The Bottleneck Moved: Why AI Coding Agents Can't Audit What They Generate

The data suggests something the marketing decks omit. Across software firms, AI coding agent adoption — Claude Code, Cursor, Devin — climbed from near zero to roughly 95% between late 2024 and early 2026. Output followed mechanically: lines of code up 30%, commits up 20%, pull requests up 23%. Every vanity metric an engineering dashboard tracks went vertical. The one metric that maps to shipped value did not. Resolved issues showed no statistically significant increase. A working paper by Fiona Chen and James Stratton, Artificial Intelligence in the Firm: Bottlenecks in Software Production, frames it bluntly — AI agents resolve zero additional issues. The body is more careful: no statistically significant increase. But the shape is unmistakable. I have traced this exact anomaly before. Not in a SaaS repository. In the EVM. The mechanism is constraint theory. Every production pipeline has a slowest stage, and system throughput is governed by that stage, not by the fastest. Amdahl's law formalizes the intuition: optimizing a non-binding constraint yields no system-level gain. AI coding agents are a spectacular optimization of the generation stage — parallel, cheap, tireless. Code review, verification, and merge are serial, expensive, and human-bound. Inject throughput into the cheap end of a serial pipeline and the surplus piles up at the expensive end. The paper's numbers confirm the pile-up. Review time per pull request rose 49%, adding roughly 3.45 days to each cycle. Pull requests requiring rework nearly doubled. Comments per PR climbed 35%. Fourteen percent more engineers were pulled into review duty. Eighty percent of firms deployed AI review tools, yet only 23% of review comments were AI-generated — downstream capacity did not scale with the upstream flood. Independent evidence converges. The 2024 DORA report found that each 25% increase in AI adoption corresponded to a decline in delivery throughput and a decline in stability. A 2025 METR randomized controlled trial found experienced developers using AI were 19% slower — while believing they were faster. Answer.AI's evaluation of the Devin agent completed 3 of 20 assigned tasks. The mechanism is not controversial. The industry simply refuses to price it. A caveat on the framing: the paper's title claims agents resolve zero additional issues, but its body reports no statistically significant increase. Zero is a strong assertion; insignificance is a weaker one. I trust the mechanism more than the specific figure — the underlying pattern is corroborated across multiple independent studies, which matters more than any single dataset's decimal places. The direction is what survives scrutiny. For general software, this is an expensive annoyance. For smart contracts, it is an existential risk surface. The reason is economic, not technical. A ticket that ships a bug can be patched next sprint. A Solidity contract that ships a bug is often irreversible — the funds are gone the moment the transaction finalizes. There is no rollback on the ledger. The issue and the loss are the same object. That asymmetry makes crypto the worst possible home for a generation/verification imbalance. And the industry has walked into it with both arms open, funded by a bull market that rewards shipping over proving. Let me trace the anomaly to its root. Generation is parallel. An agent can emit a thousand lines across fifty files in the time a human reads one diff. Verification is serial by construction: a reviewer must hold the entire state transition in their head, simulate the adversarial paths, and confirm the invariant holds across every reachable state. You cannot parallelize comprehension across a single function's control flow. The cost curves diverge — generation scales sub-linearly in effort, verification scales super-linearly in complexity. This is why the paper's downstream metrics deteriorate non-linearly. It is not merely that more code entered review. It is that the entropy of that code rose. Reworked PRs nearly doubling means the incoming diffs were not clean increments — they were higher-entropy artifacts that failed first-pass scrutiny and bounced back. The review queue absorbed a simultaneous increase in volume and decrease in quality. Two compounding loads, one fixed-capacity channel. I watched a micro-version of this in 2021. During the NFT mania I audited the ERC-721A implementation line by line — the one Azuki used — and found a subtle integer overflow in the mint function that could allow unbounded token creation under high concurrency. I reported it privately; the team patched before mainnet. The relevant detail here is the process: a single human reviewer, tracing one control-flow path, against a function written to be gas-optimal and therefore hostile to reading. Verification was