Diff Debt: Every AI-Generated PR You Merge Without Reading Is a Loan

Erdi BAY — Thu, 09 Jul 2026 05:24:58 +0000

diff debt (n.) — the accumulated risk of merging AI-generated diffs that no human has actually read.

I shipped code I've never read. So did you.

Here's a confession. A few months ago I built a desktop automation bot called Erci — GUI, computer vision, license system, the whole thing. It works. People use it. And I have never truly read most of its code.

I'm not even a professional developer. I described what I wanted to an AI assistant, it produced the code, I ran it, and when it worked, I moved on. Thousands of lines accumulated this way. The bot is great — until something breaks in a module I've technically "owned" for months, and I open the file and realize I'm reading it for the first time.

If you're a professional developer, your version of this story is more subtle but structurally identical: the agent produces a plausible 900-line diff, the checks are green, the sprint is on fire, you skim, you approve, you merge. The pull request looked perfect. That's exactly the problem — it looked perfect.

I started calling this diff debt: the gap between what was merged and what was actually reviewed.

Why it needs its own name

We already have good words for the neighborhood. Technical debt lives in the code — shortcuts you consciously took. Verification debt (a framing AWS CTO Werner Vogels pushed at re:Invent 2025) is the macro cost of inadequately checking AI output. Comprehension debt (Addy Osmani's term) is the erosion of the mental model you used to build for free just by writing code yourself.

Diff debt is the unit-level version. It accrues one unread pull request at a time, which is exactly why it's invisible: no single skimmed diff feels like a decision. Nobody chooses to stop understanding their codebase. It happens 400 green-checked lines at a time.

The math got broken

Generation got fast. Review didn't.

An engineer writing 500 lines by hand builds understanding as a side effect of writing. An agent producing 5,000 lines in six minutes produces zero understanding — that work is now a separate, unpaid job called review, and the numbers say it isn't happening:

Sonar's 2026 survey of 1,100+ developers found roughly 42% of committed code is now AI-generated — projected to hit 65% by 2027.
The same survey: 96% of developers don't fully trust AI-generated code to be correct, yet only about half always check it before committing. That spread between distrust and verification is diff debt accruing in real time.
Since AI tool adoption, average PR sizes have roughly tripled in many orgs — diffs that used to be 100–200 lines now arrive at 400–600. A 400-line diff can be read. A 4,000-line diff can only be skimmed.

How the interest compounds

Like financial debt, diff debt charges interest. Unread code becomes the foundation for the next unread diff. Six months later a production incident lands at 2 a.m. in a module that "someone" reviewed, and the debugging session costs more than writing the feature from scratch would have. Refactors stall because nobody can predict what breaks. Onboarding slows because there's no one to ask — the author was a model, and the reviewer was a glance.

Paying it down

You can't read everything; the volume math doesn't allow it anymore. Paying down diff debt means spending review attention where wrongness is expensive:

Risk-tier your reviews. Anything touching money, auth, data deletion, or external side effects gets a real human read. Boilerplate can pass on green checks.
Cap diff size. If the agent hands you 4,000 lines, make it deliver in reviewable increments. Reviewability is a feature; demand it.
Demand tests that encode intent — not tests the model wrote to flatter its own implementation.
Track comprehension like a metric. If nobody on the team can explain a module, treat it as an outage waiting for a date.

The teams that win the next few years won't be the ones that generate the most code. They'll be the ones that know, with confidence, what's actually in theirs.