AI coding costs could exceed software developer salaries by 2028, according to new research from Gartner, prompting calls for a greater focus on cost optimization efforts.

The projection by the consultancy is a result of two overlapping trends, including surging token consumption rates and the shift to consumption-based pricing (CPB) models.

A host of software and AI providers have pivoted away from flat rate “per-seat” subscriptions in recent months to CPB setups. As ITPro reported in April, GitHub signalled its own shift on this front, citing rising costs specifically as a key factor behind the decision.

Speaking to ITPro, Nitish Tyagi, Senior Principal Analyst at Gartner, said conversations with clients shows this is rapidly becoming a key concern for enterprises, particularly software engineering leaders as teams ramp up adoption of tools.

“What has happened is that most vendors have switched to a consumption-based pricing model, and it took most engineering organisations by surprise,” he said. “We were never thinking that AI will be this costly, and we are already seeing that cost.”

“Initially, it wasn't alarming,” Tyagi added. “While many organizations are still in the range of $200 to $500 per developer per month, alarming results are coming up.”

Tyagi noted that discussions with Gartner clients show heightened use of AI is costing more than $2,000 per developer, per month. These costs are rising as well, with some eye-watering figures now emerging.

“I’ve been talking to clients where they are telling me that my power users are now costing me more than $2,500 per developer, per month. Sometimes we also hear really crazy numbers, like ‘my developer cost me $20,000 last month, or my business users cost me $32,000 per month.”

Reports on surging AI costs have been coming thick and fast in recent months, and some major firms such as Microsoft have gone so far as to implement usage limits or even cut the use of specific tools internally.

As ITPro reported earlier this month, Uber blew through its entire annual AI budget in just four months after encouraging staff to ramp up their use of AI tools internally.

One of the leading causes behind these price increases and hefty bills lies in ‘tokenmaxxing’ – a trend in which enterprises measure AI usage based on the number of tokens consumed by users.

For some, it’s a way of tracking productivity by highlighting their use of the technology, although critics argue this pads stats and results in skewed metrics.

These overlapping trends raise serious concerns about long-term AI usage, particularly around returns on investment (ROI). Simply put, enterprises want their devs using AI, but heightened costs mean that measuring value is becoming more difficult.

“This is becoming a big issue from two aspects,” he told ITPro. “It’s not only related to developer salaries. This will catch the eyes, but the bigger problem here is that organizations were already struggling and justifying ROI for using these tools.”

“Now that the cost has increased, and it is increasing as well, it is becoming even more difficult to justify these costs and to identify where the ROI is.”

Cost optimization practices need to improve

Tyagi is keen to emphasize that the study doesn’t suggest that developers drop AI tools or agents outright. This completely misses the point, he said.

Instead, engineering leaders and enterprises at large need to sharpen up on cost optimization processes. Efforts on this front are critical, particularly as the study noted that vendors themselves are “yet to deliver mature, built-in cost optimization capabilities” for agents.

A key practice highlighted by Tyagi includes context engineering. This is a technique that involves selectively curating, structuring, and managing information used by AI systems to generate responses.

This essentially involves providing only the relevant information needed by agents, as well as concise summarization of content and elimination of "unnecessary data”

Tyagi noted that this will not only help optimize token consumption for developers, but ultimately deliver longer term benefits in terms of output quality.

“Context engineering is going to become the most important skill in the future,” he told ITPro. “If I actually optimize token consumption, the I would be able to increase the output quality as well.”

This is an emerging focus area for software engineering leaders, Tyagi added, and Gartner suggests that context engineering practices could eventually be mandated to cut consumption rates.

It’s also a blossoming market, he noted. Tabnine, for example, recently launched a new solution known as “Context Engine” aimed at streamlining processes on this front while Atlassian is also developing solutions in this domain.

Selective use

Gartner’s research also urges enterprises to establish a “use-case-driven decision” framework when it comes to using AI for everyday tasks.

Simply put, the focus here should be on clearly defining when AI coding agents should be used, and how much autonomy these bots are given on particular tasks. Given the increasing use of agents among developers, many are simply allocating tasks that aren’t needed.

“Not everything has to be done by an agent, not everything has to be done by developers,” he said.

Looking ahead, developer teams should assess when - and when not to - assign agents to specific tasks, which Tyagi noted could help cut needless consumption and ultimately provide greater control.

“When you’re working on highly sensitive tasks or highly complex tasks, then you want your developers to break down those tasks as well into smaller sub tasks,” he explained.

“We have seen when you are throwing smaller clues, problems at agents, agents do much better than giving them an open-ended problem,” Tyagi added. “Agents are improving, but I think developers should have that level of control right now, through which they can actually optimize the token consumption.”

It’s here that model selection is equally important, according to Gartner, specifically for smaller tasks, which can naturally be handled by smaller models.

Using “intelligent model routing” strategies will enable developers to box clever when it comes to smaller, niche AI models or larger frontier options, which typically come with added costs.

The consultancy noted that escalation is needed “only when complexity demands it”.

FOLLOW US ON SOCIAL MEDIA

AI code generation is running out of control, with eight-in-ten organizations adopting AI tools faster than they can develop policies to govern them, new research has warned.

According to GitLab's AI Accountability Report, 92% are facing governance challenges with AI-generated code as rapid adoption continues.

More than nine-in-ten have two or more AI coding tools in active use, the study found, while 54% have three or more. Meanwhile, 78% report that developers are writing and committing code faster since adopting AI tools.

Teams are generally happy with the results, with six-in-ten saying that the ROI of AI coding is better than they'd expected. More than three quarters (78%) also report faster code output and 73% said overall code quality has improved.

However, while 79% agree that individual developer productivity has improved with AI, the overall software delivery process has not accelerated at the same pace.

Indeed, 82% say that AI-generated code risks creating a new form of technical debt that organizations aren't prepared to manage.

"AI coding tools have delivered on their promise of speed," said Manav Khurana, chief product and marketing officer at GitLab.

"But the events of the past few months, including supply chain attacks, reliability issues, and regulators tightening expectations around AI traceability and provenance are making clear that speed without control is a liability, not an advantage."

AI coding is creating new bottlenecks

Notably, 85% agree that AI has shifted the bottleneck from writing code to reviewing and validating it, and 84% that the biggest challenge with AI-generated code is governing what happens to it after it's created.

Nearly-three quarters are concerned about the maintainability of AI-generated code in their organization's codebase.

GitLab also raised concerns about a prevailing trend of overconfidence when it comes to AI coding. The majority (87%) said they’re confident that teams could determine within 24 hours whether AI-generated code contributed to a production incident, for example.

Yet more than one-third (34%) of organisations fail to spot potential issues before an incident took place.

This appears to be down to difficulty distinguishing AI-generated from human-written code (43%), fragmented toolchains (40%), and systems that don't track code origin (39%).

Only 28% say their software development lifecycle (SDLC) tools are fully integrated with shared data and workflows.

New governance practices are needed

According to GitLab, what’s missing is clarity around governance. The majority (83%) of organizations identify AI-generated code accumulation as a risk to manage now, with 44% calling it a top technology risk.

On the upside, 91% of survey respondents said they are likely to invest in AI code governance tools in the next 12 months, and 98% have already allocated or expect to allocate budget toward these efforts.

Crucially, 85% agree the next phase of AI in software will focus less on generating code and more on governing it.

"The teams thinking ahead are already asking the harder question: can we actually control all the code we’re generating?" said Khurana.

"The organizations that will ship trusted software faster are the ones building the foundations of accountability with context, traceability, and governance baked into the platform, not just bolted on after the fact."

AI governance has been a persistent challenge for developers, with research from Aikido last year concluding that AI-generated code is now the cause of one-in-five breaches.

The study noted that 69% of security leaders, engineers, and developers had identified serious vulnerabilities in AI-generated code.

FOLLOW US ON SOCIAL MEDIA

The accelerating use of AI in software development has led 60% of global organizations to ship untested code, prompting warnings over potential security risks.

According to Tricentis' 2026 Quality Transformation Report, the proportion has dropped only slightly since 2025, when it was 63%.

Crucially, the reasons behind the volume of untested code have changed. Last year, the company attributed much of this to accidental quality control slips, cited by 40%.

Now, though, 32% of organizations admit that they are doing it knowingly, mainly because of leadership pressure to prioritize speed over quality. Three-in-ten blamed the sheer volume of AI-generated code, which is overwhelming quality control and testing processes.

“Accelerating business transformation initiatives is one of the top priorities for today’s C-suite and AI has the potential to help software development teams move faster than ever before,” said Kevin Thompson, CEO of Tricentis.

“However, with increased speed comes increased risk. When software quality processes fail to keep pace with development speed, organizations often respond by taking shortcuts that materially degrade or reduce confidence."

Poor code quality is now a global problem

The problem was found right across the board, with more than half of organizations across every major industry surveyed reporting deploying untested code to production.

The trend was most prevalent in financial services (64%), retailers (63%), and energy and utilities (58%).

Governance is also suffering, the study noted. While 48% of organizations have fully implemented AI internally, more than half of those report that their AI tools and processes regularly change.

Similarly, a third of teams cite tool complexity and sprawl as a key barrier to achieving continuous software quality at scale.

Other top barriers include skills gaps, cited by a third, code volume increasing faster than they can manage (28%), and a lack of clear quality and trust metrics (26%).

Conflicting priorities put enterprises at risk

Notably, researchers said what’s considered AI progress in the boardroom may feel more like operational friction to software teams, highlighting a growing divide between the C-suite and frontline workers.

Just over four-in-five CEOs reported high confidence in AI-driven systems and tools, compared with just 56% of QA and DevOps professionals.

Similarly, 44% of C-level executives believe their business is very prepared to operationalize, govern, and scale AI agents across the SDLC, compared with just 23% of QA and DevOps professionals.

While 83% of organizations trust agentic AI to make release decisions and 82% say they are prepared to operationalize and govern AI agents at scale, many continue to struggle with untested code (60%), tool sprawl (33%), security concerns (27%), skills gaps (24%), and data quality issues (24%).

Poor quality hurts the bottom line

Naturally, there's a financial cost associated with this poor software quality. Around one-in-five organizations report losing more than $1 million annually as a result, mainly because of security and compliance failures (30%) and technical debt and rework (28%).

"As risks like financial performance and customer trust become more visible and measurable, software quality can no longer be treated as just an engineering concern. It must become a boardroom imperative," said Thompson.

“As development accelerates, leaders need clearer visibility into software quality risk and stronger alignment between engineering, QA and the broader business. The organizations that succeed will be the ones that can scale speed and control together.”

FOLLOW US ON SOCIAL MEDIA

Software developers are reporting marked productivity gains with AI, yet new research from Harness shows the use of the technology is creating greater downstream challenges.

Findings from the company’s 2026 State of Engineering Excellence report suggest areas such as code quality and validation are being overlooked since the mass-integration of AI, and it’s creating bigger workloads and leading to higher levels of burnout.

“AI adoption is now the default in engineering organizations, and self-reported impact is overwhelmingly positive — but the cost is accumulating in places organizations aren't watching,” the company said in a blog post.

Indeed, Harness found that many developers are now spending more of their day on manual remediation tasks. Around 81% said they spend more time in code reviews since before the adoption of AI tools, for example.

More than one-quarter (28%) reported spending 30% longer on these tasks on average, according to Harness.

Worse still, nearly one-third of that activity isn’t tracked by teams, creating a trend of “invisible work”.

Organizations estimate that roughly 31% of developer time is now consumed by invisible work, which typically involves reviewing AI-generated code, fixing bugs, and switching between disparate tools.

Trevor Stuart, SVP and General Manager at Harness, said the findings show that while AI is not only changing how developers build, but how they spend their working day.

This, Stuart noted, means organizations need to overhaul how they measure developer productivity to compensate for changing workflows.

"Cloud and the internet were infrastructure revolutions layered underneath the developer,” he said.

“AI is reshaping the developer's job entirely, and the measurement frameworks that the industry has relied on for the past decade weren't built for this new unit of work."

Changing developer metrics

Harness noted that previous frameworks for measuring productivity and efficiency simply aren’t able to keep up with current AI-fueled working patterns.

Around 89% of tech leaders still trust metrics that don’t accurately reflect AI’s impact on individual developers or teams at large.

Moreover, 94% said key considerations such as tech debt and developer burnout rates are missing from metrics, painting a convoluted picture of overall performance which fails to scratch the surface.

“The biggest AI challenge is measurement itself,” the company noted in a blog post detailing the findings.

“When asked to name the single biggest challenge, the top answers are all visibility problems: measuring true productivity impact (26%), maintaining code quality with AI (24%), and proving ROI to leadership (18%).”

Measuring developer performance

According to Harness, changes to how performance is tracked needs to take AI into account.

The company recommends that enterprises approach this by considering the impact of tasks such as code validation, as well as the overall quality of code produced by AI tools.

This, the company noted, will paint a clearer picture on how workloads are changing due to new follow-up tasks created by AI.

Organizations should also “treat AI performance as its own discipline”, the study noted. This includes tracking AI agent accuracy, acceptance rates of AI outputs, and costs associated with the tools separately from human developer output.

Developers should also be given a say in how performance is measured due to the influx of AI tools, according to Harness. Nearly half (49%) of developers said they want to be involved in defining metrics themselves.

This is crucial, the report noted, largely because there’s a growing perception gap on how AI is actually impacting teams.

Managers, for example, are nearly four-time more likely to report no concerns on how productivity metrics are measured compared to frontline practitioners.

FOLLOW US ON SOCIAL MEDIA

Anthropic is joining forces with SpaceX to increase the AI developer's compute capacity – and that means Claude Code usage limits are set for a huge boost.

As part of the deal, SpaceX will permit Anthropic to use all of the compute capacity at its Colossus 1 data center in Tennessee, originally built for Musk's own AI firm, xAI.

"This gives us access to more than 300 megawatts of new capacity (over 220,000 NVIDIA GPUs) within the month," Anthropic said in a blog post.

That increase allowed Anthropic to raise usage limits, removing some peak-time restrictions, and boosting rate limits for APIs.

"This, along with our other recent compute deals, means that we’ve been able to increase our usage limits for Claude Code and the Claude API," the statement added.

Claude Code usage limits explained

Anthropic is making three key changes to usage limits, all targeted at making life easier for its “most dedicated customers".

To start, the company is doubling Claude Code's five-hour rate limits, meaning users will be able to make more prompts and write more code in each five-hour rolling session.

That applies to Pro, Max, Team and seat-based Enterprise plans, the company confirmed.

Next, Anthropic is removing its peak hours limit reduction on Claude Code, allowing Pro and Max users to operate the same across peak and off-peak times.

Elsewhere, Anthropic is raising its API rate limits for Claude Opus models by more than an order of magnitude. For example, tier 1 users previously had 30,000 maximum input tokens per minute, and will now have 500,000.

The move by Anthropic follows other AI companies tightening up on token usage. Last week, for example, GitHub changed its pricing model for Copilot to focus on consumption rather than credits.

GitHub said the move comes in direct response to skyrocketing compute and inference demands over the last year.

Rapid compute expansion

Anthropic pointed to a range of recent announcements designed to expand compute capacity. The AI developer has signed deals with Amazon, Google, Broadcom, Microsoft, and Fluidstack, all aimed at upping capacity to contend with skyrocketing user demands.

"We train and run Claude on a range of AI hardware — AWS Trainium, Google TPUs, and Nvidia GPUs — and continue to explore opportunities to bring additional capacity online," Anthropic added.

Anthropic revealed it is also working to ensure customers outside the US had access to local infrastructure, saying some of its capacity expansion would be international. In particular, the deal with Amazon would include "additional inference" in Asia and Europe.

"Our enterprise customers — particularly those in regulated industries like financial services, healthcare, and government — increasingly need in-region infrastructure to meet compliance and data residency requirements," Anthropic said.

In the US, Anthropic and other AI companies agreed to cover the cost of consumer electricity prices caused by their data centre rollouts. Anthropic said it was looking for ways to "extend that commitment to new jurisdictions".

"We’re very intentional about where we’ll add capacity — partnering with democratic countries whose legal and regulatory frameworks support investments of this scale, and where the supply chain on which our compute depends — hardware, networking, and facilities — will be secure.”

FOLLOW US ON SOCIAL MEDIA

NordVPN has uncovered a series of active malicious campaigns impersonating the official Google Gemini Command-Line Interface (CLI).

Attackers are creating fake websites, cloned repositories, and deceptive social media posts to trick developers and other users into installing what appears to be an unofficial or early-access version of Gemini’s developer tool.

But instead of delivering legitimate software, the campaigns distribute a reverse shell, giving the attacker complete and unrestricted remote control over the compromised machine, with no further action required on their end.

“AI tools are generating huge interest right now, and attackers are moving fast to exploit that,” said Domininkas Virbickas, product director at NordVPN.

“The payloads being delivered here grant full remote access to a victim’s machine, which makes this a serious threat regardless of how technically sophisticated the target is.”

Fake Gemini tools have Windows and Mac variants

The attack has both MacOS and Windows versions. On MacOS, it starts with a convincing clone of the official Google Gemini CLI web page. This instructs the user to run an innocuous-looking command in their terminal.

However, this command is encoded in the Base64 simple text encoding format, obscuring what it actually does.

"Once decoded, the command downloads a malicious script from a remote server and immediately runs it with the highest administrative privileges available on the system," the researchers said.

"It means the attacker’s code can read, modify, or delete any file on the device, install additional malware, or use the compromised Mac as a launchpad to access corporate networks the device is connected to."

As for the Windows variant, this uses a different delivery method. A PowerShell command, disguised with variable names like $Install=’GeminiCLI’ to look like a legitimate software setup process, connects to a remote server and executes malicious code directly in the device’s memory.

Running code in memory rather than writing it to disk - a fileless attack - evades traditional antivirus software that scans files for known threats.

As well as these direct attacks, NordVPN’s researchers also found a typosquatting operation targeting the npm ecosystem. Fake package names, including gemini/cli and gemini-cli, were registered or under preparation to mimic the official google/gemini-cli package.

