The internet has a human slop problem, and AI is exposing it

The internet we rely on every day is a patchwork of code written by countless developers over three decades. While that collaborative effort has powered unprecedented growth, it has also left a legacy of “human slop” – messy, undocumented, and fragile software that barely survives the relentless churn of new features and security threats. Now, generative AI tools that scan, refactor, and even rewrite code are shining a bright, unflattering light on these hidden flaws, prompting industry leaders like Vercel’s Tom Occhino to call for a fundamental overhaul of the web’s neglected foundations.

What Happened

In the past year, AI‑driven code assistants such as GitHub Copilot, OpenAI’s Codex, and newer large‑language‑model (LLM) platforms have been deployed at scale across open‑source projects and commercial codebases. As they parse millions of lines of JavaScript, HTML, and CSS, they are not just suggesting snippets—they are also flagging patterns that break best practices, expose security holes, or simply don’t compile under modern browsers. The result has been a cascade of automated pull requests that point out “human slop” in libraries that have been trusted for years.

One striking example came when an AI‑powered audit of a popular UI framework uncovered a series of legacy polyfills that relied on deprecated DOM APIs. The audit triggered hundreds of automated suggestions to replace those polyfills with native browser calls, dramatically reducing bundle size and eliminating a class of cross‑site scripting (XSS) vulnerabilities. The incident sparked a broader conversation: if AI can surface such deep‑seated issues in well‑maintained projects, what does that say about the unseen bugs lurking in the rest of the internet’s code?

Key Details

Tom Occhino, the co‑founder of Vercel, has been vocal about the implications of these AI discoveries. In a recent interview, he described the internet’s codebase as “a house built on sand” where developers often patch one problem with another, creating a tangled web of technical debt. Occhino pointed to a specific case where an AI model identified a mis‑configured Content‑Security‑Policy (CSP) header in a widely used static site generator. The misconfiguration allowed malicious scripts to execute on any site generated with the tool, a risk that had gone unnoticed for years because the header was generated dynamically and rarely inspected.

Beyond security, AI is also exposing performance inefficiencies. A study conducted by a consortium of cloud providers found that AI‑driven linting reduced average page load times by 12% across a sample of 10,000 websites. The reductions stemmed from AI‑suggested refactors such as consolidating duplicated CSS rules, removing dead code, and updating outdated image formats. These optimizations, while seemingly minor on a per‑site basis, compound into massive bandwidth savings at the scale of the global internet.

Background

The term “human slop” was coined by veteran engineers who have spent years wrestling with code written by others—code that often lacks clear documentation, follows inconsistent naming conventions, and contains ad‑hoc fixes that never made it into a proper release. Historically, the internet’s open‑source culture has prioritized rapid feature delivery over rigorous code hygiene, a trade‑off that made sense when bandwidth and compute were scarce but is increasingly untenable in today’s high‑speed, security‑aware environment.

AI’s entrance into this space marks a turning point. Large language models trained on billions of lines of code have developed a statistical sense of what “clean” code looks like. When they encounter anomalies—such as a function that returns a string but is typed as a number—they flag them for human review. This capability is not just about catching typos; it’s about surfacing systemic issues that have been baked into the internet’s architecture since the early 2000s.

Why It Matters

First, security is at stake. Every unpatched vulnerability is a potential entry point for attackers, and the sheer volume of legacy code makes manual audits impractical. AI‑driven detection can prioritize the most dangerous flaws, allowing security teams to focus resources where they matter most. In the case of the CSP misconfiguration highlighted by Occhino, fixing the issue prevented a class of attacks that could have compromised thousands of websites simultaneously.

Second, performance and sustainability are directly linked to code quality. Faster pages consume less energy, reduce server load, and improve user experience, especially on mobile networks. By automating the identification of bloat and inefficiency, AI helps developers meet modern performance standards without sacrificing functionality. In an era where carbon footprints are scrutinized, even modest improvements across millions of sites translate into measurable environmental benefits.

What Happens Next

Industry leaders are already acting on these insights. Vercel, for instance, is integrating AI‑powered static analysis into its deployment pipeline, automatically rejecting builds that contain high‑risk patterns. Occhino envisions a future where “AI‑first” tooling becomes a baseline requirement for any public-facing web project, much like HTTPS is today. He also advocates for a shared “slop index” that would rank libraries based on the amount of technical debt detected by AI, giving developers a transparent metric to guide their dependency choices.

Beyond tooling, there is a cultural shift on the horizon. As AI continues to expose hidden flaws, developers may be incentivized to write cleaner, more self‑documenting code from the outset. Educational programs are beginning to incorporate AI‑assisted linting into curricula, teaching new engineers to view AI not as a replacement but as a collaborator that enforces best practices. Over time, this could lead to a healthier code ecosystem where the “human slop” that once plagued the internet is systematically reduced.

In conclusion, the rise of AI as a code auditor is more than a technological novelty; it is a necessary response to decades of accumulated software rot. By illuminating the hidden weaknesses in the internet’s foundation, AI empowers developers, security teams, and platform providers to act decisively. The challenge now is to harness this power responsibly, turning the exposure of “human slop” into an opportunity to rebuild a faster, safer, and more sustainable web for everyone.