flagged, access to source systems for investigation, and clear criteria for making repair decisions. Their corrections should feed back into automated systems, continuously improving algorithmic performance.

Strategic Implementation Guidance

The question of how to handle incomplete or malformed content has no universal answer. Heuristic imputation offers speed and simplicity but introduces systematic distortions. Machine learning inference provides contextual accuracy but requires computational resources and careful validation. Human review delivers reliability but cannot scale. The optimal strategy combines all three, matched to the risk profile and operational requirements of each data domain.

Measurement remains challenging but essential. Discovery improvements, analytics fidelity, and financial returns provide the metrics needed to justify investment and guide continuous improvement. Organisations that treat data quality as a strategic capability rather than a technical chore will increasingly outcompete those that do not. Higher-quality data reduces rework, improves decision-making, and protects investment by tying outcomes to reliable information.

The toolchains are maturing rapidly. From validation frameworks to observability platforms to AI-powered repair engines, enterprises now have access to sophisticated capabilities that were unavailable five years ago. The organisations that deploy these tools effectively, with clear strategies for matching repair methods to risk profiles and robust frameworks for measuring business impact, will extract maximum value from their data assets.

In a world where artificial intelligence is transforming every industry, data quality determines AI quality. The patterns and toolchains for detecting and repairing content are not merely operational necessities but strategic differentiators. Getting them right is no longer optional.

---

References and Sources

1. Gartner. “Data Quality: Why It Matters and How to Achieve It.” Gartner Research. https://www.gartner.com/en/data-analytics/topics/data-quality

2. MIT Sloan Management Review with Cork University Business School. Research on revenue loss from poor data quality.

3. Great Expectations. “Have Confidence in Your Data, No Matter What.” https://greatexpectations.io/

4. Monte Carlo. “Data + AI Observability Platform.” https://www.montecarlodata.com/

5. Atlan. “Automated Data Quality: Fix Bad Data & Get AI-Ready in 2025.” https://atlan.com/automated-data-quality/

6. Nature Communications Medicine. “The Impact of Imputation Quality on Machine Learning Classifiers for Datasets with Missing Values.” https://www.nature.com/articles/s43856-023-00356-z

7. BMC Medical Informatics and Decision Making. “Nearest Neighbor Imputation Algorithms: A Critical Evaluation.” https://link.springer.com/article/10.1186/s12911-016-0318-z

8. Oxford Academic Bioinformatics. “MissForest: Non-parametric Missing Value Imputation for Mixed-type Data.” https://academic.oup.com/bioinformatics/article/28/1/112/219101

9. BMC Medical Research Methodology. “Accuracy of Random-forest-based Imputation of Missing Data in the Presence of Non-normality, Non-linearity, and Interaction.” https://link.springer.com/article/10.1186/s12874-020-01080-1

10. PMC. “Multiple Imputation by Chained Equations: What Is It and How Does It Work?” https://pmc.ncbi.nlm.nih.gov/articles/PMC3074241/

11. Appen. “Human-in-the-Loop Improves AI Data Quality.” https://www.appen.com/blog/human-in-the-loop-approach-ai-data-quality

12. dbt Labs. “Deliver Trusted Data with dbt.” https://www.getdbt.com/

13. Integrate.io. “Data Quality Improvement Stats from ETL: 50+ Key Facts Every Data Leader Should Know in 2025.” https://www.integrate.io/blog/data-quality-improvement-stats-from-etl/

14. IBM. “IBM Named a Leader in the 2024 Gartner Magic Quadrant for Augmented Data Quality Solutions.” https://www.ibm.com/blog/announcement/gartner-magic-quadrant-data-quality/

15. Alation. “Data Quality Metrics: How to Measure Data Accurately.” https://www.alation.com/blog/data-quality-metrics/

16. Sifflet Data. “Considering the ROI of Data Observability Initiatives.” https://www.siffletdata.com/blog/considering-the-roi-of-data-observability-initiatives

17. Data Meaning. “The ROI of Data Governance: Measuring the Impact on Analytics.” https://datameaning.com/2025/04/07/the-roi-of-data-governance-measuring-the-impact-on-analytics/

18. BARC. “Observability for AI Innovation Study.” Research on AI/ML model trust and data quality obstacles.

19. Cisco. “2024 Data Privacy Benchmark Study.” Research on consumer trust and data handling.

20. IBM. “Cost of a Data Breach Report 2024.” Research on breach costs and governance programme impact.

21. AWS. “Real-time Stream Processing Using Apache Spark Streaming and Apache Kafka on AWS.” https://aws.amazon.com/blogs/big-data/real-time-stream-processing-using-apache-spark-streaming-and-apache-kafka-on-aws/

22. Journal of Applied Statistics. “A Novel Ranked K-nearest Neighbors Algorithm for Missing Data Imputation.” https://www.tandfonline.com/doi/full/10.1080/02664763.2024.2414357

23. Contrary Research. “Monte Carlo Company Profile.” https://research.contrary.com/company/monte-carlo

24. PMC. “A Survey of Data Quality Measurement and Monitoring Tools.” https://pmc.ncbi.nlm.nih.gov/articles/PMC9009315/

25. ResearchGate. “High-Quality Automated Program Repair.” Research on trust perceptions in automated vs human code repair.

26. Stack Overflow. “2024 Developer Survey.” Research on AI tool adoption in development workflows.

    ---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

Somewhere in a data centre, a pipeline is failing. Not with a dramatic explosion or a cascade of red alerts, but with the quiet malevolence of a null value slipping through validation checks, corrupting records, and propagating errors downstream before anyone notices. By the time engineers trace the problem back to its source, hours have passed, dashboards have gone dark, and business decisions have been made on fundamentally broken data.

This scenario plays out thousands of times daily across enterprises worldwide. According to Gartner research, poor data quality costs organisations an average of $12.9 million to $15 million annually, with 20 to 30 per cent of enterprise revenue lost due to data inefficiencies. The culprit behind many of these failures is deceptively simple: malformed JSON, unexpected null values, and schema drift that silently breaks the assumptions upon which entire systems depend.

Yet the tools and patterns to prevent these catastrophes exist. They have existed for years. The question is not whether organisations can protect their content ingestion pipelines from null and malformed JSON, but whether they will adopt the defensive programming patterns, open-source validation libraries, and observability practices that can reduce downstream incidents by orders of magnitude.

The economic stakes are staggering. Production defects cost enterprises $1.7 trillion globally each year, with individual critical bugs averaging $5.6 million in business impact. Schema drift incidents alone carry an estimated average cost of $35,000 per incident. For data-intensive organisations, these are not abstract figures but line items that directly impact profitability and competitive position.

The Anatomy of Pipeline Failure

Content ingestion pipelines are the circulatory system of modern data infrastructure. They consume data from APIs, message queues, file uploads, and third-party integrations, transforming and routing information to databases, analytics systems, and downstream applications. When they work, they are invisible. When they fail, the consequences ripple outward in ways that can take weeks to fully understand.

