Disclaimer: Written by a human, spell checked by AI, spell check verified by a human.
This is an opinion piece. I am fully aware that there are lots of other opinions. Additionally I am confident, I will not be able to hit all pin points in this discussion, because there are too many.
Reason for this post
Over the past weeks and months I read a lot of posts in various media that sounds like this:
Developers of software XY have not fully banned AI from development, so avoid it now.“
Or something similar, indicating that all software that has any AI involvement in its development process should be banned entirely. Often, this comes with an explanation that AI produces shitty code, called AISlop.
My background thinking
In the early 2000s, I worked for a Fortune 500 company that was not a software development company but had a huge IT department and lots of development going on. It decided to outsource 80% of its software development to India. I will not discuss the atmosphere in the IT department on the day of the official announcement.
A lot of people believed, partially correctly, that it was because India was much cheaper. Fun fact: that wasn’t necessarily true. I will get back to this. The main reasons were different:
- Every big company at that time outsourced to India; it was the current trend. A CEO or CIO not doing so would be blamed by the media and investors.
- The company was in Switzerland, and, simply speaking, Switzerland didn’t provide enough IT personelle every year for the companies there. Even PR activities in Germany, France, and Italy did not help. To get all the work done, they needed new solutions. This was the key driver for the outsourcing.
I published various articles about my experiences with Indian offshore providers at that time. But what we had to do was this: for every five to ten developers in India we had a so-called software architect in Switzerland, simply because the code was at best mediocre. We developed architecture guidelines, programming guidelines, testing guidelines and everything you can imagine. We clearly described how testing would have to be done on their end. We kept a significant number of testing employees in-house. Additionally, we used tools to help us match their code against the various guidelines. On top of that, we had the in-house architects. We did not take the code and put it into production. We invested a significant amount of time, money, and personnel in ensuring that what was in production matched the highest standards we believed we ever maintained.
I strongly believe that, with all this in place, we had higher standards and better processes than ever before.
No one called this Indian slop. Fun fact: I have not heard of a single person who was actually fired because of this. People got trainings and development plans to become quality assurance or architecture personnel.
Why am I telling you this?
Because I see lots of similarities to the current AISlop discussions.
Some facts
AI has been in a lot of places for years, even before the ChatGPT hype began. Google Maps, Google Translate and many others haved used and use AI.
AI dramatically improves IT security. Google stated that had it fixed 1072 bugs in Chrome with the help of AI. You may say that this is their PR and therefore useless. But you can look everywhere. At least since Anthropic Mythos became apparent, the number of bugs fixed in various software releases has increased significantly. Mozilla states that they have fixed 271 security bugs in Firefox.
Security experts such as Matthew Green or Steve Gibson clearly state that, due to AI, software will become much more secure very soon. All software, for everyone. Companies incorporate AI into their development and CI/CD (continuous integration, continuous development/deployment) pipelines, ensuring that fewer bugs are deployed into production.
Matthew Green has stated another thought that I think is worthwhile to consider. Talking about major security improvements in software due to AI:
The destruction of the low-hanging vulnerability fruit will make law enforcement (and intelligence) agencies’ need much more acute. The demand for constructed, intentional backdoors will re-start in earnest.“
This indicates that he believes the software quality will improve significantly and that security bugs will decrease significantly.
The downside
There are many, but I will focus on the most important one, from my point of view.
First: I see a huge problem with bug reports flooding small and medium-sized open source projects. People, often people with no or little IT or development background, use an AI tool (not necessarily the most sophisticated or best-trained; often the cheapest, free-of-charge models) and point it to a repository, then send the model’s report unfiltered to developers. The one project that got very vocal on this was the curl project. They had a bug bounty program that they stopped. People believed sending AI security vulnerability reports to the developers would get them money. A very small team, developing an incredibly good and useful tool, was flooded. As Daniel Stenberg stated, basically they would want to look at every bug report they receive to improve their software, but now it is impossible.
The second negative impact on open source projects is that the number of commits is skyrocketing. GitHub’s CIO Vlad Fedorov posted about this on April 28 this year. People download repositories, put them into an LLM or an agent such as Claude Code, and let the tool change or write new code and commit the changes. They do this without any quality assurance and without understanding what the tool has created. They flood the repos of good tools and often make them worse. The developers – often a single person or a very small team, working on the project as a side activity rather than full-time – get drowned.
Others create entirely new projects with code written solely by AI, with no checking, no quality assurance and nothing else. It compiles, and it gets committed.
„See,“ you may say, „this is the reason AI should not be allowed in any project, or that the project should be avoided.“
No. Not my opinion.
My take
I think it will be impossible to avoid all software that contains a line of AI-generated code in it. I believe we will end up in a cave if we do so.
I strongly believe that code written solely by AI, with no human intervention, should be avoided. Even if Google won a gold medal at a development contest. (I am aware that there are comments which explain how this could happen and why that is not as good as it looks).
I think we should follow the approach we used in my intro regarding Indian offshore development. The Indian developers were seen as additional hands (not engineers or creative thinkers), to use a negative word I don’t share, as a tool.
To me, AI is a tool, comparable to Eclipse, Xcode, GitHub, and so on.
My most important point is:
A fool with a tool is still a fool.“
If people use AI as a tool, that is, as an assistant or helper, we can all benefit from it.
If people use AI as a replacement for humans, for developers, quality assurance people, testers, and architects, then we are doomed.
I do get the point that companies focusing on expenses, cash, efficiency and not having the right background or mindset, or being driven by people (boards, investors) who have no clue or don’t care what it means to use AI alone (which is righly called AISlop in my eyes), try this approach. Many have gone back to humans.
I do believe AI can have huge value in software development. If used wisely.
When humans have the last word.
When quality assurance is guaranteed.
When source code quality is guaranteed.
When code maintenance by humans is guaranteed.
When humans understand the code they deploy into production.
One of my worst-case thoughts
I am from Europe. I sometimes think about what happens if European companies entirely rely on AI tools from the US (as they do at the moment). A german article about AI used in German companies clearly states that german companies use OpenAI, Microsoft, and Google AI. Mistral from France? No company mentioned using it.
Assuming these companies have laid off much of their IT staff and are fully relying on AI code, I wonder what happens when a maniac president in the US forces his buddies to shut down the good models, or all models (maybe to put pressure on the EU with tariffs), for European companies? Then Europe is lost.
My conclusion
I don’t think it is sustainable to avoid AI in all software at all costs. I also think that fully relying on AI for coding is insane and a risk I would not take (not now, at least).
AI, used as a tool cautiously and consciously, can significantly improve productivity. But to me, the strongest benefit is in the IT security space. If we do not use AI, we will end up with software as it is today. But criminals, and states such as Russia, China, the US, and others, will use AI to exploit programs. We need AI to defend against this. There is no way out, IMHO.