What Happens When AI Agents Maintain Legacy Code?

The new maintainer in the old codebase

Legacy code has always been a paradox. It is old, disliked and expensive to change, yet it often runs the most important parts of a business. Billing systems, reporting jobs, warehouse pipelines, authentication flows, mainframe adapters and forgotten integration scripts may look ugly in a repository, but they encode years of customer commitments, regulatory compromises and production incidents.

That is why AI agents are suddenly attractive. Unlike a human developer, an agent does not get bored reading a 20-year-old module, tracing call paths or generating the hundredth regression test. Unlike older code assistants, today’s agentic tools can plan a task, inspect multiple files, run commands, revise their own patches and hand a diff to a reviewer. Current examples show the pattern moving from theory into practice: NVIDIA described an agent-driven workflow for rewriting Apache Spark user-defined functions into GPU-accelerated equivalents, with testing, conversion, benchmarking and optimization in the loop [1].

The promise is obvious: agents can reduce the archaeology tax. The danger is just as obvious: legacy code is not only code. It is a record of business behavior, some of it undocumented, some of it accidental, and some of it absolutely required.

What agents can do well

The safest starting point is investigation. A legacy agent can map modules, identify entry points, summarize data flows, list external dependencies and point to areas where tests are missing. AIDLC’s legacy-code guidance puts this first: build context, make behavior visible, then change small pieces rather than asking an agent to rewrite a system in one pass [2].

This “software archaeologist” role is valuable because old systems often lack living documentation. An agent can scan repository structure, comments, configuration, tests and commit history faster than a person. It can draft architecture notes and ask pointed questions: why does this branch exist, which customers hit this path, what job runs at month-end, and which table appears unused but is still read by a downstream export?

Agents also shine on repetitive, checkable maintenance. Framework upgrades, dependency updates, mechanical refactors, dead-code candidate lists and test generation all fit the profile. NVIDIA’s Spark example is especially revealing because it is not a vague “AI writes code” story. The workflow targets a specific bottleneck: Spark UDFs can force GPU-accelerated pipelines back to CPU execution because the optimizer cannot inspect arbitrary user code [1]. NVIDIA’s proposed agent workflow moves through scaffolding, testing, conversion and benchmarking, and the company reported that one rewrite reduced operator time from 274.55 hours to 12.78 hours across a 600-billion-row workload [1].

That is the kind of legacy work agents are best suited for: bounded, measurable and governed by a verifier. The verifier may be a test suite, a benchmark, a compiler, a type checker, a parity harness or a domain expert. Without a verifier, speed is not productivity; it is faster uncertainty.

The old problem: the repository is not the system

The central failure mode is not hallucination. The agent may understand the code perfectly and still misunderstand the system.

A legacy billing branch may look redundant because no current requirement mentions it. In reality, it may preserve a price cap for a long-standing customer. A strange retry delay may look like bad engineering but may have been introduced after a production incident. A nullable field may look unused in the application but may feed a quarterly finance export. An agent reading only the repository sees syntax, references and tests. It may not see contracts, support tickets, incident reports, audit decisions, deployment rituals or the institutional memory of the one engineer who knows why the ugly part exists.

This is why context engineering becomes maintenance engineering. AIDLC’s guidance recommends reviewed architecture notes, links to tickets and incident history, and a “context graph” that gives agents more than isolated files [2]. The important word is “reviewed.” An agent summary of an old subsystem is a hypothesis, not an authority. If no human has checked it, the organization has not gained knowledge; it has gained a confident document.

Tests before transformation

The most practical rule is old but newly urgent: characterize behavior before changing it. A characterization test records what the system does today, not what the team wishes it did. That distinction matters because legacy systems often contain bugs that customers, reports or integrations have learned to depend on.

Agents can help generate these tests quickly. They can exercise inputs, capture outputs and create a regression net around code that previously had none. But generated tests must themselves be reviewed. A test that merely asserts that a function returns something, or mirrors implementation details without checking meaningful behavior, creates false safety. AIDLC’s legacy-code playbook recommends characterization tests before agent changes and warns against mixing refactoring with behavior fixes in the same change [2].

This is where the AI maintainer changes the team’s workflow. The first task is not “modernize this module.” The first task is “show me what this module does, where that behavior is observed, and what would fail if it changed.” Only then should the agent refactor, upgrade or replace.