The fundamental challenge is that JSON, despite its ubiquity as a data interchange format, provides no guarantees about structure. A field that contained a string yesterday might contain null today. An array that once held objects might arrive empty. A required field might simply vanish when an upstream team refactors their API without updating downstream consumers. The lightweight flexibility that made JSON popular is precisely what makes it dangerous in production systems that depend on consistent structure.

Schema drift, as this phenomenon is known, occurs when changes to a data model in one system are not synchronised across connected systems. According to industry analysis, the average cost per schema drift incident is estimated at $35,000, with undetected drift sometimes requiring complete system remapping that costs millions. One analysis suggests schema drift silently breaks enterprise data architecture at a cost of up to $2.1 million annually in broken processes, failed initiatives, and compliance risk.

The problem compounds because JSON parsing failures often do not fail loudly. A missing field might be coerced to null, which then propagates through transformations, appearing as zeros in financial calculations or blank entries in customer records. By the time the corrupted data surfaces in a quarterly report or customer complaint, the original cause is buried under layers of subsequent processing.

The hidden operational costs accumulate gradually. Most data pipeline issues do not manifest as major failures. They build slowly through missed updates, manual report fixes, and dashboards that run behind schedule. Engineers stay busy keeping things stable rather than making improvements, and decisions that should be simple start taking longer than necessary.

Defensive Programming and Null Value Handling

The first line of defence against malformed JSON is a philosophy that treats every piece of incoming data as potentially hostile. Defensive programming assumes that any piece of functionality can only be used explicitly for its intended purpose and that every input might be a malicious attempt to break the system.

In practical terms, defensive programming means expecting the worst possible outcome with every user input. Rather than trusting that upstream systems will always send well-formed data, defensive pipelines validate everything at the point of ingestion. This approach is easier to implement than it might seem, because lifting overly strict validation rules is simpler than compensating for corrupted data by adding rules after the fact.

The MITRE organisation lists null pointer dereference as one of the most commonly exploited software weaknesses. When code attempts to access a property on a null value, the result ranges from silent corruption to complete system crashes. Errors such as buffer overflows, null pointer dereferences, and memory leaks can lead to catastrophic failures, making defensive programming essential for mitigating these risks through strict checks and balances.

Key strategies for handling null values defensively include validating all inputs before processing, avoiding returning null from methods when possible, returning empty collections or default objects rather than null, and using static analysis tools to detect potential null pointer issues before deployment. Static analysis tools such as Splint detect null pointer dereferences by analysing pointers at procedure interface boundaries, enabling teams to catch problems before code reaches production.

The trade-off of defensive programming is worth considering. While users no longer see the programme crash, neither does the test or quality assurance department. The programme might now silently fail despite programming errors in the caller. This is why defensive programming must be paired with observability: catching problems silently is only useful if those problems are logged and monitored effectively.

JSON Schema as a Validation Standard

JSON Schema has emerged as the primary standard for defining the structure and constraints of JSON documents. By specifying the expected data types, formats, and constraints that data should adhere to, schemas make it possible to catch errors early in the processing pipeline, ensuring that only valid data reaches downstream systems.

The current stable version, draft 2020-12, introduced significant improvements including redesigned array and tuple keywords, dynamic references, and better handling of unevaluated properties. The items and additionalItems keywords were replaced by prefixItems and items, providing cleaner semantics for array validation. The format vocabulary was divided into format-annotation and format-assertion, providing clearer semantics for format validation.

JSON Schema validation reportedly prevents 60 per cent of API integration failures and ensures data consistency across distributed systems. When schemas are enforced at ingestion boundaries, invalid data is rejected immediately rather than allowed to propagate. This fail-fast approach transforms debugging from an archaeological expedition through logs and databases into a simple matter of reading validation error messages.

The specification handles null values explicitly. When a schema specifies a type of null, it has only one acceptable value: null itself. Importantly, null in JSON is not equivalent to something being absent, a distinction that catches many developers off guard. To handle nullable fields, schemas define types as arrays that include both the expected type and null.

Community discussions emphasise that schema validation errors affect user experience profoundly, requiring clear and actionable error messages rather than technical implementation details. The goal is not merely to reject invalid data but to communicate why data was rejected in terms that enable rapid correction.

Validation Libraries for Production Systems

Implementing JSON Schema validation requires libraries that can parse schemas and apply them to incoming data. Several open-source options have emerged as industry standards, each with different strengths for different use cases.

Ajv (Another JSON Validator) has become the dominant choice in the JavaScript and Node.js ecosystem. According to benchmarks, Ajv is currently the fastest JSON schema validator available, running 50 per cent faster than the second-place option and 20 to 190 per cent faster in the jsck benchmark. The library generates code that turns JSON schemas into optimised validation functions, achieving performance that makes runtime validation practical even for high-throughput pipelines.

The library's production credentials are substantial. ESLint, the JavaScript linting tool used by millions of developers, relies on Ajv for validating its complex configuration files. The ESLint team has noted that Ajv has proven reliable over years of use, donating $100 monthly to support the project's continued development. Ajv has also been used in production to validate requests for a federated undiagnosed genetic disease programme that has led to new scientific discoveries.

Beyond raw speed, Ajv provides security guarantees that matter for production deployments. Version 7 was rebuilt with secure code generation as a primary objective, providing type-level guarantees against remote code execution even when processing untrusted schemas. The best performance is achieved when using compiled functions returned by the compile or getSchema methods, with applications compiling schemas only once and reusing compiled validation functions throughout their lifecycle.

For TypeScript applications, Zod has gained significant traction as a schema validation library that bridges compile-time type safety and runtime validation. TypeScript only exists during coding; the moment code compiles to JavaScript, type checks vanish, leaving applications vulnerable to external APIs, user inputs, and unexpected null values. Zod addresses this gap by allowing developers to declare a validator once while automatically inferring the corresponding TypeScript type.

The goal of Zod is to eliminate duplicative type declarations. Developers declare a validator once and Zod automatically infers the static TypeScript type, making it easy to compose simpler types into complex data structures. When validation fails, the parse method throws a ZodError instance with granular information about validation issues.

For binary serialisation in streaming data pipelines, Apache Avro and Protocol Buffers provide schema-based validation with additional benefits. Avro's handling of schema evolution is particularly sophisticated. The Avro parser can accept two different schemas, using resolution rules to translate data from the writer schema into the reader schema. This capability is extremely valuable in production systems because it allows different components to be updated independently without worrying about compatibility.

Protocol Buffers use .proto files where each field receives a unique numeric tag as its identifier. Fields can be added, deprecated, or removed, but never reused. This approach is particularly well-suited to microservices architectures where performance and interoperability are paramount.