the constraint. It always is. Now imagine that function generated by an agent optimizing for passing tests, not for surviving adversarial review. The agent's objective is green checkmarks. The auditor's objective is falsification. These are not the same objective, and the gap between them is where exploits live. The gas metering analogy is exact. When I traced the gas cost anomaly in Uniswap v1's transferFrom back to the EVM, the fix was a 12% reduction using unchecked arithmetic — a local optimization that happened to be a global win because the transfer path sat on the critical path. The lesson cuts both ways. AI coding agents are local optimizers. They reduce the cost of producing a diff. But diff production was never the binding constraint. The binding constraint is correctness judgment, and correctness judgment has no compiler. It has only a reviewer, a deadline, and a budget. The paper's own instrument data shows this. If AI had genuinely expanded downstream capacity, the 80/23 split would look different — AI review tools would carry a proportionate share of comments. They carry less than a quarter. Firms bought the downstream tooling without buying downstream throughput. The tools flagged; humans still adjudicated. The adjudication queue is the constraint. The economics are stark. AI drove the marginal cost of producing a line of code toward zero. It did not touch the marginal cost of verifying one — that cost is set by the complexity of the reachable state space, which grows exponentially with branching and external calls. When one input to a system goes to zero and the other stays constant, the ratio between them explodes. In crypto, where audit coverage is priced per line and per external interaction, that exploding ratio is a direct liability. A project that generates five times the code does not generate five times the assurance; it generates five times the attack surface with the same fixed review capacity. There is a second-order effect the paper understates. When generation outpaces verification, teams do not simply accumulate a backlog — they ration verification. And rationing means sampling. A reviewer facing a thousand generated lines samples the ones that look dangerous and approves the rest. Sampling is a probabilistic control. Against an adversary who can generate a thousand decoys and hide one exploit, probabilistic control fails. This is precisely the failure mode of naive optimistic rollups I modeled in 2020 — a 7-day challenge period looks robust until you find the edge case where a malicious state root slips through a specific reentrancy pattern. The challenge window is a sampling budget. AI-generated code shrinks the effective budget. Here is the angle the industry will resist: the bottleneck is not a bug to be engineered away. It is the last intact security control. Every proposal to fix the review queue — AI reviewers, auto-merge heuristics, higher test coverage — attacks the verification stage by adding more generation to it. That is adding throughput to the constraint using the same mechanism that overloaded it. An AI reviewer trained to approve is an AI generator with a different prompt. You have not added a second opinion; you have added a second optimist. The blind spot is institutional, not algorithmic. The 80/23 gap tells you firms believe they deployed review capacity. They deployed review theater. A green checkmark from an AI tool is indistinguishable from a green checkmark from a human until the exploit lands, and by then the ledger has finalized. Verification is the only currency that matters, and the industry is inflating it. I designed a Proof-of-Inference consensus layer in 2024 precisely because I believed agents should stake compute to validate data authenticity. I still believe the primitive is sound. But the paper is a warning shot: validation capacity must scale with generation capacity or the system self-defeats. If agents generate the artifacts and agents verify the artifacts, you have closed the loop on a single point of failure and called it decentralization. Trust is a variable we solved for — and here the solution was the problem. The forecast is mechanical. As AI coding agents saturate crypto development, the constraint migrates to verification, and verification is where the capital is. Expect two things. First, a wave of AI-generated contract exploits in 2026–2027 whose common signature is passed all tests, failed all adversaries. Second, a flight to verifiable tooling — formal methods, proof assistants, on-chain invariant checkers — not because they are fast, but because they are the only stage that cannot be parallelized away. The teams that win the next cycle will not be the ones generating the most code. They will be the ones who understood that the bottleneck was never the typing. It was always the judgment. And judgment does not scale by prompt.