Why the enterprise debate is getting sharper

The conversation is no longer limited to developer productivity. JPMorgan’s October 2026 earnings-call coverage shows how large enterprises are thinking about agents as both an internal productivity tool and an operational risk. The bank described internal AI-agent use, referenced early software-engineering productivity evidence including legacy-code rewrites, and also emphasized concern about “rogue agents” and external agents entering the company’s environment [3].

That tension is exactly what legacy maintenance exposes. If agents are powerful enough to rewrite old systems, they are powerful enough to break them. If they can run tests, open pull requests and call tools, they also need identity, permissions, audit trails and boundaries. The question becomes less “Can the model do it?” and more “Under what authority, with what evidence, and who is accountable?”

Developer infrastructure is another pressure point. DX Today reported that Anthropic built and migrated to its own version-control system after AI-driven code activity overwhelmed infrastructure designed for human-paced development; the report said merged code changes rose from about 2,500 per day in May 2026 to more than 30,000 per day by September [4]. Most companies will not see Anthropic-scale numbers, but the lesson generalizes: agent-generated maintenance can multiply review queues, CI costs, merge conflicts and operational noise [4].

For legacy systems, that matters because the bottleneck is rarely typing code. It is validating change. If agents create ten times as many diffs but the organization has the same number of people who understand the system, risk accumulates in the review queue.

A safer operating model

The emerging answer is risk-tiered autonomy.

Low-risk work can be delegated more freely: documentation updates, dependency inventories, dead-code candidate reports, test drafts and read-only code archaeology. Medium-risk work can include mechanical upgrades, narrow refactors and noncritical bug fixes, but only with tests, human review and rollback plans. High-risk work—payments, authentication, data migrations, compliance logic, production infrastructure and customer-specific behavior—should remain human-gated even if an agent drafts the patch.

This is not anti-automation. It is how automation becomes usable. NVIDIA’s UDF workflow is persuasive because it pairs code conversion with verification and benchmarking [1]. AIDLC’s guidance is persuasive because it tells teams to preserve behavior first, change in small batches and avoid big-bang rewrites [2]. JPMorgan’s posture is persuasive because it treats agents as useful but not borderless [3].

A mature AI-maintenance program should therefore include several artifacts: a reviewed system map, characterization tests, risk tiers, agent permission profiles, CI gates, audit logs, rollback plans and documented decisions. Each artifact turns agent output from “trust me” into evidence.

What happens to developers?

Developers do not disappear from legacy maintenance. Their work shifts upward.

They spend less time manually tracing every caller and more time judging whether the trace is complete. They spend less time writing boilerplate tests and more time deciding which behaviors matter. They spend less time performing repetitive migrations and more time designing the sequence, rollback and verification strategy. In other words, the human role moves from typist to accountable maintainer.

That shift creates a skills problem. Junior developers traditionally learned systems by doing small fixes. If agents take all small fixes, teams must deliberately create learning loops: pairing developers with agents, requiring explanation of diffs, rotating review ownership and keeping documentation close to code. Otherwise, the organization may gain short-term throughput while losing the human understanding needed to supervise the agents later.

The bottom line

When AI agents maintain legacy code, the best outcome is not a fully autonomous robot janitor. It is a faster, more disciplined maintenance loop: agents map, test, propose and benchmark; humans supply intent, priority and accountability.

The worst outcome is different. A team points an agent at a fragile system, accepts a plausible diff, and discovers that an “obvious cleanup” removed a business rule nobody had written down.

As of October 2026, the practical answer is clear. AI agents can already help maintain legacy code, especially when the work is repetitive, bounded and verifiable. But legacy maintenance is not only a coding problem. It is a knowledge-preservation problem. The organizations that win will not be the ones that let agents change the most code. They will be the ones that make old behavior observable before letting agents change anything at all.

Sources from the last 72 hours

1. [1]How to Rewrite Apache Spark UDFs for GPU Acceleration with AI AgentsOct 13, 2026, 2:00 AM
2. [2]AIDLC on Legacy Code: Using AI Agents on Brownfield SystemsOct 13, 2026, 2:00 AM
3. [3]JPMorgan Expands AI Agent Use While Blocking External AccessOct 14, 2026, 9:05 AM
4. [4]DX Today AI Newsletter | October 14, 2026Oct 14, 2026, 3:00 PM

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.