Centralised Schema Management with Registries

As systems grow more complex, managing schemas across dozens of services becomes its own challenge. Schema registries provide centralised repositories for storing, versioning, and validating schemas, ensuring that producers and consumers agree on data formats before messages are exchanged.

Confluent Schema Registry has become the standard for Apache Kafka deployments. The registry provides a RESTful interface for storing and retrieving Avro, JSON Schema, and Protobuf schemas, maintaining a versioned history based on configurable subject name strategies. It enforces compatibility rules that prevent breaking changes and enables governance workflows where teams negotiate schema changes safely.

The architecture is designed for production resilience. Schema Registry uses Kafka itself as a commit log to store all registered schemas durably, maintaining in-memory indices for fast lookups. A single registry instance can handle approximately 10,000 unique schemas, covering most enterprise deployments. The registry has no disk-resident data; the only disk usage comes from storing log files.

For larger organisations, multi-datacenter deployments synchronise data across sites, protect against data loss, and reduce latency. Schema Registry is designed to work as a distributed service using single primary architecture, where at most one instance is the primary at any moment. Durability configurations should set min.insync.replicas on the schemas topic higher than one, ensuring schema registration is durable across multiple replicas.

Alternative options include AWS Glue Schema Registry for organisations invested in the AWS ecosystem and Karapace as an open-source alternative to Confluent's offering. Regardless of the specific tool, the pattern remains consistent: centralise schema management to prevent drift and enforce compatibility.

Contract Testing for Microservices Integration

While schema validation catches structural problems with individual messages, contract testing addresses a different challenge: ensuring that services can actually communicate with each other successfully. In microservices architectures where different teams manage different services, assumptions about API behaviour can diverge in subtle ways that schema validation alone cannot detect.

Pact has emerged as the leading open-source framework for consumer-driven contract testing. Unlike schemas or specifications that describe all possible states of a resource, a Pact contract is enforced by executing test cases that describe concrete request and response pairs. This approach is effectively contract by example, validating actual integration behaviour rather than theoretical structure.

The consumer-driven aspect of Pact places the consumers of services at the centre of the design process. Consumers define their expectations for provider APIs, and these expectations are captured as contracts that providers must satisfy. This inversion ensures that APIs actually meet the needs of their callers rather than making assumptions about how consumers will use them.

Contract testing bridges gaps among different testing methodologies. It is a technique for testing integration points by isolating each microservice and checking whether the HTTP requests and responses conform to a shared understanding documented in a contract. Pact enables identification of mismatches between consumer and provider early in the development process, reducing the likelihood of integration failures during later stages.

The Pact Broker provides infrastructure for sharing contracts and verification results across teams. By integrating with CI/CD pipelines, the broker enables automated detection of breaking changes before they reach production. Teams can rapidly increase test coverage across system integration points by reusing existing tests on both sides of an integration.

For Pact to work effectively, both consumer and provider teams must agree on adopting the contract testing approach. When one side does not commit to the process, the framework loses its value. While Pact excels at testing HTTP-based services, support for other protocols like gRPC or Kafka requires additional plugins.

The return on investment for contract testing can be substantial. Analysis suggests that implementing contract testing delivers positive returns, with cumulative savings exceeding cumulative investments by the end of the second year. A conservative estimate places complete recovery of initial investment within three to four years for a single team, with benefits amplifying as more teams adopt the practice.

Observability for Data Pipeline Health

Validation and contract testing provide preventive controls, but production systems also require visibility into what is actually happening. Observability enables teams to detect and diagnose problems that slip past preventive measures.

OpenTelemetry has become the primary open-source standard for collecting and processing telemetry data. The OpenTelemetry Collector acts as a neutral intermediary for collecting, processing, and forwarding traces, metrics, and logs to observability backends. This architecture simplifies observability setups by eliminating the need for multiple agents for different telemetry types, consolidating everything into a unified collection point.

For data pipelines specifically, observability must extend beyond traditional application monitoring. Data quality issues often manifest as subtle anomalies rather than outright failures. A pipeline might continue running successfully while producing incorrect results because an upstream schema change caused fields to be misinterpreted. Without observability into data characteristics, these problems remain invisible until their effects surface in business processes.

OpenTelemetry Weaver, introduced in 2025, addresses schema validation challenges by providing design-time validation that can run as part of CI/CD pipelines. The tool enables schema definition through semantic conventions, validation of telemetry against defined schemas, and type-safe code generation for client SDKs. By catching observability issues in CI/CD rather than production, Weaver shifts the detection of problems earlier in the development lifecycle.

The impact of observability on incident response is well-documented. According to research from New Relic, organisations with mature observability practices experience 34 per cent less downtime annually compared to those without. Those achieving full-stack observability are 18 per cent more likely to resolve high-business-impact outages in 30 minutes or less. Organisations with five or more observability capabilities deployed are 42 per cent more likely to achieve this rapid resolution.

Observability adoption materially improves mean time to recovery. In North America, 67 per cent of organisations reported 50 per cent or greater improvement in mean time to recovery after adopting observability practices. Integrating real-time monitoring tools with alerting systems can reduce incident response times by an average of 30 per cent.

For data engineering specifically, the statistics are sobering. Data teams reported an average of 67 incidents per month in 2023, up from 59 in 2022, signalling growing data-source sprawl and schema volatility. Mean time to resolve climbed to 15 hours, a 166 per cent year-over-year increase. Without observability tooling, 68 per cent of teams need four or more hours just to detect issues.

Shift-Left Testing for Early Defect Detection

The economics of defect detection are brutally clear: the earlier a problem is found, the cheaper it is to fix. This principle, known as shift-left testing, advocates for moving testing activities earlier in the development lifecycle rather than treating testing as a phase that occurs after development is complete.

Shift-left testing is a proactive approach that involves performing testing activities earlier in the software development lifecycle. Unlike traditional testing, the shift-left approach starts testing from the very beginning, during requirements gathering, design, or even planning stages. This helps identify defects, ambiguities, or performance bottlenecks early, when they are cheaper and easier to fix.

In data engineering, shift-left testing means moving data quality checks earlier in the pipeline. Instead of focusing monitoring efforts at the data warehouse stage, shift-left testing ensures that issues are detected as soon as data enters the pipeline. A shift-left approach catches problems like schema changes, data anomalies, and inconsistencies before they propagate, preventing costly fixes and bad business decisions.

Key data pipeline monitors include data diff tools that detect unexpected changes in output, schema change detection that alerts on structural modifications, metrics monitoring that tracks data quality indicators over time, and data tests that validate business rules and constraints. Real-time anomaly detection is absolutely critical. By setting up real-time alerts for issues like data freshness or schema changes, data teams can respond to problems as they arise.

Automated testing within CI/CD pipelines forms the foundation of shift-left practices. Running unit, integration, and smoke tests automatically on every commit catches problems before they merge into main branches. Having developers run one automated test locally before any commit catches roughly 40 per cent more issues upfront than traditional approaches.