"The strategy exploits a common habit among developers of omitting the organization prefix when searching for or installing packages," the researchers warned.

"Although the fake package had not yet appeared in the npm registry at the time of analysis, its preparation signals an active and imminent threat. Once published, any developer who installs it by mistyping the package name could unknowingly execute malicious code."

How to stay safe

NordVPN advised users to be wary of any website, forum post, or social media message offering early or unofficial access to developer tools. They should stick to official sources - and, in this case, that's just the official Google repository.

Never run a terminal or PowerShell command you didn't write yourself unless you fully understand what it does, the firm warned, pointing out that legitimate software installers don't ask users to copy and paste commands from a webpage.

Similarly, developers should verify package names in full before installation, including the organization prefix - the official package is google/gemini-cli, not gemini/cli or gemini-cli.

Nord also adviased using security software that includes behavioral detection, not just file-based scanning. Fileless attacks are specifically engineered to bypass traditional antivirus tools.

ITPro approached Google for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

GitHub is changing how it charges for Copilot usage, claiming that some users haven't been paying the full cost for AI.

Currently, GitHub Copilot uses a premium request unit (PRU) billing system, giving subscribers a set number of credits to spend for more complex queries.

The pricing scheme was introduced last year as a way to limit access to top models.

In a blog post detailing the move, GitHub’s chief product officer Mario Rodriguez said because Copilot has added new features, the company is contending with far higher compete and inference demands.

"Today, a quick chat question and a multi-hour autonomous coding session can cost the user the same amount," said Rodriguez.

"GitHub has absorbed much of the escalating inference cost behind that usage, but the current premium request model is no longer sustainable."

GitHub said that usage-based billing will better align pricing with how Copilot is being used. The new system will replace PRUs with GitHub AI Credits for subscribers, with the option for paid plans to buy more.

How the GitHub Copilot pricing changes will work

Each tier of GitHub Copilot subscription will come with a set number of credits, though paid plans will be able to top up.

"Credits will be consumed based on token usage, including input, output, and cached tokens, according to the published API rates for each model," Rodriguez explained.

Code completions and Next Edit suggestions will be included in subscription plans and not consume AI Credits, the company noted.

"Copilot code review will also consume GitHub Actions minutes, in addition to GitHub AI Credits. These minutes are billed at the same per-minute rates as other GitHub Actions workflows," he added.

Copilot will also end its "fallback" feature, which meant users who ran out of PRUs could fall back to a lower-cost model to keep working.

"Under the new model, usage will instead be governed by available credits and admin budget controls," he said. In short, if you run out of credits, you'll need to buy more.

Indeed, an FAQ document on the changes noted: "Users with intense agentic usage will likely see an increase in costs because those features consume more compute."

Managing costs

The shift to the new system will happen on 1 June, but GitHub will send customers a preview bill in their account Billing Overview page in May to help users and admins understand what their costs will be going forward.

There will be no change to monthly subscription prices, the company noted. A Copilot Business user costs $19/month, and will include $19 in monthly AI Credits.

Meanwhile, Copilot Enterprise will still cost $39/month per user, with $39 in monthly AI Credits.

To help smooth out the shift to the new pricing system, Business users will get a bonus of $30 monthly in AI Credits for June, July, and August, while Enterprise users will automatically get a bonus of $70 a month.

"We are also introducing pooled included usage across a business, which helps eliminate stranded capacity," Rodriguez said. "Instead of each user’s unused included usage being isolated, credits can be pooled across the organization."

That should help businesses give heavy users more credits, with lighter users offsetting the balance, GitHub suggested.

Admins will be able to cap budgets at the enterprise, cost center, and user levels, he added. When pooled credits are exhausted, users can decide whether to buy more or cap spending.

"You’ll have full control over what you spend, tools to track your usage, and the option to purchase more AI Credits if and when you need them," he added.

What does this mean for individual users?

For individual users, those on Copilot Pro and Pro+, their AI Credits will also match their subscription price of $10/month and $39/month, with those on an annual plan staying premium pricing until their subscription expires.

It’s worth noting that model multipliers will increase as of 1 June for those users. Once their plan expires, they'll be converted to Copilot Free and can then upgrade to a paid monthly plan.

Alternatively, annual subscribers can choose to convert to a monthly plan now.

Rodriguez said that temporary changes were made to those plans as well as Free and Student last week, in order to prepare for the new system.

"These were reliability and performance measures as we prepare for the broader transition to usage-based billing," he said. "We will loosen usage limits once usage-based billing is in effect."

FOLLOW US ON SOCIAL MEDIA

Software developers at Amazon Web Services (AWS) are recording marked efficiency gains with AI tools, according to the company’s UK chief.

Speaking at the AWS Summit London, Alison Kay, VP and managing director for the UK & Ireland, told attendees that developers are relying heavily on its own Kiro coding tool to speed up processes.

Indeed, devs at the firm have been able to successfully deliver projects that previously would have been extensive in a far more efficient manner.

“At AWS we needed to completely rebuild the inference engine behind Bedrock from scratch,” she explained. “Now, if you'd asked me two years ago what that would’ve taken, I would’ve said ‘40 engineers, 12 months, and a whole lot of coffee’.”

Using AI, Kay noted this rebuild project was completed by six engineers in just 76 days.

“They weren’t working alone,” she added. “They were working alongside Kiro agents that wrote code, tested it, found bugs, fixed them, and deployed it around the clock. While the engineers slept, the agents kept building.”

AWS announced the launch of Kiro in mid-2025, and since launch has received a series of updates. At the company’s annual re:Invent conference in December 2025, the coding service received a big upgrade with new agentic capabilities.

As ITPro reported at the time, the Kiro Autonomous agent maintains “persistent context” across the development lifecycle, essentially lingering in the background and supporting human developers.

Talking up AI

Much like its competitors, AWS has been keen to emphasize both the capabilities of its own AI tools, but also how staff are using them across the company.

Speaking during a podcast appearance last year, CEO Matt Garman noted around 80% of developers at the firm were using AI “in some way” on a daily basis.

Notably, Microsoft and Google both touted the increasing use of AI-generated source code, which, at the time, Garman suggested was a “silly metric” by which to measure internal AI successes.

“There might be bad code, by the way. Measuring lines of code is never actually the best metric. Oftentimes, fewer lines of code is way better than more lines, so I’m never really sure why that’s the exciting metric that people like to brag about.”

Increased AI use at AWS isn’t restricted to software development, either. Speaking to ITPro at AWS re:Invent in December last year, CISO Amy Herzog revealed security practitioners have ramped up use of agentic AI tools in areas such as CVE attribution and threat detection.

Indeed, Herzog revealed security teams had recorded a “500% increase” in helping practitioners “piece together” information on emerging threats and vulnerabilities.

So far, Herzog noted there has been a “500% increase” in the company’s ability to “piece together information” for security teams on this front.

FOLLOW US ON SOCIAL MEDIA

Organizations are taking a slapdash approach to AI-generated code, with many spending far too little time on oversight, new research suggests.

The vast majority (93%) of respondents to Cloudsmith's 2026 Artifact Management Report said their organization was using AI-generated code, more than twice as many as last year.

Yet despite this sharp increase, around than one-third (31%) spend 10 hours or less per month validating, auditing, or securing it. Indeed, just 58% spend at least 11 hours per month on this front while one-in-twenty said they don't audit AI code at all.

While AI models have become a leading artifact type, only 12% of organizations are managing them using the same security policies and provenance tracking as traditional binaries, such as language packages and operating system libraries.

This is despite the fact that organizations are mostly aware of the risks, with only 17% very confident that AI is not introducing new vulnerabilities into their codebase.

“We are at a huge inflection point in the history of software development. In a matter of months, we’ve gone from, ‘How can AI help me write better code?’ to, ‘How can I help AI write better code?’”, said Glenn Weinstein, CEO of Cloudsmith.

"But at the same time, AI tools are expanding the attack surface, introducing more open source dependencies. And those same tools are being used by malicious actors to find more vulnerabilities in existing libraries, leading to more CVEs.”

Sloppy practices could come back to haunt devs

Poor security practices on this front could have wide-reaching regulatory implications for enterprises, the study warned.

Under the EU’s Cyber Resilience Act (CRA), organizations are required to provide a detailed assessment 48 hours after becoming aware of a breach – and this includes providing provenance data.

More than half (53%) of respondents told Cloudsmith they'd need to put in a significant amount of manual effort or time to produce a comprehensive report of artifact versions, origins, and security attestations.

Only a quarter of engineering teams automatically generate and verify Software Bills of Materials (SBOMs) at every build, with the rest doing it manually, reactively, or only when an auditor asks.

Notably, nearly three-quarters (74%) said they'd struggle to produce a complete report quickly if they were hit with a surprise audit tomorrow.

The majority (83%) run outdated artifact management systems, often because they're worried that upgrading is risky or painful.

Software supply chain threats are growing

Weak software supply chain security has become a high-profile issue over the last year, not least with the Axios npm compromise that hit earlier this month.

With threat campaigns including Shai Hulud 2.0 and SANDWORM_MODE specifically targeting the software supply chain via upstream repositories, 44% of respondents said they'd experienced a security incident caused by a third-party dependency.

The same number said their organization spent over 50 hours per month investigating potential security issues linked to third-party dependencies, whether or not they resulted in a breach.

“Agentic development is an incredibly powerful way to build software, and teams will be far more productive and write even more software as a result. That is a good thing, because the world certainly needs more software and more automation," said Weinstein.

"For enterprises to manage this new velocity and productivity, automated guardrails and context are the new keys to unlock the production of safer, more efficient code.”

FOLLOW US ON SOCIAL MEDIA

Salesforce CEO Marc Benioff still believes AI is nowhere near capable of replacing software engineers, and the proof is in the fact that many major industry players are still hiring for roles in this domain.

Speaking during a recent podcast appearance, Benioff said that AI is undoubtedly having a positive impact on software engineering, enabling teams to ramp up production and unlock significant productivity gains.

The technology isn’t a silver bullet and an excuse to reduce headcount, however.

Human workers remain critical and many big tech companies leading the charge in AI are still hiring in areas like software engineering – a trend he said acts as the “canary in the coal mine” for AI’s current capabilities.

“The models still cannot operate autonomously,” he said. “We’re not at that level yet of AI.”

“Our engineering organisation is probably more than 30% productive, but I wouldn’t call it 100% more productive, and that’s why even in the top AI companies, if you go to their job boards, you’ll see they are still hiring a lot of engineers,” Benioff added.

“Even though these top AI companies … have these unbelievable models, they need a lot of humans. That’s probably the canary in the coal mine that we know that the models are not at that level yet.”

Statistics from TrueUp, a platform that tracks open positions in the tech sector, shows engineering job openings have been trending upward slightly over the last two years.

Yet despite continued demand - albeit mild compared to pre-2023 levels - concerns about the impact of AI on entry-level roles have been rising.

Analysis from IDC in November 2025 warned entry-level roles will be among the hardest hit by AI adoption, and developers have been firmly in the crosshairs with this trend.

The changing face of software engineering

The influx of AI tools in software engineering has precipitated significant change in the profession over the last two years. In late 2024, for example, Gartner warned anywhere up to 80% of engineers will be forced to upskill to accommodate for changing skills requirements.

In January last year, Benioff himself proclaimed that the company “might not hire any software engineers” due to the advances in generative and agentic AI tools.

Despite that bold claim, Benioff said the CRM giant still has over 15,000 engineers globally, which has given the company a vital insight into how the technology is changing daily workflows.

When asked about whether AI would mean engineers need to become “generalists”, Benioff noted that many are now acting in a supervisory capacity managing agents working away in the background.

“The key thing about these 15,000 engineers, they’re all out there all over the world, all of them can now be hugely augmented with these coding tools,” he said.

“It could be Anthropic 4.6, it could be OpenAI Codex, it could be Cursor,” Benioff added. “But they start to use these models, they’re now working not only with the AI, but agents to help them code and they can even become somewhat supervisory over these agents.”

The use of AI still requires humans in the loop to ensure security and safety standards are maintained, however. This has become a recurring talking point with the rise of AI coding over the last 18 months. Indeed, a slew of studies highlighting AI-generated code flaws and the need for more hands-on supervision by developers.

Research from CodeRabbit in December, for example, found that although AI is helping improve developer productivity, the efficiency gains are being offset by flawed code and security issues, with many facing increased levels of manual remediation.

The situation with agents is no different. Workers across a range of professions are now managing these autonomous bots and encountering higher workloads.

Six in 10 knowledge workers who manage agents told Asana their roles are made more difficult due to “confidently wrong outputs”, highlighting the need for robust safeguards and supervision.

FOLLOW US ON SOCIAL MEDIA

Microsoft's retirement of a key OS deployment (OSD) tool is forcing admins into a scramble to find new tools – and the cloud might not offer all the answers.

That's according to a survey of IT professionals from Recast Software, which found that although 99% say OS deployment is important, 18% are still relying on Windows Deployment Services (WDS) or the now-retired Microsoft Deployment Toolkit (MDT).

The survey highlights the urgency of finding alternatives or replacements, according to David Segura, Senior Software Engineer at Recast.

Part of the drive to find alternatives is down to Microsoft retiring MDT in January, with WDS losing significant features and being partly deprecated.

Segura noted that once the VBScript component is removed from Windows 11 releases – expected to happen next year – MDT will no longer be able to deploy new versions of the OS.

"The organizations that are managing this transition well aren't waiting for MDT to break," Segura said in a blog post. "They're planning now."

The shift to cloud hasn't changed the importance of bare-metal deployment, thanks to ransomware recovery, hardware upgrades, and production imaging at scale, which involves deploying OS builds across large fleets with a custom image, he said.

"With 81% of respondents rating bare-metal or disaster recovery OSD as having a high or critical importance, the urgency is real," Segura said. "Organizations leaning on a retired tool for a critical workflow face compounding risk the longer they wait."

Finding a better way

The results of the poll suggest that teams are moving to more modern management options, with 48% Intune-only and 40% hybrid.

Key pain points remain, however, including maintenance overheads (28%), driver management (25%), speed (20%), and costs (11%) all highlighted in the survey.

"These aren't new problems, but they're persistent ones," Segura said. "The common thread: SysAdmins want OSD to be less work, not more, especially as environments grow more complex."

While companies are shifting to Intune, or a mix of ConfigMgr and Intune, Segura noted that isn't always enough.

"The challenge is that OSD and imaging workflows don't map 1:1 from ConfigMgr to Intune," he said.

"Autopilot handles provisioning for new devices in Intune, but it wasn't designed for bare-metal rebuild or disaster recovery scenarios. Organizations moving to cloud management still need a way to handle those cases."

Next steps for admins

Segura warned that action was needed now, regardless of what alternative your company chooses.

"If your organization is still running MDT, the window to plan a replacement is narrowing," he said.

The first step is to audit your bare-metal OSD dependency to understand which workflows continue to rely on MDT or WDS.

For those switching to cloud management, it's time to audit OS deployment to see anywhere that lacks coverage from existing tools.

"Those are your risk areas," he said.

FOLLOW US ON SOCIAL MEDIA

GitHub has announced plans to begin using customer interaction data to train AI models.

In a blog post detailing the move last week, GitHub’s chief product officer (CPO) Mario Rodriguez said the policy change will come into effect from 24 April onward.

Rodriguez said the move will enable the company to provide more intuitive AI capabilities for developers using the platform.

“By participating you’ll help our models better understand development workflows, deliver more accurate and secure code pattern suggestions, and improve their ability to help you catch potential bugs before they reach production,” he wrote.

Rodriguez noted that the company has already incorporated Microsoft interactions to fine tune model training processes, which so far have delivered marked improvements. Expanding the scheme to other users will support this at scale.

“The improvements we’ve seen by incorporating Microsoft interaction data indicate we can improve model performance for a more diverse range of use cases by training on real-world interaction data,” Rodriguez said.

So what do GitHub users need to know about the policy change?

What data will GitHub use to train AI models?

According to Rodriguez, customer interaction data set to be used by the company spans a range of areas, including:

• Outputs accepted or modified by the user
• Inputs sent to GitHub Copilot (including code snippets)
• Code context surrounding your cursor position
• Comments and documentation you write
• File names, repository structure, and navigation patters
• Interactions with Copilot features (including chat and inline suggestions)
• User feedback on suggestions (thumbs up/down ratings)

GitHub emphasized that there are some data types it will not use in AI model training, which includes interaction data from Copilot Business, Copilot Enterprise, or enterprise-owned repositories.

Similarly, content from issues, discussions, or private repos “at rest” won’t be used by the company - although there is a caveat here.

“We use the phrase “at rest” deliberately because Copilot does process code from private repositories when you are actively using Copilot,” Rodriguez explained.

“This interaction data is required to run the service and could be used for model training unless you opt out.”

Will GitHub share user data?

GitHub insists that data gathered as part of the program won’t be shared with third-party AI model providers or “other independent service providers”.

Notably, the company said that data “may be shared” with GitHub affiliates such as companies in its broader corporate family, including Microsoft.

In an FAQ section linked to the original blog post, GitHub did note that it may “engage service providers to assist with model training” on its behalf, albeit under the condition that this data is used “only for providing services to GitHub”.

What GitHub plans are affected?

The policy change from GitHub applies to specific subscription plans, with users on the aforementioned Business and Enterprise plans exempt.

Similarly, student and teacher accounts for GitHub Copilot are also exempt.

Customers who will be affected include those on Copilot Free, Pro, and Pro+ accounts, although you still have the option to opt out.

How to opt out

Opting out of the program is fairly straightforward, and Rodriguez confirmed that users who chose to opt out of product improvement data policies will retain these preferences.

“Your choice is preserved, and your data will not be used for training unless you opt in,” he wrote.

For those looking to opt out, users are advised to visit /settings/copilot/features. From there, under the “Privacy” section they will have an option to “Allow GitHub to use my data for AI model training” and disable the option.

