Hidden AI-code debt — detect, attribute, and make AI-produced code auditable

Software teams are increasingly accruing "AI-code debt"—snippets and modules introduced by copilots and code generators whose provenance, licensing, test coverage, and ownership are unknown. This problem hits engineering managers, security/compliance teams, SREs, and procurement alike: they must trace who introduced code, what model produced it, and whether it meets internal and regulatory standards, across an estimated 3 million software teams globally. Left unaddressed this raises measurable risk in audits, incidents, and vendor assessments. You could build a developer-facing platform that detects likely AI-generated code, attributes it to a specific model or prompt fingerprint, records file-level provenance into an auditable SBOM and commit metadata, and integrates with IDEs, CI/CD, and VCS to enforce policies and produce attestations. The timing is favorable: a $30.0B addressable market (3M teams × $10K ACV), broad copilot adoption, a shift toward "observability everywhere," and rising procurement/regulatory emphasis; analysts rate the opportunity highly (Market Score 92/100, Revenue Potential 86/100). To stand out, focus on low-friction integrations, deterministic provenance recording (signed attestations), and a hybrid detection stack combining static analysis, model fingerprinting, and runtime telemetry so false positives remain low while auditability is strong. Be honest about limits: detection is probabilistic, adversaries can obfuscate provenance, privacy and IP concerns complicate telemetry, and sales cycles will skew toward regulated enterprises; competition is medium, so execution on accuracy, UX, and enterprise integrations will be the critical differentiator.