The benefits of shift-left testing are measurable. A strategic approach can deliver 50 per cent faster releases and 40 per cent fewer production escapes, directly impacting revenue and reducing downtime costs. Enterprises that transition from manual to automated API testing approaches reduce their critical defect escape rate by an average of 85 per cent within the first 12 months.

Economic Returns from Schema-First Development

The business case for schema-first ingestion and automated contract validation extends beyond preventing incidents. By establishing clear contracts between systems, organisations reduce coordination costs, accelerate development, and enable teams to work independently without fear of breaking integrations.

The direct financial impact of data quality issues is substantial. Production defects cost enterprises $1.7 trillion globally each year, with individual critical bugs averaging $5.6 million in business impact. Nearly 60 per cent of organisations do not measure the annual financial cost of poor quality data. Failing to measure this impact results in reactive responses to data quality issues, missed business growth opportunities, increased risks, and lower return on investment.

Beyond direct costs, poor data quality undermines digital initiatives, weakens competitive standing, and erodes customer trust. The hidden costs accumulate through missed business growth opportunities, increased risks, and lower return on investment across data initiatives. In addition to immediate negative effects on revenue, the long-term effects of poor quality data increase the complexity of data ecosystems and lead to poor decision making.

The return on investment for implementing proper validation and testing can be dramatic. One financial institution achieved a 200 per cent return on investment within the first 12 months of implementing automated contract testing, preventing over 2,500 bugs from entering production while lowering testing cost and effort by 75 per cent and 85 per cent respectively. Another Fortune 500 organisation achieved a 10-fold increase in test case coverage with a 40 per cent increase in test execution speed.

Time and resources saved through implementing proper validation can be redirected toward innovation and development of new features. Contract testing facilitates clearer interactions between components, significantly reducing dependencies and potential blocking situations between teams. Teams who have implemented contract testing experience benefits such as the ability to test single integrations at a time, no need to create and manage dedicated test environments, and fast, reliable feedback on developer machines.

Building Layered Defence in Depth

Implementing effective protection against null and malformed JSON requires a layered approach that combines multiple techniques. No single tool or pattern provides complete protection; instead, organisations must build defence in depth.

At the ingestion boundary, JSON Schema validation should reject malformed data immediately. Schemas should be strict enough to catch problems but loose enough to accommodate legitimate variation. Defining nullable fields explicitly rather than allowing any field to be null prevents accidental acceptance of missing data. Validation errors should produce clear, actionable messages that enable rapid diagnosis and correction by upstream systems.

For inter-service communication, contract testing ensures that services agree on API behaviour beyond just data structure. Consumer-driven contracts place the focus on actual usage rather than theoretical capabilities. Integration with CI/CD pipelines catches breaking changes before deployment.

Schema registries provide governance for evolving data formats. Compatibility rules prevent breaking changes from being registered. Versioning enables gradual migration between schema versions. Centralised management prevents drift across distributed systems.

Observability provides visibility into production behaviour. OpenTelemetry provides vendor-neutral telemetry collection. Data quality metrics track validation failures, null rates, and schema violations. Alerting notifies teams when anomalies occur. Distributed tracing enables rapid root cause analysis.

Schema evolution in streaming data pipelines is not a nice-to-have but a non-negotiable requirement for production-grade real-time systems. By combining schema registries, compatible schema design, and resilient processing logic, teams can build pipelines that evolve alongside the business.

Organisational Culture and Data Ownership

Tools and patterns are necessary but not sufficient. Successful adoption of schema-first development requires cultural changes that treat data interfaces with the same rigour as application interfaces.

Treating data interfaces like APIs means formalising them with data contracts. Schema definitions using Avro, Protobuf, or JSON Schema validate incoming data at the point of ingestion. Automatic validation checks run within streaming pipelines or ingestion gateways. Breaking changes trigger build failures or alerts rather than silently propagating.

One of the most common causes of broken pipelines is schema drift, when upstream producers change the shape of data without warning, breaking downstream consumers. The fix is to treat data interfaces like APIs and formalise them with data contracts. A data contract defines the expected structure, types, and semantics of ingested data.

Teams must own the quality of data they produce, not just the functionality of their services. This ownership means understanding downstream consumers, communicating schema changes proactively, and treating breaking changes with the same gravity as breaking API changes.

Organisations conducting post-incident reviews see a 20 per cent reduction in repeat incidents. Those adopting blameless post-incident reviews see a 40 per cent reduction. Learning from failures and improving processes requires psychological safety that encourages disclosure of problems rather than concealment.

Implementing distributed tracing can lead to a 25 per cent decrease in troubleshooting time, particularly in complex architectures. Research indicates that 65 per cent of organisations find centralised logging improves incident recovery times. These capabilities require cultural investment beyond merely deploying tools.

Investing in Data Quality Infrastructure

The challenges of null and malformed JSON in content ingestion pipelines are not going away. As data volumes grow and systems become more interconnected, the potential for schema drift and data quality issues only increases. Data teams already report an average of 67 incidents per month, up from 59 the previous year.

The good news is that the tools and patterns for addressing these challenges have matured significantly. JSON Schema draft 2020-12 provides comprehensive vocabulary for structural validation. Ajv delivers validation performance that enables runtime checking even in high-throughput systems. Pact offers battle-tested contract testing for HTTP-based services. OpenTelemetry provides vendor-neutral observability. Schema registries enable centralised governance.

The organisations that thrive will be those that adopt these practices comprehensively rather than reactively. Schema-first development is not merely a technical practice but an organisational capability that reduces coordination costs, accelerates development, and prevents the cascade failures that turn minor data issues into major business problems.

The pipeline that fails silently today, corrupting data before anyone notices, represents an avoidable cost. The question is not whether organisations can afford to implement proper validation and observability. Given the documented costs of poor data quality, the question is whether they can afford not to.