FOLLOW US ON SOCIAL MEDIA

Software developers now face a delicate balancing act with AI. While the technology is speeding up production and improving productivity, unintended by-products such as flawed code mean many end up with heavier workloads.

Harness’ 2026 State of DevOps Modernization report found that 45% of developers who ‘frequently’ use AI coding tools (multiple times a day) deploy code faster than moderate daily or weekly users.

The company noted that this highlights the growing benefits of AI coding tools for developers, with these solutions helping to speed up production and software delivery. In this regard, AI is living up to the hype.

There are notable drawbacks, however. More than two-thirds (69%) of frequent users admitted their teams experience deployment problems more often when AI-generated code is involved.

Across all respondents, including frequent, moderate, and minimal users of AI, 58% agreed they have serious concerns about the risks associated with AI-generated code.

Speaking to ITPro, Harness CTO Martin Reynolds said these pitfalls highlight the growing complexity of software development with AI in the equation.

The technology may simplify tasks such as coding, for example, but across the broader software development lifecycle (SDLC), cracks begin to appear due to the velocity of operations.

Crucial processes such as quality assurance (QA) and security testing are being stretched to breaking point. Simply put, AI has given the engine a boost, but the frame that holds everything together isn’t up to the task.

“When you’ve got developers working at ‘human speed’, shall we say, all those processes that were built to make sure that everything stayed up was at human speed, now we’re developing at ‘machine speed’ and those other things are catching up,” he explained.

“I think what ultimately happens is some of those edge cases and bugs or impacts don't necessarily get caught, because everything to the right isn't keeping up.”

AI coding tools have a big drawback

The impact of this increased velocity in software development can hinder rather than help developers. Many now contend with heightened workloads despite AI being framed as a boon for teams.

Nearly half (47%) of frequent AI users reported that tasks such as QA, remediation, and validation have become more problematic.

Reynolds told ITPro this highlights the importance of traditional DevOps practices and the need for a considered approach to integration of these tools within daily operations.

AI isn’t a silver bullet, and as with any technology adoption process, the foundations need to be laid well in advance and be scalable. Downstream activities within the SDLC aren’t able to cope with increased volume at present.

“I will always say for any AI tool, it is still a tool, and you still have to learn your craft of how to use that tool,” he said. “You have to learn how to use it and get the best out of it.”

“But I also think that the downstream stuff they're saying they're spending their time on, it wasn't necessarily built to scale,” Reynolds added. “The foundations that you put in place that would allow it to scale haven't changed from before, like before AI to after.

“Having the good solid repeatable paths to production, scalable testing, having those good foundations, organizations that already have those are the ones that are generally scaling better, because they were built for scale.”

Telltale signs of strain

A clear sign that the volume of code production is having an adverse effect on development processes lies in remediation times, Reynolds told ITPro.

Harness’ report specifically highlighted longer recovery times as a key issue for developers that frequently use AI. These teams said it takes them an average of 7.6 hours to restore or resolve production incidents compared to just 6.3 hours for occasional or limited users.

Familiarity is a factor here, Reynolds noted. Teams are facing larger volumes of code and don’t have a clear understanding of what they’re dealing with, or even looking for.

“The mean time to recovery (MTTR) is taking longer, and it's taking longer because there's more code that they're not familiar with,” he said. “So even finding that problem is part of what's driving that.”

“You’ve got more going in,” Reynolds added. “Which leads to things just slipping through the gaps.”

The human strain of machine-speed development

This confluence of issues hampering development teams isn’t just hitting operational efficiency, as Harness found it has a human impact.

Developers now face more after-hours work as a direct consequence, with 96% of frequent AI users reporting having to work evenings or weekends multiple times each month due to release-related work.

Overwork, burnout, and “crunch culture” have been long-running issues in the profession, with a slew of studies in recent years highlighting the strain developers face.

Indeed, research from Harness in mid-2024 warned that burnout had reached “epidemic proportions” – and that was before the sustained influx of AI tools over the last two years.

Manual toil was highlighted as a key factor in this trend. Two years on, and with an array of AI-powered tools at their disposal, developers are still facing similar challenges and pressure

Reynolds repeated that this underlines the need for robust foundational preparation on the part of developer teams and enterprises at large to ensure smooth adoption of AI tools.

“I come back to that foundational thing. All those signs that you were seeing two, three years ago, I remember that because three years ago I still had engineering teams that worked for me, and [they] were having this problem,” he said.

“Part of it is if you didn’t solve the underlying things that were causing people to have to work late, whether that’s manual releases or manual release verification, or problem solving – if you’re not solving those fundamental things and those fundamental bottlenecks in the way you deliver your software, all that's happened is AI has just amplified them.”

Reynolds added that while AI is a valuable tool to reduce workload strain, the technology has the potential to further exacerbate existing problems. Worse still, the well-documented advantages of AI mean higher demands are placed on teams.

“AI doesn't solve the burnout problem. If anything, it amplifies it,” he said.

“I would add, especially because there is genuine pressure that happens, because we know you can generate more code now, so we expect more code out the door.”

FOLLOW US ON SOCIAL MEDIA

AI coding tools are surging in popularity, but often require a huge amount of oversight by developers and are trained on specific programming languages.

But recent research suggests these tools could start filling in gaps in their own knowledge.

That's according to a paper by researchers at the University of Southern California Viterbi (USC Viterbi), who developed a technique to allow an AI model to improve its own skills in an area it hasn't really been trained on, letting it expand beyond its own training parameters.

To test the idea, they used OpenAI's GPT-5 and used it to write code in an obscure programming language called Idris – which researchers said they didn't even know how to use themselves.

Researcher Minda Li improved the model's success from 39% to 96% using a system that allowed her to tell the AI when it was incorrect, but also letting it have another go.

"Our AI tools are now able to transcend their initial training," said Prof. Bhaskar Krishnamachari in a blog post detailing the project. "Used to be, maybe a year or two ago, you would say an AI model is only as good as the data it has seen. This paper is saying something different."

The work comes amidst a sharp rise in the use of AI coding tools over the last two years. A study in Science from earlier this year showed the share of Python contributions on GitHub that were written by – or otherwise used by – AI in the US climbed from 5% in 2022 to 29% at the end of 2024.

Teaching GPT-5 to code in Idris

The project made use of Idris, which has just 2,000 code repositories publicly available online versus 24 million for Python – meaning the AI model had much less data to train on.

Most of the researchers involved on the project had never even heard of it and therefore couldn't tell if the AI's code was correct or not.

"We were hunting for a language so obscure that we hadn’t heard of it," Krishnamachari said. "I think we were just in my office together, googling around, trying to find some crazy language that no one’s ever heard of."

That meant Li needed to figure out a way of teaching a skill she couldn't do herself. At first, she set GPT-5 on solving a series of Idris coding exercises on a training platform. It managed a 39% score.

To boost the score, she gave the model a range of assistance, including access to documentation, manuals, and reference guides – that helped, but only enough for a score around 60%.

To take it further, Li built a compiler feedback loop, taking error messages from the compiler and giving those to GPT-5 with a prompt to fix the issues. It was given 20 chances per error.

Li said she expected an improvement of 10%, but instead the system scored nearly perfectly.

"I was surprised that just that alone, seemingly one simple thing, just keep recompiling, keep trying, was able to get to 96%," she said.

What's next?

The results suggest it's possible to teach AI when there's a lack of available or relevant data, even after the model has been trained. Krishnamachari said the technique could be applied more widely and have huge long-term implications.

He suggested a feedback loop could help with creating 3D models of buildings or advanced mathematical reasoning, while a former student is working to translate endangered languages.

However, the technique worked well with coding Idris thanks to the feedback of the compiler, highlighting the continued need for long-standing processes such as reinforcement learning and extensive training.

"What I’ve learned from this project is that so long as you can figure out how to provide that kind of clear and correct feedback, there’s a chance we can now significantly improve the quality of AI outputs," he noted.

If that problem can be solved, it should be possible to build "an AI tool to do a task that we cannot do ourselves," Krishnamachari added.

FOLLOW US ON SOCIAL MEDIA

COBOL experts aren’t at risk of losing out to generative AI, even as the technology helps noticeably speed up mainframe modernization, according to an AWS executive.

Asa Kalavade, VP of AWS Transform, told ITPro that AI holds immense potential for workload modernization – but that it can’t and shouldn’t replace experts in the field.

AWS Transform is the firm’s agentic AI modernization platform, intended to speed up the translation and update process for legacy code, infrastructure, and applications.

First unveiled in May 2025 it was expanded upon at AWS re:Invent, and is a core offering for firms looking to modernize at scale.

AWS Transform for Mainframe is specifically designed for AI translation of mainframe codebases in languages such as COBOL, JCL, and BMS, and systems including CICS, DB2, and VSAM, into a modern language such as Java.

Generative AI has made it easier than ever to translate code from one language to another. However, at an enterprise level leaders need to know that this process won’t introduce logic errors or otherwise make workloads unpredictable or harder to audit.

Translating COBOL is no mean feat

When it comes to translating COBOL, AWS Transform gets around this by extracting system management facility (SMF) records, logs generated in IBM z/OS mainframes.

These contain details on the correct steps for implementation, execution, and workload routines to ensure that code generated by Transform retains the integrity of the original code.

Kalavade added that using AWS Transform, organizations can compare the efficiency of migrated workloads against existing P90 and P95 records to confirm no loss in performance.

AI within the tool can also be used to generate test cases to stress test the migrated mainframe code. However, Kalavade stressed that human experts are still needed at all stages of the modernization process.

For example, she explained that human experts with familiarity of mainframe systems are needed to help pressure test cloud systems post-migration.

In February, shares in firms such as IBM plummeted after Anthropic claimed its latest Claude release could translate COBOL into modern programming languages.

“You do need those COBOL experts, because how do you validate this code? And the point is, the COBOL expertise is declining.

“So in fact, we find in our team some of our unicorns are those that have come from years of doing COBOL, but now they know how to translate and they can verify so that whole human reinforcement that is needed to verify that the output is matching the input that is required.”

Kalavade added that COBOL is not just one language and that experts are still needed for proper understanding and handling of code translation.

“There are so many variants of COBOL, there are so many languages within a mainframe application, whether it's PL/I [or] Easytrieve, so you need those experts to even define what these transformations are.”

AWS has benefited in modernization efforts from its 2021 acquisition of Blu Age, a French company that had over 20 years of experience in like-for-like code translation.

“The core asset that came out of that understanding was to build the control flow graph of that old application, and that is what gives us the ability to combine the old and the new,” Kalavade explained.

IBM z/OS mainframes are still widely used across financial services, government, and healthcare among other critical industries, so it’s important that any migrated workloads are done.

“Our mainframe workloads have got the most signal where customers who thought they could previously never modernize these applications are now really accelerating some of this modernization.

Kalavade pointed to customers like BMW and Brazil-based Itaú bank as customers that are already leaning heavily into AWS’ mainframe modernization tools.

“What was most exciting to me was, we launched Transform back in May as GA and at re:Invent we had four or five of these mainframe customers providing references and experiences,” Kalavade noted.

“One might wonder, why is it so exciting? These projects typically took two, three, five years, so even if it's a start, having customers finish these projects within at least some workloads – it's not like they finished their entire mainframe project – has been very rewarding to see.”

Not every workload will move right to the cloud, Kalavade added, and IBM is a strong AWS partner for on premises workload management.

VMware licence spurring cloud migration

A noticeable factor in cloud migration has been the VMware licence changes, which have spurred 86% of customers to reduce their VMware footprint.

While one option is to go cloud native via a lift and shift process from VMware workloads to AWS EC2, others are finding the move a laborious undertaking involving unpicking numerous interdependencies.

Kalavade told ITPro that VMware licences have not only motivated customers to move to the cloud, but also to use this shift as an opportunity to modernize and adopt containers. AWS is currently beta-testing a dedicated agent for containerization, while AWS Transform can handle the code contained in migrating VMs.

“Those VMs often will have a database that is on that VM, or you’ll have a Windows Server, so some customers will look to move those VMs, and then once they're in the cloud then they might want to modernize the database from SQL Server to [Amazon Aurora PostgreSQL], or to go from .NET Framework to Core.”

AWS is working to make the entire process easier for customers through integrated AI agents. For example, Kalavade described how administrators can use a chat window to ask questions about code modernization plans directly within AWS Transform, which can be connected with a coding agent to generate code directly from a user’s natural language inputs.

“What we see could be happening is over time, as these coding agents become more autonomous, once you've defined the spec, then the agent can go and do more and more long-running tasks to generate the code, create the test cases, and validate which is what the LLMs are starting to get really good at.

FOLLOW US ON SOCIAL MEDIA

Reviewing AI-generated code has become a problem: it's made at such a fast rate, and in such a different way to human engineers that spotting bugs is increasingly difficult.

Anthropic hopes to solve that with the launch of Code Review for Claude Code, a new multi-agent tool that spots bugs that human reviews might miss and aims for “depth, not speed”.

The move by Anthropic comes after the company claimed code output for its own software engineers has leapt by 200% over the last year.

"Code review has become a bottleneck, and we hear the same from customers every week," the company said in a blog post. "They tell us developers are stretched thin, and many PRs [pull requests] get skims rather than deep reads."

That's backed by a study from CodeRabbit which found AI is indeed helping developers speed up code creation – but at the cost of more errors.

Notably, those flaws can be harder to spot thanks to the "illusion of correctness", in which mistakes made by AI aren't as obvious as those made by humans.

Indeed, developers spend so much time bogged down fixing flaws in AI code that they lose any productivity gains, according to a report from Harness.

Anthropic already has tools aimed at streamlining code reviews, such as Claude Code GitHub Action. However, the company admitted that this option is less thorough than the newly-released feature.

Claude Code GitHub Action will remain available and continue to be open source, the company noted.

So far, Code Review is only available as a research preview in Claude for Teams and Claude for Enterprise. Billed on token usage, using Code Review will cost $15-$25 each time, depending on complexity of the pull request.

How Code Review in Claude Code works

Whenever a pull request is opened, Code Review uses multiple agents to look for bugs at the same time, ranking them by severity and filtering out false positives, the company said.

Larger changes will allocate more agents to the code for a "deeper read", while basic changes will get a quicker look. Anthropic said the average review takes about 20 minutes.

Software engineers are shown a single comment with in-line comments for specific bugs, making it easier to address spotted issues.

Security professionals need not worry, either. Anthropic isn't pitching Code Review as a replacement for their human work, but an aide.

"It won't approve PRs – that's still a human call – but it closes the gap so reviewers can actually cover what's shipping," the company said.

Does it work?

Anthropic said it has been running Code Review on every pull review internally, and so far the signs have been positive. Previously, 16% of pull requests received "substantive" comments from human reviewers. Now, 54% see that many comments.

Naturally, more complicated code changes – those above 1,000 lines changed – are more likely to lead to Code Review findings, with 84% being flagged with an average of 7.5 issues. With smaller pull requests under 50 lines, only 31% are flagged, with an average 0.5 flaws.

"Engineers largely agree with what it surfaces: less than 1% of findings are marked incorrect," the company said.

That suggests the tool could help software engineers keep up with AI generated code – and that includes Anthropic, with security researchers last month spotting critical flaws in Claude Code itself.

FOLLOW US ON SOCIAL MEDIA

Microsoft CEO Satya Nadella believes “anyone can be a software developer” thanks to AI, but that doesn’t mean it’s the end of the road for skilled developers..

Speaking on the OMR Podcast on 1 March, the Microsoft chief said advances in AI have driven a transformational shift in development, helping to lower the barrier of entry for those outside the profession.

Indeed, practices like “vibe coding” have taken off over the last 18 months, allowing non-technical workers to build their own applications using natural language prompts.

That doesn’t mean any individual can walk into an engineering or development role, though, according to Nadella.

While the technology is lowering barriers in some areas, it’s also redefining roles, changing skills expectations, and thereby creating new challenges for enterprises, he said.

“Now anyone can be a software developer, but it's also raising the ceiling on what is this new sophistication you need in order to be productive with these new tools, so that these codebases that are getting generated are not black boxes,” Nadella claimed.

“That’s going to be what all of us will have to re-skill ourselves on,” he added.

Simply put, AI is a vital productivity tool for development teams, but it’s not a silver bullet. Teams and individual developers will have to change to accommodate new processes, adapt to new workflows, and fine-tune their skills to use these tools.

AI is driving change for developers

Nadella’s comments align with a slew of studies on how developers are adapting – or being forced to adapt – due to the influx of AI tools in the profession.

Research from Gartner in late 2024, for example, warned that developers and engineers across the industry will be forced to re-skill and upskill to compensate for the integration of AI tools.

Concerns about the need for reskilling have been compounded by simmering tensions about the potential for the technology to render developers obsolete.

A host of big tech figures have made bold claims on this front, with the impact of the technology on entry-level roles being key a focus point.

With regard to the impact on jobs, Nadella said there may be a degree of “displacement”, but this once again comes down to the ability of enterprises and engineers to redefine roles and reskill.

“I’m not saying that there is not going to be displacement,” he said. “We have to be clear eyed about it. What’s the best protection against displacement?”

“It’s to understand the new medium, the new tool, the new skills required, and transform yourself in-job,” he said. “That is what’s happening in software development.”

When pushed further on the topic of job losses, Nadella compared changes in development to the rise of early knowledge work, suggesting that current concerns bear similarities to that period.

“If somebody in the early 80s had come to us and said three billion, four billion people are going to get up every morning and type, we would have said why, we have a typist pool.”

“Why would four billion people type? We invented this entire thing called knowledge work. And so I think at some level, I'm not being [a Pollyanna] about this, but I'm saying let's at least have a bit of optimism in our ability as humans and human societies and as political economies, right? One thing that is discounted is like we have control.”

Nadella's claims about job "displacement" tracks with a November 2025 study from Gartner on the topic.

The consultancy projected that around 32 million jobs a year will be “reconfigured, redesigned, or fused” by AI from 2028 onwards.

