I wrote last week about the governance debt and data debt MSPs are encountering as they roll out AI tools and solutions. A recent conversation with a friend got me thinking about a more familiar IT-related liability: tech debt.
My friend is a professional developer at a healthcare research institute who uses AI coding tools every day and very much appreciates the productivity gains they’ve produced. But he’s also growing mindful of an issue that’s manageable now but may not be forever.
The code Claude writes, he says, is very effective but not especially elegant. It’s more like “spaghetti code” organized in sometimes inscrutable ways no human developer would choose. Which means that even he, who’s responsible for the code, can’t always explain why it works the way it works. What happens when something breaks and he’s home with the flu, on vacation, working somewhere else, or retired?
And AI code breaks all the time, too. Fully 75% of organizations surveyed by Futurum have already experienced a production incident involving AI-generated code, AI agents, and/or AI tooling. AI’s great at creating huge volumes of programming very rapidly, notes Mitch Ashley (pictured), vice president and practice lead for software lifecycle engineering at Futurum.
“It isn’t necessarily going to be thorough about making sure it’s been well-tested, making sure that it’s secure, making sure that if you’re talking to other third-party services, you know what it’s talking to,” he says.
The result is software quality issues that cost two-thirds of the organizations surveyed by Tricentis between $500,000 and $5 million a year and that forced Meta to cancel a major plan to replace human coders with agentic ones in the most public and humiliating way possible.
Meta and most of the companies Tricentis polled are big businesses, but MSPs aren’t immune from the same problems, as David Schwartz, CEO of service desk automation vendor Pia, explains during a recent episode of MSP Chat, the podcast I co-host.
“I’ve seen a lot of MSPs building their own tools,” he says, especially for ticket triage. And yes, they’ve saved money on licensing as a result, but Schwartz suspects they’ll eventually pay it back elsewhere.
“Most MSPs are not software businesses,” he says, which means they have limited expertise if any in security, governance, version control, R&D, and all the other things software businesses have deep in their DNA, not to mention limited time and bandwidth for the endless toil of maintenance.
And it really is endless, Ashley observes. “It’s much easier to create new code than it is to maintain current code.”
None of this should scare MSPs away from vibe coding, he adds, provided they embrace some minimum best practices for safety and efficiency. First, he says, be explicit in your instructions to your coding agent about employing safe development practices and scanning AI-generated code for known vulnerabilities.
“Those things have to be built into the environment as part of the framework, or the harness if you will, that even everyday builders build code with,” Ashley says. Pay particular attention to how vibe-coded apps handle user IDs and passwords, he adds. “The tools aren’t necessarily great about making sure that you’re not storing credentials locally.”
In fact, nothing should be stored locally, continues Ashley, who says MSPs should always put code in a trusted repository like GitHub that multiple people in their organization have access to, and back the code up regularly.
Sounds elementary, notes Schwartz, but it isn’t for a lot of people building their own code these days. “Most MSPs don’t really have a DevOps team that can truly own that,” he says.
Nor do their customers, many of whom are vibe-coding apps too. “We’re all builders now,” Ashley says. “Anyone can pick up a credit card or even a free account and start writing code with something.”
And if that puts IT professionals at risk, imagine what it does to technical amateurs. “That’s an opportunity for the advisors, the service providers, and the integrators who specialize in working with medium and small businesses,” Ashley notes. Eventually, he says, many such companies learn that AI coding creates more work than they expected. They’ll probably be happy to pay someone else to handle it for them.