---

References and Sources

1. Gartner. “Data Quality: Why It Matters and How to Achieve It.” Gartner Research. https://www.gartner.com/en/data-analytics/topics/data-quality

2. JSON Schema Organisation. “JSON Schema Validation: A Vocabulary for Structural Validation of JSON.” Draft 2020-12. https://json-schema.org/draft/2020-12/json-schema-validation

3. Ajv JSON Schema Validator. Official Documentation. https://ajv.js.org/

4. ESLint. “Supporting ESLint's Dependencies.” ESLint Blog, September 2020. https://eslint.org/blog/2020/09/supporting-eslint-dependencies/

5. GitHub. “json-schema-benchmark: Benchmarks for Node.js JSON-schema validators.” https://github.com/ebdrup/json-schema-benchmark

6. Pact Documentation. “Writing Consumer Tests.” https://docs.pact.io/consumer

7. OpenTelemetry. “Observability by Design: Unlocking Consistency with OpenTelemetry Weaver.” https://opentelemetry.io/blog/2025/otel-weaver/

8. Confluent. “Schema Registry for Confluent Platform.” Confluent Documentation. https://docs.confluent.io/platform/current/schema-registry/index.html

9. New Relic. “Service-Level Metric Benchmarks.” Observability Forecast 2023. https://newrelic.com/resources/report/observability-forecast/2023/state-of-observability/service-level-metrics

10. Zod. “TypeScript-first schema validation with static type inference.” https://zod.dev/

11. GitHub. “colinhacks/zod: TypeScript-first schema validation with static type inference.” https://github.com/colinhacks/zod

12. Integrate.io. “What is Schema-Drift Incident Count for ETL Data Pipelines.” https://www.integrate.io/blog/what-is-schema-drift-incident-count/

13. Syncari. “The $2.1M Schema Drift Problem.” https://syncari.com/blog/the-2-1m-schema-drift-problem-why-enterprise-leaders-cant-ignore-this-hidden-data-destroyer/

14. Contentful. “Defensive Design and Content Model Validation.” https://www.contentful.com/blog/defensive-design-and-content-model-validation/

15. DataHen. “Ensuring Data Quality with JSON Schema Validation in Data Processing Pipelines.” https://www.datahen.com/blog/ensuring-data-quality-with-json-schema-validation-in-data-processing-pipelines/

16. Shaped. “10 Best Practices in Data Ingestion: A Scalable Framework for Real-Time, Reliable Pipelines.” https://www.shaped.ai/blog/10-best-practices-in-data-ingestion

17. Sngular. “Understanding the ROI for Contract Testing.” https://www.sngular.com/insights/299/understanding-the-roi-for-contract-testing

18. Datafold. “Data Pipeline Monitoring: Implementing Proactive Data Quality Testing.” https://www.datafold.com/blog/what-is-data-pipeline-monitoring

19. Kleppmann, Martin. “Schema evolution in Avro, Protocol Buffers and Thrift.” December 2012. https://martin.kleppmann.com/2012/12/05/schema-evolution-in-avro-protocol-buffers-thrift.html

20. Datadog. “Best Practices for Shift-Left Testing.” https://www.datadoghq.com/blog/shift-left-testing-best-practices/

21. Datadog. “Use OpenTelemetry with Observability Pipelines.” https://www.datadoghq.com/blog/observability-pipelines-otel-cost-control/

22. Parasoft. “API ROI: Maximize the ROI of API Testing.” https://www.parasoft.com/blog/maximize-the-roi-of-automated-api-testing-solutions/

23. Pactflow. “What is Contract Testing & How is it Used?” https://pactflow.io/blog/what-is-contract-testing/

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...

The numbers are staggering and increasingly meaningless. In the first half of 2025, TikTok's automated moderation systems achieved a 99.2 per cent accuracy rate, removing over 87 per cent of violating content before any human ever saw it. Meta's Q4 2024 transparency report showed content restrictions based on local law dropping from 84.6 million in the second half of 2024 to 35 million in the first half of 2025. YouTube processed 16.8 million content actions in the first half of 2024 alone. X reported suspending over 5.3 million accounts and removing 10.6 million posts in six months.

These figures appear in transparency dashboards across every major platform, presented with the precision of scientific measurement. Yet beneath this veneer of accountability lies a fundamental paradox: the more data platforms publish, the less we seem to understand about how content moderation actually works, who it serves, and whether it protects or harms the billions of users who depend on these systems daily.

The gap between transparency theatre and genuine accountability has never been wider. As the European Union's Digital Services Act forces platforms into unprecedented disclosure requirements, and as users increasingly demand meaningful recourse when their content is removed, platforms find themselves navigating impossible terrain. They must reveal enough to satisfy regulators without exposing systems to gaming. They must process millions of appeals whilst maintaining the fiction that humans review each one. They must publish KPIs that demonstrate progress without admitting how often their systems get it catastrophically wrong.

This is the glass house problem: transparency that lets everyone see in whilst obscuring what actually matters.

When Europe Built a Database and Discovered Its Limits

When the European Union launched the DSA Transparency Database in February 2024, it represented the most ambitious attempt in history to peer inside the black boxes of content moderation. Every online platform operating in the EU, with exceptions for micro and small enterprises, was required to submit detailed statements of reasons for every content moderation decision. The database would track these decisions in near real time, offering researchers, regulators, and the public unprecedented visibility into how platforms enforce their rules.

By January 2025, 116 online platforms had registered, submitting a staggering 9.4 billion statements of reasons in just six months. The majority came from Google, Facebook, and TikTok. The sheer volume suggested success: finally, platforms were being forced to account for their decisions at scale. The database allowed tracking of content moderation decisions in almost real time, offering tools for accessing, analysing, and downloading the information that platforms must make available.

But researchers who analysed this data found something troubling. A 2024 study by researchers from the Netherlands discovered that the database allowed platforms to remain opaque on the grounds behind content moderation decisions, particularly for decisions based on terms of service infringements. A 2025 study from Italian researchers found inconsistencies between the DSA Transparency Database and the separate transparency reports that Very Large Online Platforms published independently. The two sources of truth contradicted each other, raising fundamental questions about data reliability.

X stood out as particularly problematic. Unlike all other platforms where low moderation delays were consistently linked to high reliance on automation, X continued to report near instantaneous moderation actions whilst claiming to rely exclusively on manual detection. The platform's H2 2024 transparency report revealed 181 million user reports filed from July to December 2024, with 1,275 people working in content moderation globally. Spam and platform manipulation would add an additional 335 million total actions to those figures. The mathematics of manual review at that scale strain credibility.

The database revealed what happens when transparency becomes a compliance exercise rather than a genuine commitment to accountability. Platforms could technically fulfil their obligations whilst structuring their submissions to minimise meaningful scrutiny. They could flood the system with data whilst revealing little about why specific decisions were made.

The European Commission recognised these deficiencies. In November 2024, it adopted an implementing regulation laying down standardised templates for transparency reports. Starting from 1 July 2025, platforms would collect data according to these new specifications, with the first harmonised reports due in early 2026. But standardisation addresses only one dimension of the problem. Even perfectly formatted data means little if platforms can still choose what to measure and how to present it. Critics have described current transparency practices as transparency theatre.

Measuring Success When Everyone Defines It Differently

Walk through any platform's transparency report and you will encounter an alphabet soup of metrics: VVR (Violative View Rate), prevalence rates, content actioned, appeals received, appeals upheld. These Key Performance Indicators have become the lingua franca of content moderation accountability, the numbers regulators cite, journalists report, and researchers analyse.

But which KPIs actually matter? And who gets to decide?

