AI coding agents: the hidden risks for SMEs in 2026

The premise: who is George Hotz and why his voice matters

George Hotz is not an external commentator on the software world. He is the first hacker to have independently unlocked an iPhone. He founded comma.ai, a company specializing in autonomous driving. Furthermore, he briefly worked at OpenAI. His technical profile is, therefore, anything but generic.

In May 2026, Hotz made a clear statement: LLM-powered coding agents will become one of the most costly mistakes in the entire history of software development. The original source is an analysis published by The Decoder , which reported his words accurately. Therefore, this is a public and documented position.

This stance is part of a deep debate. The AI community is currently divided between those who see coding agents as productivity multipliers and those, like Hotz, who consider them a structural source of technical risk. Therefore, ignoring this debate would be a mistake for any organization considering investments in code automation.

How coding agents work: architecture and intrinsic limits

A coding agent is an AI system capable of writing, editing, and sometimes executing code autonomously. It is based on a Large Language Model (LLM), which is a large language model trained on enormous corpora of text and source code. In practice, the model predicts the most probable sequence of tokens given a context.

This mechanism works well for tasks with high repeatability and low contextual complexity. For example, generating a CRUD function, writing a standard unit test, or completing boilerplate code blocks. However, the problem arises when the context becomes deep and interdependent.

LLMs don't truly grasp the semantics of the system they're operating on. As a result, they can generate code that's syntactically correct but logically flawed. These bugs don't throw immediate errors. Instead, they hide in deep layers and only surface under specific conditions, often in production. According to research from Gartner , the quality of AI-generated code requires systematic human review to maintain acceptable reliability standards.

The phenomenon of silent technical debt

The concept of technical debt is not new. It indicates the future cost an organization pays for suboptimal technical choices made in the present. However, coding agents introduce a particularly insidious variant: the silent technical debt .

In this scenario, the debt isn't visible when the code is written. In fact, the generated code often passes automatic linting checks and first-level tests. The problem emerges weeks or months later, when the system scales or when new features interact with the AI-generated code.

Hotz pointed out that after six months of testing, bugs become progressively harder to find. This isn't a quantity problem, but a depth problem. Therefore, the cost of fixing them grows exponentially over time. For an SME with limited development resources, this scenario can become critical.

Studies of Harvard Business Review have documented how the average cost of fixing a bug in production is up to 100 times higher than fixing it during development. So, the silent build-up of flaws has real, measurable financial consequences.

SME use cases: where the risk is highest

Not all use cases present the same level of risk. It is useful to distinguish between high-impact and low-impact scenarios for Italian SMEs operating in B2B or retail.

High-risk contexts include:

• Management systems and custom ERPs : business logic is complex and every error has a direct impact on operations.
• Integrations with third-party APIs : a coding agent can generate seemingly correct API calls but with inadequate error handling.
• E-commerce modules with payment logic : any bug in this context has immediate legal and reputational consequences.
• Authentication and user management systems : security vulnerabilities generated by AI are among the most difficult to detect.

Conversely, low-risk contexts include generating HTML templates, writing non-critical automation scripts, and producing technical documentation. In these areas, coding agents offer a real advantage without exposing the organization to significant risks.

For SMEs managing complex web projects, we at SHM Studio recommend precisely mapping the boundaries of AI tool usage before integrating them into development workflows. A AI strategy well-defined is the prerequisite for any responsible adoption.

The speed/quality trade-off: a calculation SMEs need to make

The main argument for coding agents is speed. A prototype that would take a senior developer three days can be whipped up in a few hours with an LLM's help. This perk is totally real and shouldn't be downplayed.

However, the economic calculation must account for the cost of accumulated technical debt. If a prototype goes to production without a proper review cycle, the initial savings quickly turn into an amplified cost. Furthermore, in SMEs with small development teams, the capacity to handle complex bugs is structurally limited.

The trade-off, then, isn't simply speed versus quality. It's immediate savings versus future operational risk. Because of this, deciding to use coding agents calls for a clear risk assessment, not just a performance review.

Research from the MIT Technology Review indicate that organizations integrating AI into software development without structured governance processes show significantly higher technical incident rates compared to those adopting hybrid supervision frameworks.

The division in the AI community: it's not just Hotz

Hotz's position is not isolated. The AI community is deeply divided on this issue. On one hand, companies like GitHub with Copilot and Cursor actively promote the adoption of coding agents as productivity tools. On the other hand, a growing part of the technical community points out structural problems.

The debate is fundamentally about the nature of LLMs. These models are optimized for statistical plausibility, not logical correctness. Therefore, they produce outputs that sound right much more often than they actually are. This gap between appearance and substance is particularly dangerous in a technical context.

Furthermore, the growing reliance on coding agents risks eroding the internal skills of development teams. If programmers stop writing code from scratch, they gradually lose the ability to read and understand AI-generated code. This creates a vicious cycle that increases dependency and reduces supervision capacity.

What no one calculates: the cost of supervision

A factor often overlooked in the coding agents debate is the true cost of supervision. Lots of vendors pitch these tools as ways to cut down on needing senior devs. Actually, the opposite is usually true.

Detecting bugs produced by an LLM requires high technical expertise. A junior developer cannot identify deep logical errors in AI-generated code. Consequently, a coding agent does not replace a senior developer: it requires their constant presence as a supervisor.

This radically changes the ROI calculation. The expected savings on code writing are partially or totally absorbed by the cost of qualified review. For SMEs that do not have internal senior figures, this means outsourcing supervision, adding a cost that is rarely included in initial projections.

Who deals with Digital marketing and digital transformation for SMEs knows this pattern well: underestimating hidden costs is one of the main causes of failure in technology adoption projects. For this reason too, a structured consulting approach is essential before any investment in AI applied to development.

The recommended decision: an operational framework for SMEs

In light of these considerations, what approach is recommended for an Italian SME evaluating the use of coding agents in 2026?

First off, it's useful to distinguish between assisted use and autonomous use. Assisted use, where the AI suggests and the developer decides, has an acceptable risk profile. Autonomous use, where the AI writes and the developer approves without deep review, is what Hotz rightly criticizes.

Secondly, we need to set clear boundaries. Coding agents should be enabled explicitly for specific types of tasks, not as a general tool. Every output must go through a structured code review process, no matter the source.

Third, code quality metrics need to be tracked over time. Indicators like bug density per sprint, mean time to resolve incidents, and test coverage are early warning signs of accumulating technical debt.

Finally, team training remains a non-negotiable investment. A team that understands the limitations of LLMs can use them productively. A team that considers them infallible is exposed to significant risks.

For SMEs wishing to delve deeper into these topics, the team at SHM Studio is available for structured consulting. You can explore our AI services , the solutions of web development , the strategies of SEO and Digital marketing . For a direct comparison, the page contacts is the starting point. Furthermore, our Blog regularly publishes analyses on these topics, including reflections on AI-assisted copywriting , google ads campaigns and LinkedIn campaigns .