Artificial Intelligence code entropy and complexity

Research Question

Does repeated Artificial Intelligence (AI) code generation without strong architectural guardrails demonstrably increase software entropy and complexity over time, as predicted by the entropy model described in The Pragmatic Programmer, and if so, what objective metrics (cyclomatic complexity, coupling, cognitive load, time-to-change, defect rate) best capture the difference between minimally guardrailed AI-assisted codebases and those maintained with explicit investment in clean interfaces and deep module structures?

Findings

Executive Summary

Repeated Artificial Intelligence (AI) code generation without architectural guardrails is more likely than not to increase software entropy at the system level, even though it can improve bounded task-level code quality.

The evidence is mixed only if task-level and repository-level outcomes are treated as the same thing: randomized studies show better local correctness and review outcomes, while longitudinal repository data shows more duplication and less refactoring over time.

Architectural guardrails matter because deep modules, explicit interfaces, and deterministic verification loops limit how much locally generated code can leak hidden design decisions across the rest of the system.

The repository-scale signal is observational rather than causally isolating, so broader tooling and process shifts remain a live competing explanation even though the AI-without-guardrails interpretation fits the available evidence best.

The best early warning signs are not defect counts alone, but rising clone ratio, short-term churn, refactoring-share decline, hotspot code-health decline, and unexpected change coupling.

Key Findings

1. Repeated Artificial Intelligence (AI) code generation does not reliably degrade short, bounded programming tasks, because randomized and benchmark studies show that GitHub Copilot can improve unit-test success, readability, maintainability, and review throughput under controlled conditions.
2. The strongest current evidence for software entropy appears at repository timescale, where GitClear's multi-year dataset shows more cloned code and less moved or refactored code, although that observational pattern does not isolate Artificial Intelligence (AI) from broader tooling and process shifts.
3. Human review appears easier to overload than many teams assume in AI-assisted coding because security studies still find vulnerable suggestions at meaningful rates and human-AI collaboration studies show developers scrutinize Copilot suggestions less than human pair-programming input.
4. John Ousterhout's deep-module model explains why architectural guardrails matter: when interfaces stay small and implementation complexity stays hidden, locally generated code is less able to leak design knowledge across the system and create compounding change costs.
5. The most sensitive early-warning metrics for AI-driven entropy are clone ratio, short-term churn, refactoring-share decline, and hotspot code-health decline, because they capture structural drift before defect counts or incident reports fully catch up.
6. Cognitive Complexity and change coupling are more useful maintainability indicators than cyclomatic complexity alone in this problem setting, because one measures human understandability and the other measures hidden cost-of-change relationships across commits rather than just control-flow branches.
7. The evidence supports a threshold interpretation rather than a clean linear law, because hotspot decline, hidden coupling, and duplication reinforce each other until teams face markedly slower and less predictable change.
8. The practical distinction between minimally guardrailed and guarded codebases is not that one uses AI and the other does not, but that guarded teams force generated code through interfaces, verifiers, and review loops that keep local gains from turning into system-level entropy.

Assumptions

• "Vibe-coded" is treated here as AI-heavy coding with weak architectural and review guardrails, because the literature does not offer a standardized formal term for that working style.
• GitClear's repository-scale trends are treated as partly AI-associated rather than fully AI-isolated, because the report is observational and cannot eliminate every confounder across 2020 to 2024.

Analysis

The main analytical move is to separate local code quality from system entropy, because the evidence is genuinely positive on the first and cautionary on the second.

Deep interfaces, local understandability, and historical coupling should be treated as different control surfaces, since a codebase can score well on one while degrading on another.

Human behavior is part of the mechanism: if Artificial Intelligence (AI) output is accepted quickly and at scale, review quality becomes the scarce resource and structural debt can accumulate faster than teams notice.

The competing explanation, that some repository-scale deterioration reflects broader tooling or process changes rather than AI specifically, is credible, but it does not explain away the specific AI-era combination of rising clone share, declining moved-code share, and reduced scrutiny documented in the cited evidence.

This is why prior repository work on verifier pipelines and engineering investment sharpens the conclusion here: entropy control is less about banning AI generation than about raising the strength of the architecture and verification envelope around it.

Risks, Gaps, and Uncertainties

• The evidence base does not yet include a strong independent longitudinal experiment that directly randomizes entire codebases into guardrailed and unguardrailed Artificial Intelligence (AI) workflows.
• The originally seeded Copilot pair-programming source had an incorrect arXiv identifier and the corrected Association for Computing Machinery (ACM) paper was blocked, which limits direct use of that specific comparison.
• Repository-wide trend data and survey data are directionally useful but cannot fully isolate which observed maintainability changes come from AI, broader tooling changes, or shifting development practices.

Open Questions

• Which metric bundle best predicts future remediation cost in AI-heavy repositories: clone ratio plus hotspot decline, or change coupling plus Cognitive Complexity?
• Can a controlled longitudinal study instrument two otherwise similar teams, one with enforced architectural review and one with prompt-first generation, to estimate entropy-growth differentials directly?
• What review-process changes most effectively restore scrutiny when developers grow accustomed to accepting AI suggestions?

sources

• [x] Hunt and Thomas (2019) The Pragmatic Programmer, 20th Anniversary Edition
• [x] Pragmatic Bookshelf Tip 5: Don't Live with Broken Windows
• [x] Ousterhout (2021) A Philosophy of Software Design
• [x] Ousterhout (2018) Modular Design lecture notes
• [x] McCabe (1976) A Complexity Measure
• [x] SonarSource Cognitive Complexity because testability != understandability
• [x] Pearce et al. (2021) Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions
• [x] Dakhel et al. (2023) GitHub Copilot AI Pair Programmer: Asset or Liability?
• [x] Yetistiren et al. (2023) Evaluating the Code Quality of AI-Assisted Code Generation Tools: An Empirical Study on GitHub Copilot, Amazon CodeWhisperer, and ChatGPT
• [x] Liang et al. (2023) Practices and Challenges of Using GitHub Copilot: An Empirical Study
• [x] Welter et al. (2025) From Developer Pairs to AI Copilots: A Comparative Study on Knowledge Transfer
• [x] GitHub (2023) Research: Quantifying GitHub Copilot's impact on code quality
• [x] GitHub (2024) Does GitHub Copilot improve code quality? Here's what the data says
• [x] GitHub (2022) Research: Quantifying GitHub Copilot's impact on developer productivity and happiness
• [x] GitClear (2025) AI Copilot Code Quality: 2025 Look Back at 12 Months of Data
• [x] CodeScene Change coupling: visualize the cost of change
• [x] CodeScene Improve code quality and ensure product stability
• [x] CodeScene Measure code health of your codebase
• [x] Martinovic and Rozic (2025) Perceived Impact of AI-Based Tooling on Software Development Code Quality
• [x] Mitchell (2026) Reliable Software in the LLM Era
• [x] Mitchell (2026) LLM verifiability asymmetry between code and world action
• [x] Mitchell (2026) Software engineering investment case for LLM value
• [x] Mitchell (2026) Systems capability debt, citizen development, and agentic AI risk synthesis