Meta's Community Standards Enforcement Report tracks prevalence, the percentage of content that violates policies, across multiple harm categories. In Q4 2024, the company reported that prevalence remained consistent across violation types, with decreases on Facebook and Instagram for Adult Nudity and Sexual Activity due to adjustments to proactive detection technology. This sounds reassuring until you consider what it obscures: how many legitimate posts were incorrectly removed, how many marginalised users were disproportionately affected. The report noted that content actioned on Instagram for Restricted Goods and Services decreased as a result of changes made due to over enforcement and mistakes, an acknowledgment that the company's own systems were removing too much legitimate content.

Following policy changes announced in January 2025, Meta reported cutting enforcement mistakes in the United States by half, whilst the low prevalence of violating content remained largely unchanged for most problem areas. This suggests that the company had previously been making significant numbers of erroneous enforcement decisions, a reality that earlier transparency reports did not adequately disclose.

TikTok publishes accuracy rates for its automated moderation technologies, claiming 99.2 per cent accuracy in the first half of 2025. This builds upon the high accuracy they achieved in the first half of 2024, even as moderation volumes increased. But accuracy is a slippery concept. A system can be highly accurate in aggregate whilst systematically failing specific communities, languages, or content types. Research has consistently shown that automated moderation systems perform unevenly across protected groups, misclassifying hate directed at some demographics more often than others. There will always be too many false positives and too many false negatives, with both disproportionately falling on already marginalised groups.

YouTube's transparency report tracks the Violative View Rate, the percentage of views on content that later gets removed. In June 2025, YouTube noted a slight increase due to strengthened policies related to online gambling content. This metric tells us how much harmful content viewers encountered before it was removed but nothing about the content wrongly removed that viewers never got to see.

The DSA attempted to address these gaps by requiring platforms to report on the accuracy and rate of error of their automated systems. Article 15 specifically mandates annual reporting on automated methods, detailing their purposes, accuracy, error rates, and applied safeguards. But how platforms calculate these metrics remains largely at their discretion. Reddit reported that approximately 72 per cent of content removed from January to June 2024 was removed by automated systems. Meta reported that automated systems removed 90 per cent of violent and graphic content, 86 per cent of bullying and harassment, and only 4 per cent of child nudity and physical abuse on Instagram in the EU between April and September 2024.

Researchers have proposed standardising disclosure practices in four key areas: distinguishing between ex ante and ex post identification of violations, disclosing decision making processes, differentiating between passive and active engagement with problematic content, and providing information on the efficacy of user awareness tools. Establishing common KPIs would allow meaningful evaluation of platforms' performance over time.

The operational KPIs that content moderation practitioners actually use tell a different story. Industry benchmarks suggest flagged content response should be optimised to under five minutes, moderation accuracy maintained at 95 per cent to lower false positive and negative rates. Customer centric metrics include client satisfaction scores consistently above 85 per cent and user complaint resolution time under 30 minutes. These operational metrics reveal the fundamental tension: platforms optimise for speed and cost efficiency whilst regulators demand accuracy and fairness.

The Appeals System That Cannot Keep Pace

When Meta's Oversight Board published its 2024 annual report, it revealed a fundamental truth about content moderation appeals: the system is overwhelmed. The Board received 558,235 user generated appeals to restore content in 2024, a 33 per cent increase from the previous year. Yet the Board's capacity is limited to 15 to 30 cases annually. For every case the Board reviews, roughly 20,000 go unexamined. When the doors opened for appeals in October 2020, the Board received 20,000 cases, prioritising those with potential to affect many users worldwide.

This bottleneck exists at every level. Meta reported receiving more than 7 million appeals in February 2024 alone from users whose content had been removed under Hateful Conduct rules. Of those appealing, 80 per cent chose to provide additional context, a pathway the Oversight Board recommended to help content reviewers understand when policy exceptions might apply. The recommendation led to the creation of a new pathway for users to provide additional context in appeal submissions.

YouTube tells users that appeals are manually reviewed by human staff. Its official account stated in November 2025 that appeals are manually reviewed so it can take time to get a response. Yet creators who analysed their communication metadata discovered responses were coming from Sprinklr, an AI powered automated customer service platform. The responses arrived within minutes, far faster than human review would require. YouTube's own data revealed that the vast majority of termination decisions were upheld.

This gap between stated policy and operational reality is existential. If appeals are automated, then the safety net does not exist. The system becomes a closed loop where automated decisions are reviewed by automated processes, with no human intervention to recognise context or error. Research on appeal mechanisms has found that when users' accounts are penalised, they often are not served a clear notice of violation. Appeals are frequently time-consuming, glitching, and ineffective.

The DSA attempted to address this by mandating multiple levels of recourse. Article 21 established out of court dispute settlement bodies, third party organisations certified by national regulators to resolve content moderation disputes. These bodies can review platform decisions about content takedowns, demonetisation, account suspensions, and even decisions to leave flagged content online. Users may select any certified body in the EU for their dispute type, with settlement usually available free of charge. If the body settles in favour of the user, the platform bears all fees.

By mid 2024, the first such bodies were certified. Appeals Centre Europe, established with a grant from the Oversight Board Trust, revealed something striking in its first transparency report: out of 1,500 disputes it ruled on, over three quarters of platform decisions were overturned either because they were wrong or because the platform failed to provide necessary content for review.

TikTok's data tells a similar story. During the second half of 2024, the platform received 173 appeals against content moderation decisions under Article 21 in the EU. Of 59 cases closed by dispute settlement bodies, 17 saw the body disagree with TikTok's decision, 13 confirmed TikTok was correct, and 29 were resolved without a formal decision. Platforms were getting it wrong roughly as often as they were getting it right.

The Oversight Board's track record is even more damning. Of the more than 100 decisions the Board has issued, 80 per cent overturned Meta's original ruling. The percentage of overturned decisions has been increasing. Since January 2021, the Board has made more than 300 recommendations to Meta, with implementation or progress on 74 per cent resulting in greater transparency and improved fairness for users.

When Privacy and Transparency Pull in Opposite Directions

Every content moderation decision involves personal data: the content itself, the identity of the creator, the context in which it was shared, the metadata revealing when and where it was posted. Publishing detailed information about moderation decisions, as transparency requires, necessarily involves processing this data in ways that raise profound privacy concerns.

The UK Information Commissioner's Office recognised this tension when it published guidance on content moderation and data protection in February 2024, complementing the Online Safety Act. The ICO emphasised that organisations carrying out content moderation involving personal information must comply with data protection law. They must design moderation systems with fairness in mind, ensuring unbiased and consistent outputs. They must inform users upfront about any content identification technology used.

But the DSA's transparency requirements and GDPR's data protection principles exist in tension. Platforms must describe their content moderation practices, including any algorithmic decision making, in their terms of use. They must also describe data processing undertaken to detect illegal content in their privacy notices. The overlap creates compliance complexity and strategic ambiguity. Although rules concerning provision of information about digital services can be found in EU consumer and data protection laws, the DSA further expands the information provision list.