Gartner once again highlighted the need for widespread reskilling across a range of industries, although one analyst warned this could be easier said than done.

A natural evolution for developers

Ultimately, Nadella seemed convinced AI represents the next evolutionary step in the history of software development. Reflecting on the course of his career, he noted that the profession has changed drastically over that time.

“If you look at the history of software development…I started learning with Assembly, and then compilers came, and then we went to higher-level languages,” he said.

“We [then] went to interpreted languages, and we’ve had many tool changes and levels of abstraction that made us more productive,” Nadella added.

“This one is another big leap forward in making it possible for both reducing the flow and raising the ceiling for anyone who is a software developer.”

FOLLOW US ON SOCIAL MEDIA

The overwhelming majority of organizations are running software with known, exploitable vulnerabilities, as security risk increases across the software delivery lifecycle.

Datadog's 2026 State of DevSecOps report indicates that 87% of organizations have at least one known exploitable vulnerability in deployed services - a problem that's most visible in Java services, at 59%, with .NET at 47% and Rust at 40%.

More than four-in-ten (42%) services rely on libraries that are no longer actively maintained. Notably, the median dependency is 278 days behind the latest major version, compared with 215 days behind last year.

Java and Ruby were 492 days behind and 357 days behind, respectively.

Services using end-of-life language versions face exploitable vulnerabilities in 50% of cases, Datadog noted, compared with 31% for supported versions.

Half of organizations adopt new library versions within 24 hours of release, but while this might seem like a good thing, that's not always the case.

"When factoring in supply chain compromises, updating to a new version within a day of release can have a negative impact on the overall security of an application due to the potential to unknowingly install malicious software," the researchers warned.

Meanwhile, only 4% of organizations pin all public GitHub Actions to a specific version using commit hashes, leaving CI/CD pipelines vulnerable to silent code changes.

“The way software is built has fundamentally changed, but security practices haven’t kept up,” said Andrew Krug, head of security advocacy at Datadog.

“DevSecOps teams are caught between moving too slowly and moving too fast. Go slow, and outdated software accumulates known vulnerabilities. Go fast, and automation can introduce unvetted code," Krug added.

"The real challenge, though, isn’t speed - it’s clarity. As environments grow more complex, AI-assisted workflows help ensure top priorities get attention first.”

Alert fatigue is rising

Researchers warned the volume of alerts is obscuring real risk: while vulnerability alerts continue to rise, most don't represent immediate business risk, with only 18% of vulnerabilities labeled “critical” remaining critical once runtime context is applied.

“When almost everything is labeled ‘critical’, nothing is,” said Krug. “Teams get paged for noise while threats that pose real risk slip through. Without context, prioritization becomes harder - leading to burnout, slower response times and accumulated risk. Teams need better visibility into what actually requires action.”

Just last week, Veracode released research indicating that 82% of organizations are struggling with high levels of security debt, up by 11% compared with last year.

Of these, 60% have security debt defined as “critical” - representing accumulated vulnerabilities that would be severe enough to cause catastrophic damage to an organization if exploited.

Third-party libraries and open source dependencies were behind 66% of the most dangerous, longest-lived vulnerabilities, the researchers said.

FOLLOW US ON SOCIAL MEDIA

Over the span of three decades, Stack Overflow has been a fixture in the software engineering landscape – guiding developers of all experience levels through their thorny programming queries. Such was its significance that it featured more than 250,000 monthly queries at its peak in the mid-2010s. It was also acquired in 2021 for a staggering $1.8 billion by the Dutch company Prosus.

Since then, however, the traffic has fallen away, with a viral graphic showing the number of monthly queries beginning to collapse between the end of 2022 and the start of 2023 – coinciding with the public debut of ChatGPT. Since then, traffic to the site has evaporated, with just 2,640 queries registered in the month of January 2026. Does this mean the platform is "dead" as many commentators have been musing?

The answer depends on who you ask: the company's CEO, Prashanth Chandrasekar, insists the business is fundamentally different to the one developers used frequently in the middle of the last decade. For many individual developers, the recent AI pivot by the company, outlined in coverage by ITPro last year and a blog post that Chandrasekar shared, is unconvincing. The software world, as far as they're concerned, has moved on from it almost entirely, deeming it more of an archival resource.

But such an iconic and once essential platform surely won't vanish without leaving its mark in this AI-laden development landscape. Is it game over for Stack Overflow in 2026? Or, to borrow a famous saying, are the rumours of its death greatly exaggerated?

The changing face of software development

"Stack is far from dead," Chandrasekar tells ITPro. "While we know many who have announced this in public are referencing a chart they’ve seen online regarding a decline in questions and answers on our public platform, very few of them know the reality of our business. Many only know us for the Q&A element of our business, and while this format is fantastic for high-quality, curated knowledge, it does not always enable certain types of conversations or address new ways people learn or collaborate."

Although Chandrasekar insists there is life in the old dog yet, two developers tell with ITPro how Stack Overflow has changed over the years – not for the better – with the rise of AI being something of a death knell.

Vincent Schmalbach, a freelance software developer and AI engineer, says he hasn't been on Stack Overflow for at least a month at the time of our interview. "Before AI, I was on Stack Overflow 10 times a day. I'm not exaggerating. This is what software development looked like. You Google a problem, Google shows you Stack Overflow, you click through," he explains – adding that when he now Googles something, "I usually just read the AI overview".

"When I do click through to an actual website, it's usually GitHub Issues, not Stack Overflow. That's where discussions between software developers happen now. If you have a problem with a specific library or package, the developers of that library discuss things in GitHub Issues. That's a first-party source. Plus, reading the official documentation, or rather pasting it into the AI instead of reading through it myself."

Behnam Bastani is the CEO and founder of OpenInfer, an AI edge computing company. With more than 20 years of development experience, he was previously director of engineering for AI and machine learning at Roblox and Meta – and says he's shipped AI engines at scale at various big tech companies. He says his engineering teams have been shifting entirely to integrated development environment (IDE) first workflows, where the primary interaction happens with some form of chatbot or localized inference model. "Engineers only visit Stack Overflow for esoteric, low-level debugging where human debate provides context that models might hallucinate," he says. "Reaching for a web forum now feels like a last resort rather than the natural starting point for problem-solving."

AI is to blame, but there's so much more to the story

Although AI is the primary accelerator for Stack Overflow's so-called demise, Bastani says, it was already deteriorating from what many developers call "community entropy". He defines this as "years of gatekeeping and moderator friction that drove developers away."

"Overflow always has had issues with moderation and people getting their questions closed for no reason," adds Schmalbach. "But that's just how crowdsourced platforms work. Wikipedia has similar problems. People accepted it and kept using the site anyway."

Gergely Orosz, author of the Pragmatic Engineer blog, commented on a similar trend in a 2025 blog post. "Even without LLMs," he said, "it’s possible StackOverflow would have eventually faded into irrelevance – perhaps driven by moderation policy changes or something else that started in 2014."

But those issues weren't ever terminal and don't speak to the cataclysmic usage drop the site has sustained in recent months: "What killed Stack Overflow is AI, plain and simple," Schmalbach decrees, a characterization that Chandrasekar would of course reject.

Unlike Bastani and Schmalbach's irrelevance, Orost comes across as full of lament. "I'll certainly miss having a space on the internet to ask questions and receive help – not from an AI, but from fellow, human developers," he added. "While Stack Overflow's days are likely numbered: I'm sure we'll see spaces where developers hang out and help each other continue to be popular – whether they are in the form of Discord servers, WhatsApp or Telegram groups, or something else.

What role will Stack Overflow play in 2026 and beyond?

While Chandrasekar concedes that the way developers seek answers to their queries has shifted, he sees a future beyond the site's original purpose and insists it's evolving with the times. "We believe the new measures of value in the post-GenAI era are reach, trust, attribution, and influence," he tells ITPro. "Stack Overflow provides that layer of context and trust for developers – whether through our enterprise product Stack Internal used by engineering teams at over 25,000 organizations globally, or via the depth and reach of our data partnerships with leading LLM developers and hyperscalers, including Google Cloud, OpenAI, and Microsoft."

For Stack Overflow, the purpose is to shift to new forms of content "that generate more conversation" alongside "investing in new GenAI tools". Chandrasekar also points out that many developers technically use Stack Overflow without realizing, albeit indirectly, through the licensing partnerships with the purveyors of AI as well as within marketplaces via the likes of Snowflake, Databricks and Moveworks, among many others.

"Developers or anyone seeking out information online no longer looks in one place – that’s not how our media and tech ecosystem operates anymore. Beyond the public platform, Stack Overflow has evolved into a larger ecosystem residing inside enterprises which is also useful as AI Agents depend on context to unlock their potential. None of this can be captured by a single Q&A chart."

Schmalbach is brutal in his assessment of the platform's future, saying: "Stack Overflow's biggest value now is as training data for the AI. If it would go away tomorrow, I wouldn't even notice it."

But Bastani is more charitable, predicting it "will become the "gold standard" archive for human-verified logic" rather than a daily destination. "As the web floods with AI-generated content, the industry desperately needs repositories where humans verify the correctness of AI-proposed architectures," he says. "It will serve as critical "ground truth" to prevent model collapse, the recursive degradation that occurs when AI trains on its own unverified output. The platform is evolving from a public help desk to a specialized data provenance layer for high-stakes software engineering."

That's a core message that Chandrasekar wants to stress. "We believe the new measures of value in the post-GenAI era are reach, trust, attribution, and influence. Stack Overflow provides that layer of context and trust for developers."

For our experts, there will certainly be some kind of future for the platform, even if they disagree on the exact nature of that. What’s apparent is that this will center around how it can align with and co-exist alongside a flood of generative AI systems that are now augmenting development.

This also signals a wider shift with the nature of software development – and the way that individual engineers perform their daily tasks. Rather than using tools like Google Search and Stack Overflow, AI is becoming far more proficient at assisting developers and responding to queries. Extrapolating this further, we might begin to see teams of developers managing and overseeing vast amounts of code generated by AI, with conventional writing replaced by curation and editing, rather than getting stuck in themselves.

As for problem-solving, Schmalbach envisages different ways of online engagement and relationship-building beyond forums like Stack Overflow. "I think that the good old blogs will come back," he says, with people likely to visit posts written by human developers about problems that AI can't yet solve. Given the pace at which AI is improving, however, it remains to be seen how long even this form of engagement might last.

Security researchers have warned Anthropic’s Claude Code tool had critical flaws that could’ve allowed hackers to execute remote code.

A recent advisory from Check Point Research revealed details of a trio of vulnerabilities that could allow code to be run remotely or allow hackers to steal API keys by taking advantage of automation and other built-in tools.

The flaws shouldn't come as a surprise, given how quickly AI coding tools have been introduced to the industry, said Check Point. In recent years, tools like Claude Code and GitHub Copilot have led to a surge in AI-generated or assisted code.

The pace of adoption naturally increases the potential attack surface, researchers noted, with security teams struggling to keep up.

"As AI-powered development tools rapidly integrate into software workflows, they introduce novel attack surfaces that traditional security models haven’t fully addressed," said Check Point researchers Aviv Donenfeld and Oded Vanunu said in a post detailing the bugs.

"These platforms combine the convenience of automated code generation with the risks of executing AI-generated commands and sharing project configurations across collaborative environments."

All three bugs have already been fixed after the security firm disclosed them to Anthropic over the course of several months last year.

ITPro approached Anthropic for comment, but did not receive a response by time of publication.

The Claude Code flaws explained

In a blog post detailing the flaws, Check Point said Claude Code introduced a new attack vector by trying to make work easier for developers. The tool is designed to embed project-level configuration files directly within repositories, researchers explained, automatically applying them when a dev opens the tool within any given project directory.

While this is a convenient feature, researchers noted that in some instances cloning and opening a malicious repository would be enough to trigger hidden commands, slip past safeguards, and expose active API keys.

"Check Point Research found that these files, typically perceived as harmless operational metadata, could in fact function as an active execution layer."

Three flaws in total were spotted by Check Point. The first impacted Claude Hooks, which can be used to run predefined actions when a session is started. By fooling developers into opening a malicious repository, hackers could trigger arbitrary shell commands on their computer.

The second centered on Model Context Protocol (MCP), an industry system for letting AI models work with external tools. With this flaw, designated CVE-2025-59536, Check Point found that repository-controlled configuration settings could override safeguards that require users approval, letting remote code be executed.

"When code runs before trust is established, the control model is inverted – shifting authority from the user to repository-defined configuration and expanding the AI-driven attack surface," the researchers said.

The third flaw, tracked as CVE-2026-21852, takes advantage of those repository-controlled configuration settings, researchers said.

If a hacker meddles with those, it's possible to redirect API traffic to an attacker controlled server before security protections kick in. That could allow attackers to steal a developer's active API key and other credentials.

Check Point stressed that API key exposure is particularly problematic as stolen credentials could allow hackers to access shared project files, modify or delete cloud data, upload further malicious content, and run up API costs.

"In collaborative AI environments, a single compromised key can become a gateway to broader enterprise exposure," the researchers noted.

From passive to execution

These new systems have led to a shift in how software supply chains work, Check Point said, relying on repository-based configuration files for automation and collaboration.

"Traditionally, these files were treated as passive metadata – not as execution logic," the researchers noted, adding that "fundamentally alters the threat model."

Check Point said AI-powered coding tools are bringing significant benefits — but also changing how systems work leading to a need to "reassess traditional security assumptions."

"As AI integration deepens, security controls must evolve to match the new trust boundaries,” researchers added.

FOLLOW US ON SOCIAL MEDIA

AI hasn’t rendered traditional DevOps practices obsolete, new research suggests, but only enterprises with mature practices are recording success with the technology.

According to Perforce’s 2026 State of DevOps Report, 70% of organizations say DevOps maturity materially affects AI success. Indeed, those with mature processes are finding it easier to integrate the technology across the software development lifecycle (SDLC).

Nearly three quarters (72%) of high-maturity organizations told Perforce they’ve successfully embedded the technology in processes, compared with 43% of mid-maturity companies and 18% of low-maturity firms

"The market often asks whether AI will replace DevOps. Our research shows the opposite: AI amplifies DevOps," said Anjali Arora, CTO of Perforce and author of the report.

"Organizations with disciplined engineering practices, automation, strong collaboration, and focus on control, auditability, and governance are the ones scaling AI successfully and turning innovation into measurable business outcomes."

How AI is changing DevOps practices

AI is changing roles in DevOps, researchers found, particularly in testing. The vast majority of respondents (87%) believe that AI will enable engineers to focus less on scripting and more on system design and directing outcomes.

More than half (55%) of QA teams have increased their focus on quality analytics rather than test execution, and 53% said developers author tests directly.

Nearly half (41%) reported that QA teams are also evolving into Quality Engineering (QE) teams, with 39% citing a focus on orchestration across pipelines, environments, and data. Meanwhile, 38% said that business analysts are involved in test creation.

"The research confirms what we are already seeing: AI is helping teams shift up from execution to oversight and strategy, effectively elevating individual roles," said Jake Hookom, EVP of product at Perforce and report author.

"But the research also highlights that governance and auditability need to be a focus for organizations and the collaboration between teams."

Devs are starting to trust AI

Confidence in AI appears to be improving among DevOps teams, Perforce researchers found. More than three quarters (77%) said they have confidence in AI outputs, for example.

Meanwhile, 74% said AI was meeting or exceeding expectations, with 50% measuring AI's value through customer retention or acquisition, 48% seeing faster delivery, and 44% citing revenue or market share impact.

Perforce did warn that governance is often fragmented and incomplete, posing significant challenges for many enterprises. Compliance oversight is split between multiple functions, and only 39% have full automated audit trails, making measurement expensive and inconsistent.

Notably, 74% said that cloud/compute costs and energy usage influence their organization's decisions about AI adoption, and 37% cite these as limiting factors.

"DevOps practices are widespread but uneven. This split explains why DevOps is simultaneously described as 'solved' and 'broken'," the researchers conclude.

"For organizations with mature practices, DevOps works. For those with incomplete implementations, it doesn't. AI doesn't change this dynamic. It amplifies it, widening differences in outcomes, reliability, and cost."

FOLLOW US ON SOCIAL MEDIA

Anthropic believes Claude Code can play a key role in modernizing legacy code like COBOL, but IBM appears to disagree.

In a recent blog post, Anthropic said its flagship coding tool can automate much of the legwork required in COBOL modernization, which is a notoriously difficult process for enterprises.

"With AI, teams can modernize their COBOL codebase in quarters instead of years," the company said.

If as useful as promised, Claude could be the tool that finally breaks the ongoing dependence on COBOL, or Common Business-Oriented Language, a programming language first developed back in 1959.

While it's still widely used, that's largely for legacy operations, and efforts are being made to shift at least some of those workloads to more modern platforms. Anthropic noted COBOL runs 95% of ATM transactions in the US and is used to power critical systems including finance, airlines, and government.

"Despite that, the number of people who understand it shrinks every year," Anthropic noted in its blog post. "The developers who built these systems retired years ago, and the institutional knowledge they carried left with them."

Waning expertise in COBOL is exacerbated by the fact universities no longer teach the language. Indeed, it’s becoming increasingly difficult to find qualified engineers in this domain.

That could have serious implications for major industry players such as IBM, largely because COBOL is a major selling point for IBM systems as the company continues to sell mainframes to customers reliant on the language.

After Anthropic's announcement, shares in IBM fell 13.2% – the biggest drop seen by the company in more than 25 years, according to Reuters.

Claude Code vs COBOL

Anthropic said COBOL modernization is different from standard code, adding "you're reverse engineering business logic from systems built when Nixon was president."

With that in mind, it’s not just about coding, but understanding long lost institutional knowledge that's only represented in the code itself.

That's one reason why "armies of consultants" are now required to update these systems – at high cost and with lengthy timelines.

"Tools like Claude Code can automate the exploration and analysis phases that consume most of the effort in COBOL modernization," the post noted.

