Why AI is Making Bad Code Faster and Cybercriminals More Dangerous — and why the enterprise is still losing to a $20/month subscription
The starting point nobody wants to hear
You’ve met both types. The old-school developer who says using AI to write code is wrong on principle. And the one who fires vague prompts — “build me a system that does X and Y” — and expects magic.
Both are wrong. For the same reason: neither understands what an accelerator actually is.
AI is not a creative tool. It’s a multiplier. It multiplies what you bring in. If you bring vision, architecture, method — it multiplies quality. If you bring nothing — it multiplies chaos. Faster than any junior with Stack Overflow open on the second monitor.
The data on code quality: this isn’t a feeling, it’s measurable
The degradation of code quality in the AI era is not a subjective impression. It’s documented.
GitClear analyzed 211 million lines of code changed between 2020 and 2024. The results are uncomfortable:
Duplicated code blocks (5+ lines) increased 8x in 2024
Refactoring collapsed from 25% of changed lines in 2021 to under 10% in 2024
Code churn is projected to double vs the pre-AI 2021 baseline
AI-coauthored PRs show 1.7x more issues (CodeRabbit, December 2025)
The paradox: 82% of developers use AI coding assistants daily or weekly, and 59% say AI has improved code quality. But only 3.8% report both low hallucinations and high confidence in AI-generated code ready for production.
Everyone uses it. Almost everyone thinks it works. Very few have reliable code in production.
The main problem cited by developers isn’t hallucinations — it’s missing context, reported by 65% during refactoring. If you don’t know what you’re building, AI won’t know for you.
The real risk nobody calculates: attack surface proliferation
“Build me a tool that blocks phishing.”
AI will do it. It will follow consolidated patterns, known libraries, standard architectures. The code will compile. Tests will pass. The tool gets deployed.
Six months later you have a thousand different tools all doing the same thing, each written without architectural vision, each with its own outdated dependencies, its own exposed endpoints, its own undocumented attack surface.
You didn’t reduce the risk. You distributed and multiplied it.
Code duplication means bugs require fixes in multiple places. Reduced refactoring means complexity compounds until full rewrites become necessary. In security, this isn’t technical debt — it’s a vulnerability waiting to be exploited.
There’s also an invisible cost: whoever doesn’t know what they want ends up in infinite iterative loops. Vague prompts generate vague output that requires more prompts to correct. Thousands of enterprise employees multiply this waste — in burned tokens, budget, and time — that never appears in any AI initiative ROI calculation.
Software written without architecture is a real and underestimated security risk. Not because AI is inherently dangerous, but because it lowers the cost of creation without lowering the cost of consequences.
Criminals figured this out before you did
This is the part that stings, and it’s all documented.
In February 2025, three teenagers — ages 14, 15, and 16, zero coding background — used ChatGPT to build a tool that hit Rakuten Mobile’s systems approximately 220,000 times.
A single attacker compromised nine Mexican government agencies using Claude Code and GPT-4.1: 1,088 prompts, 5,317 commands, 34 live sessions. A team’s worth of output, executed by one person.
AI-generated spear phishing messages achieved a 54% click-through rate on real targets. More than one in two people fooled.
Anthropic has documented campaigns including ransomware-as-a-service operations, credit card fraud, romance scam bots, and a Russian-speaking developer who used Claude to create malware with advanced evasion capabilities.
The criminal doesn’t have an AI Transformation office. No governance committee. No KPIs on token consumption. They have a clear objective, a method, and $20/month — or an abliterated model running locally with no filters at all.
In 2025, the barrier to entry for technically sophisticated attacks dropped significantly. We’re seeing single-actor attacks with the operational capacity of organized teams, and non-technical individuals executing what previously required a skilled hacker.
The enterprise method is failing
The company spends thousands on enterprise licenses, governance frameworks, responsible AI adoption committees. Months to approve use cases. More months of onboarding. Proprietary tools with dashboards and metrics.
The result: duplicated code, accelerated technical debt, multiplied attack surface, and tokens burned in directionless sessions.
The criminal: clear objective, $20/month, no committee.
The asymmetric advantage isn’t in the technology — both sides access the same models. It’s in the method. The attacker knows exactly what they want to build. Most enterprise developers don’t.
AI amplifies those who know what they’re building. The problem is it does exactly the same for those who don’t have a clue.
The difference between a quality accelerator and a chaos accelerator isn’t in the model. It’s in the head of whoever uses it. Architecture, vision, method aren’t optional add-ons — they’re the entry fee. Without them, you’re not adopting AI. You’re just accelerating the mess you already had.
The criminal already has the method. Does your team?