AI-generated code, Shadow Dev and technical debt: how to avoid destabilising your PHP/Symfony application

Olivier

13 Aug 2026

The emergence of AI assistants (Copilot, Claude, Cursor, OpenAI, Google Gemini) has brought about a revolution: producing code 5 times faster, shrinking backlogs and accelerating Time-to-Market.

But a few months after these tools were rolled out on a massive scale, a silent backlash is taking place in many companies: an explosion of technical debt, amplified by the emerging phenomenon of Shadow Dev.

It is the classic house-of-cards analogy: shipping features at full speed gives an immediate sense of efficiency, but if the architectural foundations are not under control, the whole structure ends up weakened.

"Shadow Dev": when AI bypasses IT department processes

After Shadow IT (the use of SaaS tools not approved by IT), here comes the era of Shadow Dev.

In the past, developing a small business feature or an automation script required advanced technical skills and sign-off from the IT department. Today, a marketing profile, a project manager or a junior developer can generate a complete script in a few clicks thanks to AI assistants.

A business need arises,
An employee creates a "Quick & Dirty" solution via an LLM,
The code is put into production without an architecture review,
The application becomes critical… but nobody knows how to maintain it.

The problem? These "under the radar" developments completely escape the company's security standards, integration tests and governance. When they eventually get integrated into the main application platform, they inject a colossal amount of technical debt into it.

The "Illusory Code" syndrome: the pitfalls of AI

Even within official development teams, AI has three major structural limitations if it is not strictly managed:

No systemic vision: AI solves a localised problem (a controller, a class, a script) without understanding the overall Symfony architecture, your DDD principles or your business constraints.
The "It works" illusion: the generated code works in basic local tests but hides critical scalability flaws (N+1 SQL queries, poor Redis cache management, memory leaks).
Loss of intellectual ownership: passively approving large AI-generated Pull Requests (PRs) erodes developers' detailed knowledge of their own codebase.

4 warning signs of a destabilised application platform

Shadow Dev takes over: you discover scripts or pieces of code in production that the architecture team did not know existed.
Frequent regressions with every release: adding a simple feature breaks another because of tight coupling generated by AI.
Unexplained server slowdowns: CPU/RAM consumption soars during traffic peaks because of unoptimised database queries.
Fear of version upgrades: considering a migration to the latest versions of Symfony or Ibexa DXP becomes a taboo subject because the code has become so heterogeneous.

Taking back control: establishing "Code & AI" governance

The goal is not to ban AI — it is a tremendous productivity lever — but to put strict guardrails in place to reconcile speed and stability.

Channel Shadow Dev: give business teams a secure framework so they can express their needs without injecting "wild" code into the information system.
Strengthen your CI/CD (automated guardrails): automate the detection of non-compliant code through strict static analysis rules (PHPStan at max level, SonarQube, Rector and automated security audits).
Keep senior human review paramount: require a rigorous code review for any PR that includes AI suggestions.
Carry out a technical health check (audit): have a neutral outside eye assess the real state of your platform to map the accumulated debt and invisible ghost developments (Shadow Dev).

Regain control of your web ecosystem

The true value of a technical team is not measured by the number of lines of code produced per day, but by the robustness, security and longevity of the information system.

At Code Rhapsodie, we help companies and large enterprises regain control of their PHP, Symfony and Ibexa DXP platforms. Our Code Audit, Post-AI & Governance offering cleans up technical debt, detects Shadow Dev and establishes sound engineering practices.