Using Claude Code, Anthropic said researchers were able to map dependencies across thousands of lines of code, document long-lost workflows, spot risks more quickly than human analysts, and offer "deep insights" to make key decisions.

"AI excels at streamlining the tasks that once made COBOL modernization cost-prohibitive," the company said. "With it, your team can focus on strategy, risk assessment, and business logic while AI automates the code analysis and implementation."

By going through a step-by-step process that includes validation, the AI can translate COBOL logic into modern languages, creating API wrappers around legacy components and building a system to run old and new code together.

IBM isn't convinced

In an apparent response, IBM published its own blog post about AI coding tools and COBOL – without specifically mentioning Anthropic – that argues there's a clear difference between translating code and modernizing a platform.

"Translation captures almost none of the actual complexity," said Rob Thomas, Senior Vice President, IBM Software and Chief Commercial Officer, later adding: "Decades of hardware-software integration cannot be replicated by moving code."

IBM's mainframe business isn't just about COBOL, Thomas said. Indeed, nearly half (40%) of COBOL doesn't even run on mainframes.

"COBOL on IBM Z is code optimized over decades of tight coupling between software and hardware," Thomas added.

"An analogy is the iOS and iPhone: someone could build an alternative, but it is unlikely to displace a billion iPhones. The performance derives from tight coupling of software and hardware, processor-level acceleration, I/O subsystem optimization, and decades of performance tuning."

Whether that convinces the markets to stop battering IBM's shares remains to be seen, but IBM isn't the first company to see its price fall over an Anthropic post or product launch in recent weeks.

Software and services shares dipped over the launch of Claude Cowork, while another reveal about security tools tanked share in a host of major cybersecurity companies.

FOLLOW US ON SOCIAL MEDIA

Google has added code validation capabilities to its Gemini CLI coding extension Conductor in a move aimed at tackling some of the challenges of using AI for software engineering.

The tech giant first unveiled the Conductor extension back in December, aiming to create context-driven development by shifting projects out of chat logs and into markdown files. Now, it's adding a new feature to help coders verify their work.

"Our new Automated Review feature allows Conductor to go beyond planning and execution into validation, generating post-implementation reports on code quality and compliance to the guidelines you’ve defined," the company said in a blog post.

Once the coding agent finishes its tasks, Conductor will generate a report where it reviews code, ensures everything meets user-set guidelines and compliance requirements, and runs a basic security review to look for critical vulnerabilities before code is merged.

This includes probing for hardcoded API keys or personal information that could leak, according to Google. Beyond that, Conductor includes test-suite validation.

"Instead of relying on manual execution, Conductor integrates your entire test suite directly into the review workflow," the post added.

"It runs all relevant unit and integration tests, then incorporates the results and coverage data into the final report to provide a unified view of whether the new code actually functions as intended within your existing ecosystem."

Google eyes security gains with Gemini CLI

The aim is for Automated Review to give developers detailed information on what needs improvement or addressing, offering a clear workflow that includes the exact file path to fix issues.

"This level of detail ensures that 'agentic' development doesn't mean 'unsupervised' development," the blog post noted.

"Instead, it creates a workflow where the AI provides the labor and the developer provides the high-level architectural oversight, backed by automated verification."

Google suggested more features were on the way, noting the latest updates are evidence of the company's aim to make "AI development safe, predictable and architecturally sound."

Trust but verify

The rise of AI coding tools has sparked concerns about errors introduced by agents and other automation tools – especially with code that looks correct and production ready, but contains security risks.

Indeed, AI-generated code is already the cause of one in five breaches, according to one survey.

Adding another layer of verification and supervision could be critical in stopping disastrous flaws before they cause havoc – especially given that developers are now falling foul of these on a frequent basis.

A recent survey found nearly half of software developers don't check AI-generated code, in part because it's harder to review code produced by AI than humans.

Nigel Douglas, head of developer relations at Cloudsmith, said while the feature could prove useful, it won’t address all the challenges presented by AI-generated code.

"An AI coding CLI without automated reviews is like a chainsaw without an ‘off’ button, but, unfortunately, these changes focus only on the code that’s been generated –completely skipping the upstream components it’s pulling in," he said.

"If an AI coding assistant suggests a package that doesn’t exist or has already been infected with malware, you’ll end up shipping vulnerabilities far faster than you can catch them.

“Peer reviews can’t work the way they’ve always worked when LLMs can generate thousands of lines of functional code in minutes. No human can – or should – read that fast.

FOLLOW US ON SOCIAL MEDIA

The creator of Anthropic’s Claude Code tool says software engineers will still play a vital role despite the increased use of AI across the profession – with a notable caveat.

The prediction by Boris Cherny came during an exchange on X, in which a user pondered why engineers are needed at Anthropic if Claude is being used to generate the majority of code.

Cherny’s comments came in the wake of recent claims by Mike Krieger, head of Anthropic Labs, on the scale of AI code generation at the company.

During a discussion at the Cisco AI Summit, Krieger revealed that devs at Anthropic are increasingly relying on Claude to speed up coding practices, product development, and quality control.

“Claude is now writing Claude,” he told Cisco’s Jeetu Patel. “We're moving extremely quickly. Right now for most products at Anthropic it's effectively 100% just Claude writing.”

So does that mean AI is doing all the work at Anthropic? Not exactly. According to Cherny, the increased use of the technology doesn’t mean engineers aren’t needed – if anything they’re “more important than ever”.

“Someone has to prompt the Claudes, talk to customers, coordinate with other teams, decide what to build next,” he wrote. “Engineering is changing and great engineers are more important than ever”.

Job postings at Anthropic do appear back up what Cherny suggested. At the time of writing, the company has 24 open product engineering and design roles, with an additional 26 software engineering positions in infrastructure.

Software developers aren’t going anywhere

Cherny is by no means the first industry figure to highlight the continued need for software developers, and some will take solace in his comments given the state of the industry over the last two years.

Software developers and engineers have faced repeated threats of obsolescence since the advent of generative AI.

Some industry stakeholders have warned the technology will essentially render them useless as enterprises look to automate processes and cut teams.

A host of big tech execs have fired warning shots on this front, including Meta CEO Mark Zuckerberg.

During a January 2025 appearance on the Joe Rogan podcast, Zuckerberg claimed AI would be doing the work of most mid-level engineers by the end of the year.

This prediction hasn’t quite materialized, however, and if anything teams could grow as a result of AI.

Speaking to ITPro in December last year, GitLab Field CTO Marco Caronna said he believes AI adoption will ultimately create larger development teams, rather than a wave of job cuts across the industry.

Regardless of what side of the fence industry stakeholders are on with regard to AI coding, the reality is that engineers will face huge changes in years to come.

Previous research from Gartner warned that around 80% of engineers will be forced to reskill or upskill due to the influx of AI tools in the profession, and those who fail to evolve will be left behind as the technology tightens its grip.

Developers probably shouldn’t hold their breath

It’s worth noting that Cherny’s comments on social media came with a big caveat that might not please developers.

During a recent interview at the World Economic Forum (WEF) in Davos, Anthropic CEO Dario Amodei said advances in AI mean the technology could be doing most of the work in the near future.

“We might be six to 12 months away from when the model is doing most, maybe all, of what software engineers do end-to-end,” he said.

In a follow-up with another poster on X questioning the logic behind engineers still being needed, Cherny noted that Amodei was “describing the current state” of the profession.

“Dario is talking about what’s next,” he added.

FOLLOW US ON SOCIAL MEDIA

Developers are growing increasingly frustrated with Oracle Java pricing changes, new research suggests, with a significant number now considering migrating to reduce costs.

Findings from Azul’s 2026 State of Java survey show nine-in-ten Java developers are concerned about pricing, while roughly eight-in-ten plan to migrate to platforms such as OpenJDK due to rising costs.

Oracle bought Sun Microsystems in 2009, gaining control of Java and keeping access free for commercial users until a paid version was introduced several years later.

That was slowly cut back until 2023, when Oracle introduced employee-based pricing, charging on headcount rather than users.

The cloud computing giant formally ended free commercial support for Java in 2024, introducing audits and requiring users to upgrade and pay or shift to an alternative.

Azul’s findings mark the latest in a string of studies pointing toward a developer exodus, and the company said the situation has intensified over the last year.

All told, 81% of those polled said they had migrated, are in the process or plan to shift at least part of their Oracle Java work to a non-Oracle distribution. Nearly two-thirds said they plan to migrate their entire Java estate.

The main driver is cost (37%), followed by a preference for open source (31%), uncertainty caused by ongoing changes (29%), and the risk of an Oracle Java audit (26%).

Indeed, a fifth said they have already been subjected to an Oracle Java audit.

Azul said in a statement that enterprises are "prioritizing cost predictability, vendor independence, and long-term stability — driving widespread adoption of supported OpenJDK alternatives."

Just 7% said they weren't concerned about Oracle pricing, half the level recorded last year.

ITPro approached Oracle for comment on the Azul research, but did not receive a response by time of publication.

Beyond Oracle, enterprises are focused on using Java to cut cloud costs, with 97% of respondents saying they'd worked to cut public cloud costs, and 41% saying use of a high-performance Java platform is among their top strategies.

Java in the age of AI

The report also found the use of Java in AI was rising, with 62% of respondents revealing they use Java to code AI functionality, an increase from 50% of those polled last year.

Azul said that shows a shift toward integrating AI models with existing Java applications. Java is now "indispensable" for scaling AI workloads, the study noted.

And it goes both ways. Three-in-ten respondents say half of their Java applications now contain AI functionality, helped by Java-friendly AI libraries.

To help that continue, Java requires support for modern versions, built-in security, observability insights, support for large data access, and better integration with large language models, according to respondents.

Scott Sellers, co-founder and CEO at Azul, said the report shows Java “continues to prove its durability and strategic importance”.

“From powering the next generation of AI-driven applications to helping organizations regain control of cloud spend and modernize their estates, Java remains at the center of innovation and operational excellence.”

FOLLOW US ON SOCIAL MEDIA

“I couldn’t imagine it being more impactful,” Jon Kern, co-author of the Agile Manifesto tells ITPro. 25 years on and Kern firmly believes the manifesto – and methodology at large – has withstood the test of time.

Alongside 16 other co-authors, Kern helped curate the Agile Manifesto in February 2001 during a series of crunch meetings at Snowbird ski resort in Utah. The goal was simple: streamline development by combatting “heavyweight processes” which burdened devs and slowed down software delivery cycles.

“It promoted lighter, easier ways of developing software by capturing what a small group of practitioners had in common, and making those attitudes available to others who were struggling under heavyweight approaches,” he told ITPro.

The inspiration behind the manifesto lay in long-running gripes with traditional development approaches such as Waterfall. According to Jon Rimmer, CXO at Mercator Digital, this approach was rigid, inefficient, and at times painfully slow.

A key factor here is that under this methodology, teams worked through phases in a linear fashion, with each of these required to be completed before moving on.

“The traditional ‘Waterfall’ approach meant you could spend six months planning - and then a further three years building - only to be completely divorced from the end users and the real environment,” Rimmer told ITPro.

With Agile development, however, flexibility and adaptability were key focus areas. The 12 central principles outlined in the manifesto prioritized an array of factors, including faster delivery times through now-iconic ‘sprints’, rolling testing processes, continuous feedback, and smaller, more efficient teams.

Martin Reynolds, field CTO at Harness, told ITPro that the impact of Agile was “huge” when it hit the scene, adding that it highlighted and emphasized what efficient teams were already doing at the time.

“I’m old enough to remember when the Agile Manifesto launched – I was coding at the time – and its impact was huge,” he said.

“What it really did wasn’t to invent anything radically new, but codify what the best teams were already doing,” Reynolds added. “It gave the industry a common framework to move away from Waterfall, long release cycles, heavy documentation upfront, and very little ability to change course once things were underway.

“I can vividly remember projects where half the time was spent writing specs, only to hope everything fitted together months later. Agile flipped that on its head.”

What did Agile development actually improve?

Key focus areas of the Agile Manifesto helped drastically simplify software development, Reynolds noted.

By moving teams to smaller more regular releases, for example, this “shortened feedback loops” typically associated with Waterfall and improved flexibility throughout the development lifecycle.

“That reduced risk made it easier to respond to customer and business needs, and genuinely improved software quality,” he told ITPro. “Smaller changes meant testing could happen continuously, rather than being bolted on at the end.”

The longevity of Agile methodology is testament to its impact, and research shows it’s still highly popular. A survey from Forrester in early 2025 found 95% of respondents highlighted Agile practices as critical to their organization.

Notably, 58% of respondents said they’re still prioritizing adoption of Agile practices, underlining its continued popularity among business and technology professionals.

Manageable drawbacks

That’s not to say Agile doesn’t have some drawbacks, however. Reynolds noted that areas such as technical debt can become a burden due to the rapid nature of this approach.

“When teams are under constant pressure to deliver new features, debt can easily be pushed to the bottom of the backlog,” he told ITPro. “The problem is it doesn’t age well – it’s not like wine. It’s more like milk: the longer you leave it, the worse it smells.”

Moreover, scaling Agile across larger organizations has proved troublesome over the course of its lifespan. As ITPro previously reported, Digital.ai’s 2024 State of Agile survey found larger enterprises encountered significant challenges embracing Agile.

Simply put, the larger the company, the more fragmented teams become. This results in a scattered approach where some teams fully embrace the methodology while practices fall by the wayside in others.

Agile in the age of AI

With the rapid enterprise adoption of generative AI over the last three years, Agile methodology has once again been thrust into the spotlight.

Findings from Digital.ai’s 2025 State of Agile Report found AI is now helping supercharge Agile development, with teams using an array of tools to underpin and support processes.

More than three-quarters of respondents said they’re using AI to “save time or reduce manual effort”, for example, using the technology to auto-generate documentation or summarize retrospectives.

According to Kern, AI and Agile are “a match made in heaven” and the advent of the technology means this approach is no longer optional, albeit with a notable caveat.

“You need it more than ever,” he said. “You can build so much more in less time, which can also magnify potential pitfalls if you’re not careful. The speed of delivery with AI can easily outpace feedback, but that’s an exciting opportunity, not a flaw.”

Reynolds echoed those comments, noting that while Agile can be a force multiplier for teams, there are still risks – particularly with the influx of AI-generated code in software development.

“Those gains are often offset downstream, creating more bugs, higher cloud costs, and greater security exposure. The real value comes when AI is extended beyond code creation into testing, quality assurance, and deployment,” he said.

“Applied thoughtfully, it strengthens the fast feedback loops that Agile depends on and helps teams adapt more confidently as business requirements change,” Reynolds added.

“In that sense, AI doesn’t replace or outdate Agile – it reinforces the principles that have kept it relevant for the past quarter of a century and will ensure it remains so long into the future.”

FOLLOW US ON SOCIAL MEDIA

Development teams at generative AI firm Anthropic are now allowing Claude to effectively write itself, according to the company’s Labs chief Mike Krieger.

Speaking at the Cisco AI Summit on 3 February, Krieger told Cisco’s Jeetu Patel that “Claude is now writing Claude” as the company ramps up internal development processes.

“We're moving extremely quickly,” he said. “Right now for most products at Anthropic it's effectively 100% just Claude writing, and then what we've done is created all the right scaffolds around it to let us trust it.”

Krieger said the shift toward AI-powered coding has delivered marked benefits for teams, helping to not only speed up development processes but also in shoring up security.

Claude acts as a “super tough grader” for devs, according to Krieger, identifying potential flaws and enabling teams to fine-tune and tweak work.

“Having Claude trained and sort of prompted to be a really good adversarial code reviewer has been fantastic,” he told Patel.

“I’ll put up pull requests and Claude will come back and say ‘here are the security vulnerabilities, but here’s also how it could be refactored, here’s how it could be different’, it’s just really prompting to be a super tough grader,” Krieger added.

Anthropic has been keen to highlight the use of its own AI tools internally in recent months.

Findings from an internal survey published in December 2025 show engineers and researchers frequently use Claude for gaining a better understanding of codebases, refactoring tasks, and debugging code.

More than half (55%) of employees polled said they use Claude for debugging on a daily basis, for example.

AI in the driving seat for developers

Krieger’s comments come after Anthropic CEO Dario Amodei claimed AI would be writing 90% of code within just six months during a March 2025 conference appearance.

“I think we’ll be there in three to six months – where AI is writing 90% of the code,” he told attendees. “And then in 12 months, we may be in a world where AI is writing essentially all of the code.”

Krieger told Patel that “people thought it was crazy” at the time. However, Amodei and the company at large were confident that the technology would come to play an increasingly central role in development practices.

“We were already seeing that trajectory,” he said.

Anthropic isn’t the only company relying heavily on AI tools to speed up development and automate code production. In April last year, Microsoft CEO Satya Nadella revealed 30% of the company’s code was AI-generated while industry counterparts like Google have increased the volume of AI-written code.

The jury’s still out on AI coding

While the use of AI-generated code has been gaining traction over the last two years, research shows the jury’s still out on this trend.

As Krieger noted, development teams have established clear “scaffolds” to ensure responsible use.

This makes sense given repeated concerns about security and the potential for AI tools to produce flawed code, which could prove disastrous for enterprises.

A recent survey from Black Duck warned that AI-generated code is now among the top security-related concerns for developers and cyber practitioners. A key risk factor identified by Black Duck centered around the "illusion of correctness”, whereby developers take code produced by these tools at face value and fail to check and verify.

There are real world consequences as a result of this trend, separate research shows. In a survey from Aikido in October last year, one-in-five CISOs revealed they’d suffered serious security incidents due to AI-generated code.

FOLLOW US ON SOCIAL MEDIA

AI has overtaken all other factors in reshaping security priorities, with teams now forced to deal with AI-generated code that appears correct, professional, and production-ready – but that quietly introduces security risks.

That’s according to a new survey from Black Duck, which recorded a 12% rise in teams actively risk-ranking where LLM-generated code can and can’t be deployed last year.

Meanwhile, there was a 10% increase in custom security rules designed specifically to catch AI-generated flaws.

