Working-Paper

AI raises worker productivity and lets firms build knowledge assets, such as the software they run on, faster. Low-quality AI output, however, may embed these assets with hidden liabilities that firms must later verify, fix, and maintain. Software lets us inspect the asset itself and measure these liabilities directly. We identify firm-affiliated public GitHub projects and, every month, use an industry-standard tool to scan each project’s full codebase for maintainability issues, bugs, and security vulnerabilities. This amounts to processing over 3.6 billion lines of code. We convert the tool’s estimated repair time into a dollar measure of technical debt. We compare projects in which AI use first appears with similar projects whose AI use is detected later or remains undetected. During the first seven months of detected AI use, codebases grow on average 6.1% more than those of comparable projects. Contrary to concerns about “AI slop,” total issues per line of code decline by 1.3%, and technical debt per line by 0.7%. Bugs per line also decline, and security vulnerabilities and critical issues, the most severe ones, show no statistically significant change. The quality gains are modest, but at the very least they provide evidence against a deterioration in the quality of the average line. Detected AI use is thus linked with faster growth in firms’ software assets.

We investigate a novel channel of venture capital value creation: the practices through which startups build and maintain their technology. We construct a new panel of 569 firms using 60,000 full codebase snapshots. We compare changes in engineering quality following first VC investment with changes at similar firms that remain without VC backing. We also construct a dollar-denominated measure of technical debt, the estimated maintenance liability embedded in software. Relative to codebase size, serious deviations from coding best practices decline by 15% and technical debt by 12%. These improvements accompany substantial codebase growth. The decline in the frequency of serious coding problems persists after matching on pre-financing growth, and quality gains extend to firms already generating revenue. In contrast, a placebo test around later financing rounds shows no evidence of quality improvement. We also analyze 4.8 million code contributions (commits). After first VC investment, documented peer review and formal issue tracking become more common, off-hours work declines, and existing team members become less likely to introduce defective code. The findings suggest that VC professionalization extends to the engineering practices through which teams build and maintain their products.

We study how cybersecurity vulnerabilities affect firm performance. We analyze 551 open-core software firms from 2010 to 2025, comparing firms affected by vulnerability discoveries with unaffected firms. These discoveries concern third-party dependency packages, making their timing plausibly exogenous to the firms using them. Exposed firms experience approximately 10% slower headcount growth relative to their pre-treatment average and a 1.7 percentage point decline in acquisition probability. Developer activity shifts toward remediation: the share of non-remediation work falls by 2.8 percentage points, while elevated fix-related activity persists for twelve months. These changes accompany faster accumulation of technical debt and cognitive complexity, which grow approximately 20 and 16–21 percentage points faster, respectively. Together, the findings suggest that cybersecurity vulnerabilities can disrupt firm growth and place persistent demands on engineering resources.