What We Lost the Last Time Code Got Cheap — and What AI Might Cost Us Next
Every few decades, the cost of writing software collapses. It happened when high-level languages replaced assembly. It happened when open-source frameworks made it possible to spin up a web app over a long weekend. It happened again with offshore outsourcing and the no-code boom. Each time, the industry celebrated the productivity gains. Each time, a quieter bill arrived years later — in the form of security breaches, brittle systems and a generation of engineers who never learned the layer beneath the one they were paid to write.
We are now mid-way through the next collapse. As The New York Times argued recently, the AI disruption we have been waiting for has arrived, and the early signs are that it will reshape the engineering profession faster than any prior shift. Code, in 2025, is the cheapest it has ever been. That is worth celebrating. It is also worth being honest about what we lost the last time this happened.
The myth of the costless productivity boom
The story we tell ourselves about cheap code is a story about progress. Lower costs mean smaller teams ship bigger products. Startups disrupt incumbents. Consumers get free apps. The productivity curve goes up and to the right.
The story we don't tell is about the externalities. When the cost of producing a line of code falls, the cost of reviewing it does not fall in the same way. Neither does the cost of operating it, securing it, or fixing it when it goes wrong at 3am. Those costs get pushed downstream — onto users, onto ops teams, onto the next engineer who inherits the codebase, and increasingly onto the public.
You can see this everywhere if you know where to look. The reason The New York Times still has to publish guides explaining the crucial security step most people are missing is not because users are uniquely careless. It is because two decades of cheap web development gave us an internet stitched together from libraries, plugins and shortcuts that nobody fully audited. Multi-factor authentication exists in part to compensate for the fact that the underlying code we all rely on is, statistically, leaky.
The first cheap-code era: outsourcing and the Java sprawl
The early 2000s offshoring wave was sold as a productivity miracle. Australian banks, telcos and government departments cut development costs by routing work through Bangalore, Manila and Kuala Lumpur. For a while, it worked. Then the long tail showed up.
Anyone who has worked in a large Australian enterprise IT shop knows the legacy: layers of Java, .NET and SAP customisation that nobody fully understands, written by contractors who left the project a decade ago. The code is functional. It is also a security and maintenance liability that newer cloud-native companies have spent the last fifteen years out-competing. The cost of cheap code in 2005 was paid in 2015, when the first big breaches hit and CIOs discovered they could not even map their own systems.
The second era: the framework explosion
The second collapse came with open source. Suddenly a junior developer could pull down React, Express, a half-dozen npm packages and ship a working product in days. This was, on balance, a good thing. It democratised software-building in ways the industry should be proud of.
But it also created the supply-chain problem that haunts modern security. The average web application today depends on hundreds — sometimes thousands — of third-party packages, most maintained by volunteers, many abandoned, some quietly compromised. The reason ordinary people now need detailed instructions on password managers, hardware keys and authenticator apps is that the foundations beneath their banking apps and email inboxes are made of borrowed parts.
The same dynamic plays out in consumer-facing systems. When fans complain about the Ticketmaster queue — the bots, the crashes, the mysterious vanishing seats — they are not really complaining about ticketing. They are complaining about a system whose engineering complexity has long outrun the discipline of the people who built it. Cheap code makes scale easy; it does not make scale graceful.
The AI era: where the bill might land
This brings us to the present. Generative AI has, in the space of three years, made code roughly an order of magnitude cheaper to produce. A junior engineer with Cursor or Copilot can output what a mid-level developer used to ship in a week. The Times opinion piece linked above frames this as the long-promised disruption finally arriving. They are right. The question is what we will lose this time.
Three things are worth watching:
- Comprehension debt. When developers generate rather than write code, fewer of them deeply understand it. That is fine when everything works. It is catastrophic during an incident, an audit, or a security review.
- Security regression. Early studies of AI-generated code consistently find higher rates of common vulnerabilities — SQL injection, hardcoded secrets, insecure defaults. The model has read the entire internet, including the bad examples.
- Lost apprenticeship. Cheap code historically eats junior roles first. Without juniors, the pipeline of seniors who actually understand the stack five layers down begins to thin. We have already seen this with sysadmin and database administration skills. We are about to see it with general programming literacy.
The Australian angle: a small market with big exposure
Australia is unusually exposed to this cycle. Our software industry is small relative to the size of our economy, and we import a lot of our digital infrastructure. The Optus and Medibank breaches of recent years were not exotic events — they were the predictable consequences of mature systems built cheaply, maintained thinly, and staffed by people working around legacy decisions made by someone else.
If AI further hollows out the local engineering talent pipeline — by making junior roles uneconomic and concentrating capability inside a handful of US hyperscalers — we will be even more dependent on imported software, with even less ability to inspect what is inside it. That is a sovereignty problem dressed up as a productivity story.
What good looks like this time
None of this is an argument against cheaper code. It is an argument for noticing where the costs go when they leave the development budget. Every previous wave of cheap code has eventually forced the industry to build a new discipline to clean up after it: DevSecOps after the framework boom, supply-chain auditing after the npm crises, MFA campaigns after a decade of password reuse. The work doesn't disappear; it just moves.
The question for engineering leaders, regulators and ordinary users in the AI era is whether we build those disciplines proactively this time, or whether we wait for the breach, the outage and the post-mortem. The honest lesson from history — including the security guides we still need to write, the queues that still collapse and the breaches that still happen — is that cheap code is never actually cheap. It just sends the invoice to someone else.