“The real risk of AI-generated code isn’t obvious breakage; it’s the illusion of correctness. Code that looks polished can still conceal serious security flaws, and developers are increasingly trusting it,” said Black Duck CEO Jason Schmitt.

“We’re witnessing a dangerous paradox: developers increasingly trust AI-produced code that lacks the security instincts of seasoned experts."

It's regulation that's forcing most security investment, researchers found, with the use of Software Bill of Materials (SBOM) up nearly 30%, and automated infrastructure verification surging by more than 50%.

Similarly, respondents reported an increase of more than 40% in streamlining responsible vulnerability disclosure, driven by the EU Cyber Resilience Act (CRA) and evolving US government demands.

"The surge in SBOM adoption reported in BSIMM16 is so critical, since it gives organizations the transparency to understand exactly what’s in their software — whether written by humans, AI, or third parties — and the visibility to respond quickly when vulnerabilities surface," said Schmitt.

"As regulatory mandates expand, SBOMs are moving beyond compliance — they’re becoming foundational infrastructure for managing risk in an AI-driven development landscape.”

A sharp focus on first and third-party code

Organizations are rapidly standardizing tech stacks, the survey noted. Black Duck found teams are now expanding visibility beyond first-party code as third-party and AI-assisted development explodes.

Security training is also being reinvented, researchers revealed, with multi-day courses now being replaced by just-in-time, on-demand guidance embedded directly into developer workflows in bite-sized chunks.

The use of open collaboration channels increased 29% year over year, giving teams instant access to security guidance on the fly.

AI-generated code is in vogue

Recent research from Aikido found that AI coding tools now write 24% of production code globally as enterprises across Europe and US ramp up adoption.

The trend has been gaining momentum for several years now, with a host of major tech providers such as Google and Microsoft revealing significant portions of source code is now written using the technology.

However, while this is speeding up production, research shows it also carries huge risks.

Aikido found that AI-generated code is now the cause of one-in-five breaches, with 69% of security leaders, engineers, and developers on both sides of the Atlantic having found serious vulnerabilities.

These risk factors are further exacerbated by the fact many developers are placing too much faith in the technology when coding. A separate survey from Sonar found nearly half of devs fail to check AI-generated code, placing their organization at huge risk.

FOLLOW US ON SOCIAL MEDIA

Software bloat has shifted from a technical annoyance to a measurable business risk. This is according to analyst firm IDC, which believes organizations are now facing a ‘complexity tax’ that directly erodes revenue and stalls innovation.

And the problem looks set to only get bigger. IDC forecasts that by 2028 there will be over one billion net-new applications – that’s in addition to the software that businesses are already struggling to manage.

Almost all of us have noticed apps getting larger, slower, and buggier. We've all had a Chrome window that's taking up a baffling amount of system memory, for example. While performance challenges can vary by organization, application and technical stacks, it appears the worst performance bottlenecks have migrated to the ‘last mile’ of the user experience, says Jim Mercer, program vice president, Software Development, DevOps and DevSecOps at IDC.

This is specifically the browser – e.g. the ‘Tab Tax’ – and the integration layers between fragmented SaaS tools, he notes, adding that in the age of AI, we’re also increasingly seeing challenges with inference latency.

“Commercial pressure has created a ‘velocity-over-quality’ challenge,” he says. “While architectural decisions and developer skills remain critical, they’re too often compromised by the need to integrate AI and new features at an exponential pace. So, [software bloat’s down to] a lack of due diligence when we should know better.”

In the open source world, the legacy challenge is also adding to bloat, notes Amanda Brock, CEO at OpenUK. “This is inevitably a growing challenge over time. I think it’s harder and harder for open-source projects to cope with the volume of contributions they’re getting, and AI is leading to larger amounts of code getting submitted.

“Without adequate funding and more skilled people, ecosystem maintenance suffers and important hygiene work, like stripping out superfluous code, is routinely deprioritized.”

AI – a double-edged sword

AI tools sit at the core of the debate around software bloat and optimization, seemingly bringing as many downsides as it does benefits.

In the short term, AI-generated code is likely to increase software bloat, as it optimizes for working, rather than efficient code, says Nell Watson, IEEE senior member, author and AI ethics engineer at Singularity University. “It tends toward completeness, handling every conceivable edge case, defensive patterns everywhere.

“There’s no feedback loop where AI learns from runtime performance or user complaints about sluggishness. Generating more code faster with less human scrutiny isn’t a recipe for lean software.”

The somewhat concerning part is that AI bloat is structurally different from traditional technical debt, she points out. Rather than accumulated cruft over time, it usually manifests as systematic over-engineering from day one. “That can make these deeply embedded, and much harder to identify and remove, especially in an era of ‘vibe coded’ systems.”However, the flipside is that it makes porting mission critical infrastructure to more secure and race-ready, resistant stacks such as those based on Rust far easier, she adds. This is especially true for translating more obscure languages in legacy systems, “which counteracts some of these issues with bloat and maintainability”.

Data center challenges will reshape software design

In the long-term, the growth of AI is expected to lead to new tools that will help streamline software applications. “New markets for code modernization and review will help reduce maintainability concerns,” says Jim Scheibmeir, VP analyst at Gartner. “However, this means more tools in the toolbox and additional costs for modern software engineering licenses and subscriptions,” he adds.

Software optimization has become even more important due to the recent RAM price crisis, driven by surging demand for hardware to meet AI and data center buildout. Though the price increases may be levelling out, RAM is now much more expensive than it was mere months ago. This is likely to shift practices and behavior, Brock explains:

“When I was in China late last year, there were conversations around how developers there are obsessed with efficiency in the way they write code and build AI, largely because they have less access to compute.

“I think that’s going to have a real impact on how things play out. If you look at the bigger picture, we’re now in an arms race around data centers and getting enough compute and – crucially – enough power to run them. That’s going to be hugely problematic.

“Because of that, the leaner and more efficient the software is, the better it’s going to perform. The same applies to AI, and we’ll definitely see more of a shift towards small language models (SLMs). I think data center capacity, and the limits around energy and infrastructure, are going to be a key driver in shaping what our software looks like going forward.”

The importance of software hygiene

Looking forward, Brock believes that software hygiene is only going to become more important, “and we’re really only just starting to look at it,” she says.

“I know people who are rewriting parts of code to make them more secure in Rust, or to run slimmer, leaner operating systems so they can deploy data centers in emerging markets like Africa. If you have the right OS, you can reduce a data center down to the size of a cupboard and roll it out very quickly.”

Security will play a role too, particularly with the growing data sovereignty debate and concerns about bad actors, she notes. Leaner, neater, shorter software is simply easier to maintain – especially when you discover a vulnerability and are faced with working through a massive codebase.

“Questions around security, sustainability, access to technology, the efficiency, cost and availability of compute, and data center capacity and energy all feed back to the same point. They ultimately push upstream to the software itself – how it’s written and how it’s maintained. I think pressure to streamline software will be universal.”

To de-risk your software estate and protect performance over the coming years, Mercer recommends using platform engineering to help with governance. “Also look towards software normalization and vendor consolidation, and consider unified platforms where possible,” he says.

It also comes down to embedding good practices, Brock adds. “It’s about creating internal discipline among users and project creators: being conscious about not adding superfluous software and making the time to apply real rigor in removing historic bloat. That means recognizing that this genuinely is an issue,” she concludes.

AI tools are helping improve efficiency for software developers, but it may result in many losing key skills in the long-term.

That's according to a pre-print of a study on AI and skills formation conducted by a pair of fellows at Anthropic, which suggests there may be downsides to frequent AI use.

The study comes amid questions about the productivity boost offered by these technologies, as well as their wider impact, be it on jobs or on human creativity and critical thinking. .

The Anthropic paper — authored by fellows Judy Hanwen Shen and Alex Tamkin — sought to unpick the relationship between AI use and skills formation by studying how participants picked up new skills while using the technology in daily tasks.

To test this, they randomized experiments that measure skill formation, giving 51 participants a coding task that used a Python library they hadn't used before, later evaluating how well they learned that library.

The researchers tracked whether using AI boosted productivity for coding tasks that required new concepts or tools and whether that led to participants learning less about those new concepts and tools.

All told, researchers found that the productivity gains afforded by AI were offset by the fact participants lacked a deeper knowledge in core areas. Indeed, the technology could ultimately “inhibit skills formation”.

"Participants who fully delegated coding tasks showed some productivity improvements, but at the cost of learning the library," they reported in their paper.

"Our findings suggest that AI-enhanced productivity is not a shortcut to competence and AI assistance should be carefully adopted into workflows to preserve skill formation – particularly in safety-critical domains."

Less time coding, less time learning

Notably, the results suggest AI assistance didn't lead to a statistically significant faster task completion, though those using no AI did take slightly longer to complete tasks.

After the task was completed, participants were given a score to test how well they learned the new library. Those who were assisted by AI posted scores ranging from below 45% to just shy of 60%, while those who didn't use AI all scored above that mark.

The results differed depending on how much coding experience a participant had, however. Novice developers, for example, posted a more significant benefit in performance than their colleagues with four years or more of coding experience.

When it came to quiz scores, those with no AI assistance posted better scores regardless of their level of coding experience.

The researchers suggested that the failure to significantly boost productivity can be pinned on participants spending time exploring the AI assistant, adding that the amount of time spent directly coding did fall.

"Several participants spent substantial time interacting with the AI assistant, spending up to 11 minutes composing AI queries in total," the researchers said, adding: "Using AI decreased the amount of active coding time. Time spent coding shifted to time spent interacting with AI and understanding AI generations."

No simple answers

The researchers broke down the results into six "AI interaction patterns" that might help shed light on the best way to use AI for work and learning.

Those who fell into the "AI delegation" group used AI to entirely write their code, getting the fastest results but scoring poorly on the quiz.

The "progressive AI reliance" group asked a few questions first before delegating all code to the tool; they also scored poorly on the quiz.

Elsewhere, the "iterative AI debugging" cohort used the AI to debug and verify their own code, but "relied on the assistant to solve problems, rather than clarifying their own understanding," so they failed the quiz and also took a long time to finish the task.

The next three groups all scored above 65% on the quiz, suggesting they managed to use the AI tool while also learning new skills. The fastest of these three were those who asked "conceptual" questions of the AI to boost their understanding before completing the task, learning as they went.

Crucially, researchers found two other groups used AI to better understand their task as well: the first generated code and then unpicked how it worked themselves, while the other asked for explanations of the generated code so they could learn as they went.

Both took longer to complete the task, but this had a positive impact on broader understanding and capabilities. What this underlines is the fact that AI can help boost skills if deployed in the right way.

"Participants in the new AI economy must care not only about productivity gains from AI but also the long-term sustainability of expertise development amid the proliferation of new AI tools," they added.

Critical thinking on the line

This research is the latest in a string of studies to highlight the balancing act with frequent AI use among knowledge workers of all varieties.

In February last year, research from Microsoft on the impact of ChatGPT showed frequent use could have a negative impact on critical thinking skills.

The study, conducted alongside researchers from Carnegie Mellon University, warned that workers using the tool encountered “diminished independent problem-solving” skills.

Similar research from MIT in June also highlighted the risks of overreliance on AI tools, noting that those using the technology at length saw a marked decline in critical thinking and evaluation skills.

FOLLOW US ON SOCIAL MEDIA

The share of code written or relying on AI in the US rose from 5% in 2022 to 29% at the end of 2024, underlining huge growth among developers and engineers.

That's according to academic research out of the Complexity Science Hub (CSH) and published in Science. Researchers studied 30 million Python contributions from 160,000 developers on GitHub — ironically by using an AI model to spot whether blocks of code were created using AI tools including ChatGPT or GitHub Copilot.

"The results show extremely rapid diffusion," said Frank Neffke, leader of the Transforming Economies group at CSH, in a statement. "In the US, AI-assisted coding jumped from around 5% in 2022 to nearly 30% in the last quarter of 2024."

The data showed American coders were the most likely to use AI in their work of the regions studied, followed by France at 24% and Germany at 23%.

The continued take-up of AI coding tools is no surprise given half of developers think large language models (LLMs) can code better than most humans — though issues around accuracy continue to hold the idea back.

In the UK, a survey by JetBrains revealed British coders are more cautious than peers globally when it comes to using AI tools — with a quarter saying they're still uncertain about its use in their work.

Playing catchup

Notably, AI-generated coding is taking off in India, with uptake standing at 20%. Neffke said the trend is “catching up fast” across the country.

Russia and China "lagged" at 15% and 12% respectively — but in the year since the data was collected, that's likely changed.

"It's no surprise the U.S. leads – that's where the leading LLMs come from," said Johannes Wachs, a faculty member at CSH and associate professor at Corvinus University of Budapest.

"Users in China and Russia have faced barriers to accessing these models, blocked by their own governments or by the providers themselves, though VPN workarounds exist."

He added: "Recent domestic Chinese breakthroughs like DeepSeek, released after our data ends in early 2025, suggest this gap may close quickly."

Benefits of experience

The study found software programmers with less experience were more likely to use AI, with 37% of their code featuring it in some way, versus 27% for their more skilled colleagues. However, the research suggests that more experienced coders are seeing the most productivity gains — suggesting human skills still matter.

"Beginners hardly benefit at all," said Simone Daniotti, a researcher at CSH and Utrecht University, in a statement.

That also suggests that generative AI may widen existing skills gaps between coders, rather than help less experienced programmers catch up effortlessly.

The study noted that experienced developers are more likely to use AI to help experiment, such as with new libraries or tools.

"This suggests that AI does not only accelerate routine tasks, but also speeds up learning, helping experienced programmers widen their capabilities and more easily venture into new domains of software development," said Wachs.

The gaps in uptake and benefits mean AI adoptions could exacerbate existing problems — something governments and companies should keep in mind.

"For businesses, policymakers, and educational institutes, the key question is not whether AI will be used, but how to make its benefits accessible without reinforcing inequalities," added Wachs.

FOLLOW US ON SOCIAL MEDIA

A majority of developers are using AI to create code, but even though most don't trust the output, they're failing to take steps to verify it.

That's according to a survey from code review company Sonar, which found that 72% of developers use AI tools every day, with the technology helping to write up to 42% of committed code.

Notably, 96% of developers surveyed said they don't fully trust that AI-generated code is functionally correct – but fewer than half say they review it before committing.

Sonar said this leads to "verification debt", a term used by AWS CTO Werner Vogels while discussing the use of AI in software development at the company's annual re:Invent conference in December.

Tariq Shaukat, CEO of Sonar, said the research highlights a “fundamental shift” in software development, whereby value is no longer simply defined by the speed at which code can be written, but by the "confidence in deploying it”.

"While AI has made code generation nearly effortless, it has created a critical trust gap between output and deployment,” he said. "To realize the full potential of AI, we must close this gap."

Why devs are slacking on AI-generated code

There may be a good reason for the failure to check AI-generated code, the study noted, mainly as it typically takes more time than reviewing human-written code.

"While AI is supposed to save time, developers are spending a significant portion of that saved time on review," the Sonar report said, adding: "In fact, 38% of developers say reviewing AI-generated code requires more effort than reviewing code written by their human colleagues."

One reason for that is AI often produces code that looks correct but isn't reliable, a statement that 61% of respondents agreed with.

"That's a critical finding — it means AI code can introduce subtle bugs that are harder to spot than typical human errors," the report noted. "The same percentage (61%) agree that it 'requires a lot of effort to get good code from AI' through prompting and fixing."

How developers are using AI

The survey found the most common use for AI by developers was for proofs of concept and prototypes (88%), followed by the creation of production software for internal, non-critical workflows (83%), customer-facing applications (73%), and business-critical internal software (58%).

Those surveyed said AI was most effective at writing documentation, explaining existing code, and vibe coding. Just 55% of those polled said such tools were effective for assisting development of new code, but that task had the highest adoption rate at 90%.

"Developers have embraced AI as a daily partner, but they're finding it's a much better 'explainer' and 'prototyper' than it is a 'maintainer' or 'refactorer' — at least for now," the report states.

"It's highly effective at generating new things (docs, tests, new projects) but struggles more with the complex, nuanced work of modifying and optimizing existing, mission-critical code."

Too much trust in AI tools

The Sonar report is the latest in a string of studies highlighting the benefits of AI for developers, but a prevailing lack of trust among many on their outputs.

Best practices have also been slipped among many since the influx of these tools in the profession, research shows. In a survey from Cloudsmith last year, for example, nearly half of developers (42%) said their codebases are now largely AI-generated.

Respondents specifically highlighted productivity and efficiency gains while using the technology, yet only 67% said they actively review code before deployments.

Cloudsmith warned this lax approach to code testing and reviews could have dire consequences for enterprises, leaving them open to an array of security risks and vulnerabilities.

FOLLOW US ON SOCIAL MEDIA

Microsoft is reportedly reshuffling internal teams as part of a drive to stave off competition from up-and-coming AI coding startups and key competitors in the space.

According to reports from Business Insider, the tech giant has embarked on an overhaul of GitHub, aiming to ramp up agentic AI options and position the software development platform as the go-to option for developers.

Sources told the publication the move comes as both Microsoft and GitHub face heightened competition from key providers in the industry, such as Anthropic and Cursor.

Anthropic’s Claude Code tool has quickly emerged as one of the most popular AI tools for software developers globally, with other up-and-coming providers such as Cursor and Loveable gaining significant traction.

Microsoft appears concerned that competitors are now muscling in on GitHub’s dominant position in the space.

The tech giant acquired GitHub for $7.5 billion in 2018, and closer integration between the two has accelerated in recent years.

A new direction for Microsoft and GitHub

The overhaul at GitHub comes in the wake of a new focus for the tech giant toward improving internal synergy on AI offerings.

In January last year, chief executive Satya Nadella announced the launch of a new internal AI division dubbed ‘CoreAI - Platform and Tools’ and led by Jay Parikh. This, he said at the time, aimed to bolster collaboration between the AI and software engineering divisions.