Research examining how platforms use GDPR transparency rights highlighted deliberate attempts by online service providers to curtail the scope and meaning of access rights. Platforms have become adept at satisfying the letter of transparency requirements whilst frustrating their spirit. Content moderation processes frequently involve third party moderation services or automated tools, raising concerns about unauthorised access and processing of user data.

The privacy constraints cut both ways. Platforms cannot publish detailed information about specific moderation decisions without potentially exposing user data. But aggregated statistics obscure precisely the granular details that would reveal whether moderation is fair. The result is transparency that protects user privacy whilst also protecting platforms from meaningful scrutiny.

Crafting Explanations Users Can Actually Understand

When users receive a notification that their content has been removed, what they get typically ranges from unhelpful to incomprehensible. A generic message citing community guidelines, perhaps with a link to the full policy document. No specific explanation of what triggered the violation. No guidance on how to avoid similar problems in future. No meaningful pathway to contest the decision.

Research has consistently shown that transparency matters enormously to people who experience moderation. Studies involving content creators identified four primary dimensions users desire: the system should present moderation decisions saliently, explain decisions profoundly, afford communication effectively, and offer repair and learning opportunities. Much research has viewed offering explanations as one of the primary solutions to enhance moderation transparency.

These findings suggest current explanation practices fail users on multiple dimensions. Explanations are often buried rather than presented prominently. They describe which rule was violated without explaining why the content triggered that rule. They offer appeals pathways that lead to automated responses. They provide no guidance on creating compliant content.

The potential of large language models to generate contextual explanations offers one promising avenue. Research suggests that adding potential social impact to the meaning of content would make moderation explanations more persuasive. Such explanations could be dynamic and interactive, including not only reasons for violating rules but recommendations for modification. Studies found that even when LLMs may not accurately understand contextual content directly, they can generate good explanations after being provided with moderation outcomes by humans.

But LLM generated explanations face challenges. Even when these systems cannot accurately understand contextual content directly, they can generate plausible sounding explanations after being provided with moderation outcomes. This creates a risk of explanatory theatre: explanations that sound reasonable whilst obscuring the actual basis for decisions. Some studies imply that users who received explanations for their removals are often more accepting of moderation practices.

The accessibility dimension adds another layer of complexity. Research examining Facebook and X moderation tools found that individuals with vision impairments who use screen readers face significant challenges. The functional accessibility of moderation tools is a prerequisite for equitable participation in platform governance, yet remains under addressed.

Effective explanations must accomplish multiple goals simultaneously: inform users about what happened, help them understand why, guide them toward compliant behaviour, and preserve their ability to contest unfair decisions. Best practices suggest starting with policies written in plain language that communicate not only what is expected but why.

Education Over Punishment Shows Promise

In January 2025, Meta launched a programme based on an Oversight Board recommendation. When users committed their first violation of an eligible policy, they received an eligible violation notice with details about the policy they breached. Instead of immediately receiving a strike, users could choose to complete an educational exercise, learning about the rule they violated and committing to follow it in future.

The results were remarkable. In just three months, more than 7.1 million Facebook users and 730,000 Instagram users opted to view these notices. By offering education as an alternative to punishment for first time offenders, Meta created a pathway that might actually reduce repeat violations rather than simply punishing them. This reflects a recommendation made in the Board's first policy advisory opinion.

This approach aligns with research on responsive regulation, which advocates using the least interventionist punishments for first time or potentially redeemable offenders, with sanctions escalating for repeat violators until reaching total incapacitation through permanent bans. The finding that 12 people were responsible for 73 per cent of COVID-19 misinformation on social media platforms suggests this graduated approach could effectively deter superspreaders and serial offenders.

Research on educational interventions shows promising results. A study using a randomised control design with 750 participants in urban Pakistan found that educational approaches can enable information discernment, though effectiveness depends on customisation for the target population. A PNAS study found that digital media literacy interventions improved discernment between mainstream and false news by 26.5 per cent in the United States and 17.5 per cent in India, with effects persisting for weeks.

Platforms have begun experimenting with different approaches. Facebook and Instagram reduce distribution of content from users who have repeatedly shared misleading content, creating consequences visible to violators without full removal. X describes a philosophy of freedom of speech rather than freedom of reach, where posts with restricted reach experience an 82 to 85.6 per cent reduction in impressions. These soft measures may be more effective than hard removals for deterring future violations whilst preserving some speech.

But educational interventions work only if users engage. Meta's 7 million users who viewed violation notices represent a subset of total violators. Those who did not engage may be precisely the bad actors these programmes aim to reach. And educational exercises assume good faith: users who genuinely misunderstood the rules.

Navigating Speed, Accuracy, and Security

Platforms face an impossible optimisation problem. They must moderate content quickly enough to prevent harm, accurately enough to avoid silencing legitimate speech, and opaquely enough to prevent bad actors from gaming the system. Any two can be achieved; all three together remain elusive.

Speed matters because harmful content spreads exponentially. TikTok reports that in the first three months of 2025, over 99 per cent of violating content was removed before anyone reported it, over 90 per cent was removed before gaining any views, and 94 per cent was removed within 24 hours. These statistics represent genuine achievements in preventing harm. But speed requires automation, and automation sacrifices accuracy.

Research on content moderation by large language models found that GPT-3.5 was much more likely to create false negatives (86.9 per cent of all errors) than false positives (13.1 per cent). Including more context in prompts corrected 35 per cent of errors, improving false positives by 40 per cent and false negatives by 6 per cent. An analysis of 200 error cases from GPT-4 found most erroneous flags were due to poor language use even when used neutrally.

The false positive problem is particularly acute for marginalised communities. Research consistently shows that automated systems disproportionately silence groups who are already disproportionately targeted by violative content. They cannot distinguish between hate speech and counter speech. They flag discussions of marginalised identities even when those discussions are supportive.

Gaming presents an even thornier challenge. If platforms publish too much detail about how their moderation systems work, bad actors will engineer content to evade detection. The DSA's requirement for transparency about automated systems directly conflicts with the operational need for security through obscurity. AI generated content designed to evade moderation can hide manipulated visuals in what appear to be harmless images.

Delayed moderation compounds these problems. Studies have shown that action effect delay diminishes an individual's sense of agency, which may cause users to disassociate their disruptive behaviour from delayed punishment. Immediate consequences are more effective deterrents, but immediate moderation requires automation, which introduces errors.

Defining Meaningful Metrics for Accountability

If current transparency practices amount to theatre, what would genuine accountability look like? Researchers have proposed metrics that would provide meaningful insight into moderation effectiveness.

First, error rates must be published, broken down by content type, user demographics, and language. Platforms should reveal not just how much content they remove but how often they remove content incorrectly. False positive rates matter as much as false negative rates. The choice between false positives and false negatives is a value choice of whether to assign more importance to combating harmful speech or promoting free expression.