A key focus here, according to Nadella, centered around enabling customers to build and deploy AI agents and applications in an easier manner by creating a singular stack spanning the breadth of its AI and Copilot solutions – with a build-out of GitHub Copilot another main objective.

The report from Business Insider points to an acceleration of this strategy and comes during a period of flux for GitHub. In August last year, GitHub CEO Thomas Dohmke announced his departure, having held the position since 2021.

Dohmke had deep roots at the company, first joining Microsoft in 2015 following the acquisition of his startup, HockApp.

As ITPro reported at the time, Dohmke’s departure signaled big changes for the developer platform, with its leadership team directly reporting to the CoreAI organization under Parikh.

Separate reports from CNBC noted that the remaining GitHub executives would report to Julia Liuson, former head of Microsoft's developer division and now an executive at the CoreAI group.

GitHub’s popularity is cemented

In GitHub, Microsoft has its hands on one of the most popular platforms for developers globally. At the time of Dohmke’s departure, the platform boasted over 150 million users, more than doubling from 73 million in 2021.

A key factor in its surging popularity across this period was the release of its Copilot assistant tool, launched under the leadership of Nat Friedman in 2021, which offers developers code suggestions and support.

A slew of AI features have been added to the service since then, and with the advent of agentic AI last year the shift toward coding agents has accelerated.

In May, GitHub announced the launch of a new dedicated coding agent at Microsoft Build 2025. This is designed to tackle “low-to-medium complexity tasks” and formed part of a sweeping update to the platform.

It isn’t alone in offering these types of services, however. Cursor Agent, for example, is capable of completing “complex coding tasks independently”, according to the company.

FOLLOW US ON SOCIAL MEDIA

Software development is expected to continue evolving at pace across 2025, according to industry experts, with technologies such as AI prompting an overhaul of traditional processes and practices.

The profession has been in the midst of a significant transformation over the last two years, largely due to the advent of generative AI and, more recently, agentic AI.

Stack Overflow’s 2025 Developer Survey found 84% of developers were using – or planning to use – AI in their workflows, for example.

Similar research from JetBrains underlined the scale of AI adoption across the profession, with the 2025 State of Developer Ecosystem finding 85% use the technology frequently in daily tasks.

The influx of AI tools in software development was a contentious topic across 2025, prompting concerns about security, the impact on junior developers, and the prospect of widespread job cuts as processes are automated.

While these alarmist claims have grabbed headlines and airtime, what has become clear is that developers themselves will have to adapt and evolve to compensate for the use of the technology, as GitLab field CTO Marco Caronna told ITPro in December 2025.

Shifting developer priorities

Across the year ahead the focus will change, however. Martin Reynolds, field CTO at Harness, believes that the excitement surrounding AI-powered coding will subside as teams shift their focus toward better quality control practices.

“Organizations will move beyond using AI for coding alone, applying it to enhance testing and quality control,” he said. “AI-powered coding is becoming more refined and is already helping teams move faster, but so far, productivity gains at the front end have been erased by downstream bottlenecks.”

These "downstream bottlenecks” Reynolds refers to include an influx of bugs and “greater security exposure”. Both these issues were recurring talking points throughout 2025.

Research from CodeRabbit in December found that while developers may be moving quicker and improving productivity with AI, these benefits are offset by the fact they’re spending time fixing flawed code or tackling security issues.

Reynolds warned developer teams need to address the issue and reevaluate processes to streamline the broader development lifecycle.

“If left unchecked, this velocity problem will get out of hand fast – after all, no human can check thousands of lines of code and be expected to catch every issue,” he added.

So how will this quality control focus unfold? Reynolds noted that AI agents could play a key role here. There’s a sense that teams will essentially be stacking agents on top of assistants, but this could help reduce workloads and pick up slack for developers in what he described as a “continuous quality control” practice.

“This means crafting intelligent pipelines with multiple agents that can manage AI, optimize deployments, predict potential failures with high accuracy, and resolve incidents autonomously,” he explained.

“These agents will use a variety of models depending on their specific function,” Reynolds added. “This will be a real breakthrough for AI-assisted development in 2026, building trust in AI across the SDLC and ushering in a wave of automated processes that no longer require a human in the loop.”

Vibe coding will mature

“Vibe coding” was named the Word of the Year by Collins Dictionary, and the trend is likely to continue in 2026. Vibe coding involves using AI to automate coding processes, and gained significant traction early on last year after OpenAI co-founder Andrej Karpathy coined the term.

Research from Fastly in September found the practice was becoming more popular among developers, particularly those at a senior level. A host of industry figures, including Google CEO Sundar Pichai, hailed the trend as a landmark shift in software development.

Steven Webb, Capgemini’s UK CTO, believes 2026 will be the year when “AI-native engineering goes mainstream” as vibe coding practices mature and AI code generation gains further traction.

“Vibe coding, already crowned Collins’ Word of the Year for 2025, will take off in earnest, fundamentally reshaping software delivery pipelines,” he said.

This isn’t simply about speeding up development processes, however. Webb noted that AI code generation represents an opportunity to streamline modernization for enterprises globally.

“AI-driven code generation can rewrite legacy estates, reduce technical debt, and refactor entire modules autonomously, enabling organizations to break free from brittle, ageing systems at a pace previously impossible,” he claimed.

Security and governance in the spotlight

Webb warned that while AI has great potential in these areas, this means “trust again becomes a major concern”.

“Organizations will need strong traceability, provenance controls, and automated assurance mechanisms to ensure safety, security, and long-term maintainability,” he said.

“The maturity journey ahead is significant, but once confidence is established, we’ll see widespread, production-scale adoption.”

AI-related security concerns are multi-faceted, with cybersecurity practitioners warning about the malicious use of the technology and “shadow AI” as well as the fact the technology could create downstream security risks for development teams.

JetBrains’ State of Developer Ecosystem study found many devs are still wary about handing the reins over to AI tools entirely. Nearly half (48%) told the firm they prefer to “stay hands-on” when using AI in core tasks such as testing or code reviews.

Reynolds echoed Webb’s comments on security and trust, adding that the rapid pace of AI adoption could have a significant impact on software supply chain security in 2026.

“Many enterprises will say they have learnt supply chain security lessons after 2023’s SolarWinds breach – but that doesn’t mean their AI has,” he said.

“With AI expanding software supply chain volume and complexity, similar incidents become more likely and severe, as a single compromised component could cascade across thousands of enterprises.”

Reynolds warned that many AI coding tools are “trained on historical repositories”, meaning there’s a risk they lack “real-time CVE awareness and will happily draw from vulnerable libraries”.

AI-generated code is an equally pressing issue for developers, he added.

“Developers can’t trace where suggestions originated or whether they incorporate licensed code or vulnerable components,” Reynolds explained. “That makes it near-impossible to work backwards and identify if the company’s software is affected by issues like Log4Shell.”

FOLLOW US ON SOCIAL MEDIA

Microsoft plans to replace C and C++ with Rust within the next five years as part of a major engineering modernization project – but a senior company figure insists AI won’t be doing the heavy lifting after a social media backlash.

In a post on LinkedIn advertising a job opening last week, Galen Hunt, Distinguished Engineer at Microsoft, said the tech giant plans to “eliminate every line of C and C++ from Microsoft by 2030”.

The scale of the project here is significant, with Hunt suggesting that developers will be working toward refactoring upwards of one million lines of code on a monthly basis.

“Our North Star is ‘1 engineer, 1 month, 1 million lines of code’,” Hunt wrote. “To accomplish this previously unimaginable task, we’ve built a powerful code processing infrastructure. Our algorithmic infrastructure creates a scalable graph over source code at scale.”

“Our AI processing infrastructure then enables us to apply AI agents, guided by algorithms, to make code modifications at scale,” he added. “The core of this infrastructure is already operating at scale on problems such as code understanding.”

The move from Microsoft marks the latest in its shift to the Rust programming language in recent years. In 2022, David Weston, corporate VP for OS security and enterprise at Microsoft, revealed the company was investing around $10 million in Rust to make it the company's "1st class language" for engineering systems.

As ITPro reported back in 2023, the company made a significant leap on this front with the introduction of Rust-based kernel features on Windows as part of the Windows 11 Insider Preview Build 25905.

Progress has continued at pace in the intervening years. During a keynote presentation at RustCon 2025 in September, Azure CTO Mark Russinovich detailed the company’s efforts to embrace Rust, per reports from The New Stack.

Microsoft's Rust project courts controversy

Initially, Hunt hinted at the use of AI in helping Microsoft deliver on the goal of rewriting some of the company’s largest codebases.

The suggestion tracks with how the tech giant is using the technology in software development over the last two years. In May this year, CEO Satya Nadella revealed up to 30% of the company’s code is now written by AI.

However, Hunt’s comments appear to have courted controversy, prompting an edit on the original post to clarify that “Windows is *NOT* being rewritten in Rust with AI”.

Hunt insisted this is a research project aimed at “building tech to make migration from language to language possible”.

“The intent of my post was to find like-minded engineers to join us on the next stage of this multi-year endeavor—not to set a new strategy for Windows 11+ or to imply that Rust is an endpoint,” he wrote.

Rust is in vogue

Microsoft isn’t the only company making the shift to Rust. Last year, Lars Bergstrom, director of engineering at Google’s Android team, said developer teams embracing the programming language have unlocked marked productivity and efficiency benefits.

A 2024 project from DARPA also saw the US government agency announce plans on this front, this time actually using AI tools to translate C code to Rust.

A key factor behind the shift to Rust lies in security. Popular languages such as C and C++ have suffered from recurring security-related issues, making them vulnerable to bugs due to how they use memory.

These ‘memory-safety vulnerabilities’ have become a frequent pain point for enterprise security teams and developers alike, and have caught the attention of security agencies on both sides of the Atlantic.

In 2022, the US National Security Agency (NSA) urged organisations to shift to memory-safe programming languages, such as Rust, Python, or Java. More recent guidance from the NSA and CISA, meanwhile, once again urged devs to make the shift.

FOLLOW US ON SOCIAL MEDIA

OpenAI has launched new capabilities for its Codex coding agent aimed at streamlining ease of use and customization for software engineers.

The Skills in Codex service will provide users with a package of handy instructions, resources, and scripts based on the specific individual needs of developers.

Essentially, these ‘skills’ available for users allow them to customize agents for particular tasks, either through pre-made options, or by building their own from scratch.

Users creating their own skills can do so through natural language prompts, the company noted, or have the ability to manually build specific scripts.

“Agent Skills let you extend Codex with task-specific capabilities,” the company said in a blog post. “A skill packages instructions, resources, and optional scripts so Codex can perform a specific workflow reliably.”

“You can share skills across teams or the community, and they build on the open Agent Skills standard.”

What Codex skills means for users

For OpenAI, the aim here is to allow developers to improve customization of the Codex coding tool, allowing developers to tweak and fine-tune agents for repeatable tasks.

The skills bundles mean against can continue working away in the background in a more reliable and autonomous manner. They’re instructions for the agents which remove the need for devs to repeatedly create specific prompts each time they require one to perform an action.

Notably, the service recommends specific skills for agents depending on what development teams are working on. These pre-built packages are available via GitHub, the company noted.

The launch comes hot on the heels of a sweeping round of updates for the agentic coding tool, with OpenAI having launched GPT-5.2-Codex last week.

As ITPro reported, this update saw marked performance and accuracy improvements, along with new cybersecurity-focused features. OpenAI described GPT-5.2-Codex as its "most advanced agentic coding model yet".

Skill for agents

OpenAI isn’t the only major AI developer to launch similar ‘skills’ packages for developers. AWS’ take on this trend saw the company launch a range of ‘powers’ for its Kiro coding agent.

These new powers, unveiled at the company’s annual re:Invent conference earlier this month, also allow developers to pick and choose - and tweak - powers for the coding agent.

Anthropic has also made significant headway on this front for developers. In October, the company launched its Agent Skills service, again giving users reusable resources, scripts, and instructions.

The AI developer has gone one step further this month, however. According to reports from VentureBeat, the company will now release Agent Skills as an open standard.

"We're launching Agent Skills as an independent open standard with a specification and reference SDK available at https://agentskills.io," Mahesh Murag, a product manager at Anthropic, told VentureBeat.

"Microsoft has already adopted Agent Skills within VS Code and GitHub; so have popular coding agents like Cursor, Goose, Amp, OpenCode, and more. We're in active conversations with others across the ecosystem."

FOLLOW US ON SOCIAL MEDIA

Software developers face an array of productivity-related hurdles in their daily workflows. From tool sprawl to cumbersome workloads and, more recently, AI integration challenges.

However, another area that’s also proving troublesome is documentation, according to Stack Overflow.

Research from the company shows missing, fragmented, or inconsistent documentation was identified by developers as one of their biggest productivity barriers in 2025.

But as Stack Overflow found, they're not exactly helping themselves on this front, with many shirking responsibilities.

Indeed, fewer than one-third (30%) of developers revealed they document code on a daily basis. Meanwhile, nearly half (40%) fail to do so each week, and none reported documenting on a monthly basis.

Why documentation matters in software development

Well-maintained documentation is a key component of the software development lifecycle (SDLC), according to Maurice Kalinowski, product director at Qt Group.

This allows developers to explain notable features of a particular project, detail progress, or provide information on a specific code base.

Imagine joining a project late and being given no information on progress or where the rest of your team is at? That’s the challenge devs face without proper documentation.

“One of the bigger benefits of architectural documentation is how it functions as an onboarding resource for developers,” Kalinowski told ITPro.

“It’s much easier for new joiners to grasp the system’s architecture and design principles, which means the burden’s not entirely on senior team members’ shoulders to do the training," he added.

“It also acts as a repository of institutional knowledge that preserves decision rationale, which might otherwise get lost when team members move to other projects or leave the company."

The cost of poor documentation

According to Stack Overflow, failures on this front create glaring knowledge gaps that not only frustrate developers, but end up slowing down teams and hampering long-term development processes.

Stack Overflow’s study isn’t the only piece of research to highlight the productivity-related implications of poor documentation.

Atlassian’s 2025 State of DevEx report, for example, found half of developers lose around 10 hours a week just sourcing basic information they need to do their jobs.

Sven Peters, AI evangelist at Atlassian, told ITPro this highlights the need for a concerted focus on improving documentation: developers are wasting time that could otherwise be spent on critical tasks.

“Every day, developers lose time because of inefficiencies in their organization – they get bogged down in repetitive tasks and waste time navigating between different tools,” he said.

“They also end up losing time trying to locate pertinent information – like that one piece of documentation that explains an architectural decision from a previous team member,” Peters added.

“If software development were an F1 race, these inefficiencies are the pit stops that eat into lap time. Every unnecessary context switch or repetitive task equals more time lost when trying to reach the finish line.”

Can AI help the situation?

With an influx of AI tools in software development, Stack Overflow questioned whether the use of the technology could help improve matters on this front.

However, developers show little appetite for capitalizing on AI. More than one-third (39%) of respondents said they have no plans to use AI for documenting code.

Similarly, 40% said they don’t plan on using AI for “creating or maintaining other documentation”.

“Documentation and deployments appear to either be not routine enough to warrant AI assistance or otherwise removed from existing workflows so that not much time is spent on it,” the company said.

Entry-level devs are bearing the brunt

For developers of all experience levels, Stack Overflow highlighted a concerning divide in terms of documentation activities.

Senior developers, for example, spend the least time documenting in their daily workflows while mid-career devs spend more time and experience the most frustration.

This has a trickle down effect on developer teams, the study warned, harming broader knowledge exchange and impacting early-career developers.

Essentially, those with less experience end up suffering from a lack of clear documentation, which impairs their understanding of particular projects or code bases.

FOLLOW US ON SOCIAL MEDIA

AI is helping developers write code faster, but it's also leading to more problems, marking the latest study to highlight adoption concerns among software developers.

In a study from CodeRabbit, researchers found AI makes 1.7 more times as many mistakes as human programmers.

To come to that conclusion, CodeRabbit looked at 470 open source GitHub pull requests, of which 320 had AI input and 150 were human only.

"The results? Clear, measurable, and consistent with what many developers have been feeling intuitively: AI accelerates output, but it also amplifies certain categories of mistakes," wrote CodeRabbit's director of AI David Loker in a blog post.

He admitted the study wasn't perfect, in part because it was difficult to double-check authorship, but said the findings matched with previous research. Loker pointed to a report by Cortex that found pull requests per author increased by 20%, but incidents per pull request also went up — by 23.%.

That matches with previous research suggesting AI-generated code is now the cause of one-in-five breaches, with another report noting coders' concerns around AI introducing errors to their work.

More problems and more critical flaws

The CodeRabbit study found 10.83 issues with AI pull requests versus 6.45 for human-only ones, adding that AI pull requests were far more likely to have critical or major issues.

"Even more striking: high-issue outliers were much more common in AI PRs, creating heavy review workloads," Loker said.

Logic and correctness was the worst area for AI code, followed by code quality and maintainability and security. Because of that, CodeRabbit advised reviewers to watch out for those types of errors in AI code.

"These include business logic mistakes, incorrect dependencies, flawed control flow, and misconfigurations," Loker wrote. "Logic errors are among the most expensive to fix and most likely to cause downstream incidents."

AI code was also spotted omitting null checks, guardrails, and other error checking, which Loker noted are issues that can lead to outages in the real world.

When it came to security, the most common mistake by AI was improper password handling and insecure object references, Loker noted, with security issues 2.74 times more common in AI code than that written by humans.

Another major difference between AI code and human written-code was readability. "AI-produced code often looks consistent but violates local patterns around naming, clarity, and structure," Loker added.

Beyond those issues, Loker noted flaws in concurrency, formatting, and naming inconsistencies — all of which could not only cause issues with software or apps, but also make it harder for human reviewers to spot problems.

What's happening, and how to fix it

Some of the faults are down to a lack of context, Loker suggested, and in other cases AI is sticking to "generic defaults" rather than company rules, such as with naming patterns or architectural norms.