Second, appeal outcomes should be reported in detail. What percentage of appeals are upheld? How long do they take? Are certain types more likely to succeed? Current reports provide aggregate numbers; meaningful accountability requires granular breakdown.

Third, human review rates should be disclosed honestly. What percentage of initial moderation decisions involve human review? Platforms claiming human review should document how many reviewers they employ and how many decisions each processes.

Fourth, disparate impact analyses should be mandatory. Do moderation systems affect different communities differently? Platforms have access to data that could answer this but rarely publish it.

Fifth, operational constraints that shape moderation should be acknowledged. Response time targets, accuracy benchmarks, reviewer workload limits: these parameters determine how moderation actually works. Publishing them would allow assessment of whether platforms are resourced adequately. The DSA moves toward some of these requirements, with Very Large Online Platforms facing fines up to 6 per cent of worldwide turnover for non compliance.

Rebuilding Trust That Numbers Alone Cannot Restore

The fundamental challenge facing platform moderation is not technical but relational. Users do not trust platforms to moderate fairly, and transparency reports have done little to change this.

Research found that 45 per cent of Americans quickly lose trust in a brand if exposed to toxic or fake user generated content on its channels. More than 40 per cent would disengage from a brand's community after as little as one exposure. A survey found that more than half of consumers, creators, and marketers agreed that generative AI decreased consumer trust in creator content.

These trust deficits reflect accumulated experience. Creators have watched channels with hundreds of thousands of subscribers vanish without warning or meaningful explanation. Users have had legitimate content removed for violations they do not understand. Appeals have disappeared into automated systems that produce identical rejections regardless of circumstance.

The Oversight Board's 80 per cent overturn rate demonstrates something profound: when independent adjudicators review platform decisions carefully, they frequently disagree. This is not an edge case phenomenon. It reflects systematic error in first line moderation, errors that transparency reports either obscure or fail to capture.

Rebuilding trust requires more than publishing numbers. It requires demonstrating that platforms take accuracy seriously, that errors have consequences for platform systems rather than just users, and that appeals pathways lead to genuine reconsideration. The content moderation market was valued at over 8 billion dollars in 2024, with projections reaching nearly 30 billion dollars by 2034. But money spent on moderation infrastructure means little if the outputs remain opaque and the error rates remain high.

Constructing Transparency That Actually Illuminates

The metaphor of the glass house suggests a false binary: visibility versus opacity. But the real challenge is more nuanced. Some aspects of moderation should be visible: outcomes, error rates, appeal success rates, disparate impacts. Others require protection: specific mechanisms that bad actors could exploit, personal data of users involved in moderation decisions.

The path forward requires several shifts. First, platforms must move from compliance driven transparency to accountability driven transparency. The question should not be what information regulators require but what information users need to assess whether moderation is fair.

Second, appeals systems must be resourced adequately. If the Oversight Board can review only 30 cases per year whilst receiving over half a million appeals, the system is designed to fail.

Third, out of court dispute settlement must scale. The Appeals Centre Europe's 75 per cent overturn rate suggests enormous demand for independent review. But with only eight certified bodies across the entire EU, capacity remains far below need.

Fourth, educational interventions should become the default response to first time violations. Meta's 7 million users engaging with violation notices suggests appetite for learning.

Fifth, researcher access to moderation data must be preserved. Knowledge of disinformation tactics was partly built on social media transparency that no longer exists. X ceased offering free access to researchers in 2023, now charging 42,000 dollars monthly. Meta replaced CrowdTangle, its platform for monitoring trends, with a replacement that is reportedly less transparent.

The content moderation challenge will not be solved by transparency alone. Transparency is necessary but insufficient. It must be accompanied by genuine accountability: consequences for platforms when moderation fails, resources for users to seek meaningful recourse, and structural changes that shift incentives from speed and cost toward accuracy and fairness.

The glass house was always an illusion. What platforms have built is more like a funhouse mirror: distorting, reflecting selectively, designed to create impressions rather than reveal truth. Building genuine transparency requires dismantling these mirrors and constructing something new: systems that reveal not just what platforms want to show but what users and regulators need to see.

The billions of content moderation decisions that platforms make daily shape public discourse, determine whose speech is heard, and define the boundaries of acceptable expression. These decisions are too consequential to hide behind statistics designed more to satisfy compliance requirements than to enable genuine accountability. The glass house must become transparent in fact, not just in name.

---

References and Sources

Appeals Centre Europe. (2024). Transparency Report on Out-of-Court Dispute Settlements. Available at: https://www.user-rights.org

Center for Democracy and Technology. (2024). Annual Report: Investigating Content Moderation in the Global South. Available at: https://cdt.org

Digital Services Act Transparency Database. (2025). European Commission. Available at: https://transparency.dsa.ec.europa.eu

European Commission. (2024). Implementing Regulation laying down templates concerning the transparency reporting obligations of providers of online platforms. Available at: https://digital-strategy.ec.europa.eu

European Commission. (2025). Harmonised transparency reporting rules under the Digital Services Act now in effect. Available at: https://digital-strategy.ec.europa.eu

Google Transparency Report. (2025). YouTube Community Guidelines Enforcement. Available at: https://transparencyreport.google.com/youtube-policy

Harvard Kennedy School Misinformation Review. (2021). Examining how various social media platforms have responded to COVID-19 misinformation. Available at: https://misinforeview.hks.harvard.edu

Information Commissioner's Office. (2024). Guidance on content moderation and data protection. Available at: https://ico.org.uk

Meta Transparency Center. (2024). Integrity Reports, Fourth Quarter 2024. Available at: https://transparency.meta.com/integrity-reports-q4-2024

Meta Transparency Center. (2025). Integrity Reports, Third Quarter 2025. Available at: https://transparency.meta.com/reports/integrity-reports-q3-2025

Oversight Board. (2025). 2024 Annual Report: Improving How Meta Treats People. Available at: https://www.oversightboard.com/news/2024-annual-report-highlights-boards-impact-in-the-year-of-elections

PNAS. (2020). A digital media literacy intervention increases discernment between mainstream and false news in the United States and India. Available at: https://www.pnas.org/doi/10.1073/pnas.1920498117

RAND Corporation. (2024). Disinformation May Thrive as Transparency Deteriorates Across Social Media. Available at: https://www.rand.org/pubs/commentary/2024/09

TikTok Transparency Center. (2025). Community Guidelines Enforcement Report. Available at: https://www.tiktok.com/transparency/en/community-guidelines-enforcement-2025-1

TikTok Newsroom. (2024). Digital Services Act: Our fourth transparency report on content moderation in Europe. Available at: https://newsroom.tiktok.com/en-eu

X Global Transparency Report. (2024). H2 2024. Available at: https://transparency.x.com

Yale Law School. (2021). Reimagining Social Media Governance: Harm, Accountability, and Repair. Available at: https://law.yale.edu

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...