Security problems may be down to how models recreate "legacy patterns or outdated practices" by using older code as training data.

"AI generates surface-level correctness: It produces code that looks right but may skip control-flow protections or misuse dependency ordering," Loker added.

None of this means AI shouldn't be used in coding, he stressed. Instead, companies should ensure AI has context of business rules, policies or style guides, and be given guidelines for basic security.

Such efforts would wipe out many of the faults spotted, he said. Similarly, code reviewers should be given a checklist that takes this research into account, so they know what types of errors to watch out for.

"The future of AI-assisted development isn’t about replacing developers," he added. "It’s about building systems, workflows, and safety layers that amplify what AI does well while compensating for what it tends to miss."

FOLLOW US ON SOCIAL MEDIA

Software developers may be forgiven for worrying about their jobs in 2025, but GitLab Field CTO Marco Caronna believes the end result of AI adoption will be larger teams, not an onslaught of job cuts.

New research from GitLab shows a steep increase in the use of the technology across the profession, with 99% currently using – or planning to use – AI across the software development lifecycle.

Similarly, more than half (57%) of devs now use more than five tools for software development. This influx of AI tools is transforming the profession, with 75% revealing the technology will “significantly change” their roles within the next five years.

However, as the study noted, this is creating a “paradox” for teams. Concerns over security, compliance, and skills are rising, prompting a rethink of traditional operating frameworks.

More than two-thirds (67%) of respondents said AI is making compliance management “more challenging” for their organization, for example.

Speaking to ITPro in the wake of the report’s publication, Caronna said the current pace of change in software development means many companies are “facing issues in keeping up”.

That’s not because AI is difficult to use, either. Indeed, it’s “quite the opposite”, he told ITPro.

“It's way too easy to use, which basically means that most enterprises who are conscious about compliance, security, costs, they find themselves in a situation where the adoption of these new tools becomes extremely complex,” he explained.

“They start having issues from a compliance standpoint and from a security standpoint, because the data path of information becomes unclear, and also from a cost perspective, it becomes a little bit more challenging.”

The rise of ‘AI platform engineering’

The solution here, Caronna suggested, will be an evolution of platform engineering practices that take into account AI, fusing the technology across various teams to fine-tune the development lifecycle.

Platform engineering has long been employed as a means to embed security and compliance considerations within the broader development lifecycle, creating closer synergy between developer, security, and operations teams.

But while AI may speed up development practices, it creates new risk surfaces, for example, through flaws in AI-generated code. More than three-quarters (78%) of respondents specifically highlighted this issue, noting they’d experienced problems with code created using “vibe coding practices”.

With this in mind, Caronna suggested augmenting the practice to compensate for these potential issues could be the key to safer AI-infused development processes.

“I do expect that we will end up with an ‘AI platform engineering practice’, or it’s probably going to have a better name. I’m not good at marketing messages,” he said.

“It’s going to be a team of experts who understand how to correlate the different agents, how to make them work together, and then publish those capabilities to the consumers,” Caronna added.

“So just like platform engineering teams to actually publish the capabilities that can be used in cloud providers, on-premises and so on and so forth; there's going to be a similar pathway for AI adoption.”

Shifting left is critical

A key component of this transition will be a concerted focus on “shifting left” to tackle lingering issues with AI.

The technology has already influenced this shift, research shows. A May 2025 study from AI security firm Pynt, for example, found enterprises are ramping up efforts to shift left to bolster software security and tackle AI-related risks.

Placing a stronger emphasis on security will help break down long-standing barriers and bottlenecks for developer teams, Caronna said. Shifting left essentially helps weed out issues earlier in the lifecycle, preventing headaches further down the line.

“If you don’t start implementing a practice where you move security towards the very beginning of the coding [process], at that point what happens is that your developers are going to be chasing security issues in production,” he told ITPro.

“The closer you get to production, the more expensive it becomes to fix security issues, but also performance issues or features and capabilities issues,” Caronna added.

“So the reality is that when we talk about the prerequisites [for AI adoption] this shift left, potentially even shift left testing, that's a prerequisite that needs to happen. Once those prerequisites are in place. At that point, we can really start talking about how to adopt AI so that we can write secure code by default.”

Devs aren’t going anywhere

This transitional period will ultimately result in larger teams, according to Caronna and GitLab. Three-quarters (75%) of respondents told the firm that as AI becomes more deeply embedded within development practices, this will require more engineers.

The thinking here is that software development is never going to be fully automated, and enterprises will be keen to keep humans in the loop across the lifecycle.

Indeed, only one-third of respondents said they’d trust AI to handle daily tasks without human review. This isn’t limited to developer teams, either. With more AI tooling, enterprises face greater security and compliance risks, meaning more staff in these respective domains will likely be required.

The outlook here runs counter to the prevailing sentiment among many developers and industry stakeholders over the last year. Across 2025, concerns about the impact of AI on developers have reached boiling point, spurred on by alarmist comments from leading industry figures.

Meta CEO Mark Zuckerberg and Salesforce chief Marc Benioff have both hinted at not needing developers due to the technology.

Caronna said businesses now face two paths looking ahead. They can lean into the benefits of AI, allowing it to fuel future growth and support the creation of better software, or fall into the trap of thinking it’s an excuse to cut staff.

A slew of businesses have opted for the latter approach, and ultimately, it could prove detrimental.

“AI is not fully replacing developers,” he said. “AI is going to give you a productivity increase, and at that point you can invest that productivity increase in cost cutting or improving revenues.”

“If, as a savvy company, what you’re looking for is to improve your top line instead of decreasing the bottom line, at that point you’re going to invest that in producing even more capabilities for your customers,” Caronna added.

“More capabilities, generally speaking, should mean more revenue and an increase in the top line. That productivity increase can really provide a huge competitive advantage to companies.”

Follow us on social media

JetBrains has revealed plans to scrap its Fleet IDE (integrated development environment) platform amid a sharpened focus on its flagship IntelliJ offering.

In a blog post last week, the company said running two general-purpose IDE platforms “diluted our focus” and a review prompted the decision.

The move means that from 22 December, Fleet will no longer be available for download. JetBrains added that it’s now building a new product “focused on agentic development”.

“Fleet did not succeed as a standalone product. We could neither replace IntelliJ IDEA with Fleet nor narrow it into a clear, differentiated niche,” the company said.

“We suddenly had two IDE families aimed at largely the same audience, with overlapping purposes. Users kept asking which one to choose, and the answer was never short or satisfying. Two similar products created friction and raised questions about ownership and long-term investment.”

Crucially, no more updates will be released for the IDE platform. The company said customers can continue using the platform, however, some features that rely on server-side services, such as its AI assistant, “may stop working over time”.

JetBrains says Fleet wasn't a failure

JetBrains said the decision to scrap Fleet doesn’t mean it was a failure. First launched in 2021, it was designed to offer users a lightweight multi-language IDE, later operating as an editor and coding assistant.

Indeed, the company noted that it “seriously considered” whether Fleet could act as a second flagship IDE in addition to IntelliJ-based tools.

A host of Fleet components now power JetBrains IDEs, the company said, while several UX and UI concepts built through the platform have been adopted across other products.

Ultimately, having two overlapping products proved detrimental and “created confusion” for customers.

“User feedback was consistent: If you already work with IntelliJ IDEA, Rider, WebStorm, PyCharm, or any other JetBrains IDE, switching to Fleet required a strong reason – and Fleet did not offer enough value to justify the transition from IDEs you already know and love,” the company said.

JetBrains' agentic focus

Learnings from the Fleet experience will power a new “niche” focus at the company, JetBrains revealed.

The company is building a new “agentic development environment” based on the Fleet platform. This will eventually ship as a new product with a new name and help streamline agentic workflows for developers.

According to JetBrains, working on AI features with Fleet showed a “new development workflow began to take shape”, prompting a major rethink on IDEs and evolving developer processes.

“Developers started delegating meaningful tasks to agents – updating tests, cleaning code, refactoring modules, exploring unfamiliar code paths, and even building new features,” the company explained.

“These tasks run asynchronously and return full patches. The developer doesn’t write the code themselves. They guide the agent and review its output. This is fundamentally different from the classic IDE workflow, which is based on immediate feedback, synchronous control, and a single stable local state.”

By contrast, agentic workflows rely on “structured task definition, context assembly, multiple asynchronous runs, isolated execution, and review-first workflows”.

With this in mind, combining them into a single tool resulted in a disjointed and confusing experience.

“The Fleet team chose to stop competing with IDEs and code editors and instead build a product focused on agentic workflows.”

MORE FROM ITPRO

• The best IDEs for beginners and professionals
• UK software developers are still cautious about AI, and for good reason
• Practical AI: the age of agentic AI

A mistake by a developer at OX Security has revealed critical vulnerabilities in Cursor that could allow attackers to drain enterprise coffers.

Cursor is one of a number of highly popular “vibe coding” platforms that allows developers to build applications using AI.

According to OX Security, the developer in question accidentally spent the firm’s entire monthly budget in hours, prompting calls for more robust spending caps and guardrails.

"When he got notified of exceeding the limit, he wandered off to his user settings and found out he could simply change the organization’s budget limitations (to over $1M!) – even though he wasn’t the admin. The admin received no notification."

The mistake was possible because of a lack of mandatory spend caps and overly permissive access, with non-admins able to modify critical settings. Meanwhile, bills appeared hours or days later, making the overspend difficult to spot.

While both Cursor offers ways to limit spending, these protections are not enabled by default, are reactive rather than preventative, and depend entirely on manual configuration.

OX Security said most teams will probably assume that controls are admin-only, particularly given the statement in Cursor’s documentation that “admins can increase the limit”.

However, the default settings mean that a non-admin user can change team limits to 'unlimited', set caps to more than $1,000,000, and save changes without any pushback.

Spending limit issues have security implications

This isn’t only an admin’s headache, OX Security warned, as it's been able to build a proof-of-concept showing how attackers can exploit these weaknesses to drain millions of dollars in compute power value.

First, the attacker sends a malicious Cursor deeplink which, when clicked, automatically injects a prompt into the user’s Cursor chat, opens the Command Palette, navigates to the team Usage & Billing modal.

Thereafter, it edits the usage limit to an extremely high value and then saves it – all without requiring admin permissions. The team budget can now hit more than $1 million a month.

Crucially, a second deeplink is sent triggering an infinite requests loop to flood Cursor with high usage. This link runs code in the name of the team member, injects a prompt that triggers infinite requests and burns through tokens at scale.

Researchers warned this would cost the company up to the modified limit.

Deeper access

According to OX Security, when developer accounts are compromised or API tokens leak online, attackers gain direct access to AI compute resources.

These stolen tokens can be used directly by attackers for their own AI workloads or exploited at scale across multiple compromised accounts simultaneously – or sold on dark web marketplaces where AI access is increasingly valuable.

"Organizations using these platforms should immediately review billing settings, enable admin-only controls, and implement spending caps," said the firm.

"This wasn’t just a configuration oversight. It exposed a systemic problem: AI platforms prioritize speed and access over protection, creating an environment where a single leaked token or malicious link can trigger unbounded usage – silently driving costs into the millions before any alert fires."

Amazon Bedrock claims questioned

Notably, OX Security claimed Amazon Bedrock also has similar issues. While the firm said the platform has no built-in spend caps by default, customers do have access to AWS Service Quotas and cost controls via AWS Budgets.

In a statement given to ITPro, a spokesperson for AWS said: "This is not a security issue with Amazon Bedrock or AWS. AWS customers who want to manage spending in Amazon Bedrock can do so through AWS Service Quotas and cost controls like AWS Budgets.

"Access to Bedrock APIs and the ability to modify service quotas are governed by IAM permissions, which customers configure based on their security requirements."

MORE FROM ITPRO

• The Replit vibe coding incident gives us a glimpse into why developers are still wary of AI coding assistants
• ‘Slopsquatting’ is a new risk for vibe coding developers
• Google Brain founder Andrew Ng thinks everyone should learn programming with ‘vibe coding’ tools

Want some coding help from Claude? Just tag it in Slack as you would any colleague.

Anthropic has announced its popular AI model will be integrated with the workplace collaboration platform, allowing users to delegate a range of tasks.

The move could shift the discussion around AI coding by making it much easier for developers to use these tools in their existing workflows, rather than having to stop what they're doing or change their ways of working.

The integration follows Anthropic's recent announcement of Claude Opus 4.5, which the company said topped rivals in leading coding benchmarks thanks to a leap forward in accuracy and efficiency.

Beyond the ease of adding the tool into coding workflows, the integration means Claude will have access to discussions related to tasks, further aiding both the tool itself and developers.

"The critical context around engineering work often lives in Slack, including bug reports, feature requests, and engineering discussion," Anthropic said in a blog post.

"When a bug report appears or a teammate needs a code fix, you can now tag Claude in Slack to automatically spin up a Claude Code session using the surrounding context."

The AI company said users can ask Claude Code it to investigate bugs and fix them, run quick code reviews and make modifications, and for collaborative debugging.

"When team discussion provides crucial context — error reproductions or user reports — Claude can use that information to inform its debugging approach," the post added.

How to use Claude Code with Slack

Anthropic already has an app to let Slack talk to Claude to relay tasks, but the new system deepens that integration and gives Claude more access to the context of the query.

"When you mention @Claude in Slack, Claude reviews your message to determine if it’s a coding task," the company explained in a blog post. "If it is, a new Claude Code session will automatically be created. You can also manually tell Claude to handle requests as coding tasks."

The key to the system is that added context, which Claude can gather from Slack to make decisions.

"Claude gathers context from recent channel and thread messages in Slack to feed into the Claude Code session," the post explained.

"It will use this context to automatically choose which repository to run the task on based on the repositories you’ve authenticated to Claude Code on the web."

The integration works two ways, as Claude will also post updates to your Slack thread, and when the work is finished, it will post a link to the full Claude session to review any changes and a link to open a pull request.

The Claude Code integration for Slack is currently in a research preview phase, Anthropic noted. This will allow the company to fine-tune the use of the coding tool within Slack and weed out any potential bugs.

To get access, users will have to have the Claude app installed in their Slack workspace - this is accessible through the Slack App Marketplace. There are other steps required before you can start delegating tasks, however.

Claude accounts will need to be authenticated, and Anthropic noted users will also need access to Claude Code on the web to “route coding tasks”.

MORE FROM ITPRO

• Snowflake inks $200m deal with Anthropic to drive ‘Agentic AI’ in the enterprise
• Want to get the most out of Anthropic’s Claude AI assistant? This new training course will give you prompt engineering tips and how to use Claude Code
• GitHub is scrapping some Claude, OpenAI, and Gemini models in Copilot

AWS has unveiled a set of powerful new “frontier agents” , which the hyperscaler said marks a step change in the potential of agentic AI technology and the automation of far more complex tasks.

Frontier agents aren’t your typical AI agent working away in the background, automating tasks and dealing with customer service queries. As journalists were told at a pre-briefing ahead of the annual re:Invent conference, they’re a “new class” of agent capable of working fully autonomously for hours or days without intervention.

These agents are highly scalable, self-learning, and represent the next iteration of the technology, according to the hyperscaler.

To mark its first foray on this front, AWS has launched three new frontier agents, which it said are primed to fundamentally transform software development. The company’s Kiro coding service, for example, is getting a big update with an agentic twist, dubbed Kiro Autonomous Agent.

Speaking to ITPro ahead of the event, David Yanacek, senior principal engineer for agentic AI at AWS, said these new capabilities will prove vital in helping developer teams speed up production in a safe and secure manner.

“These act as an extension to your team, more so than a tool for developers,” he said. “So we've started this category of what we call frontier agents. We've started by releasing three software development lifecycle related agents.”

According to AWS, the Kiro Autonomous Agent “maintains persistent context across a range of sessions,” meaning it’s lingering in the background learning from human processes.

While this appears similar to what one would consider a ‘traditional’ AI agent, this new class tracks human activity to improve continually, learning pull requests and providing users with feedback.

The agent comes with a range of capabilities, such as triaging bugs and improving code coverage, the company told assembled media.

“You can ask it questions, describe a task, and assign tasks in your backlog directly from GitHub,” AWS explained in a statement. Thereafter, the agent will “independently figure out” how to complete the task and share recommendations for changes, potential edits or pull requests.“

Security agents target safer software

Elsewhere, Yanacek told ITPro the new AWS Security Agent aims to drive the development of safer, more secure software.

According to AWS, the agent “embeds deep security expertise throughout the development lifecycle” by proactively reviewing design documents and scanning pull requests, comparing them to common vulnerabilities and in-house security requirements.

The launch of this frontier agent represents a step change in software development, according to Yanecek, addressing long-standing security-related issues and alignment between developer and security teams. The agent can perform penetration testing to probe for security vulnerabilities, for example, turning what was previously a laborious manual process into an “on-demand capability”.

“If you're a security team, you want to make sure that all of the teams in your organization are doing things in a secure way, ultimately, and so you want them to be penetration testing code, the changes that they make, the systems that they're building, that's an expensive thing to do,” he explained.

“It takes a lot of time and a lot of setup and execution,” Yanacek added. “Sometimes teams only get to practice only their most critical systems, because it just takes so much time.”

One AWS customer that’s already used the agent, photo-sharing firm SmugMug, was able to conduct penetration testing on multiple applications within the space of hours, rather than days, Yanecek told ITPro.

In simplifying and streamlining this aspect of the development lifecycle, agents are reducing manual toil and freeing up developers to focus on more critical tasks, he added.

“Now we've taken pen test time from weeks to hours, we can just cover more ground, so we can test more changes as they're going through than you could in practice before.”

DevOps gets the agentic treatment

The third and final frontier agent unveiled by AWS today, the AWS DevOps Agent, completes the agentic treatment for the SDLC. This tool aims to streamline DevOps practices, again with a focus on reducing toil for developers.

Similar to the security agent, this has a deep knowledge of user IT estates and applications, identifying relationships between areas such as observability tools, code repositories, and CI/CD pipelines.

It achieves this through mapping application resources, according to AWS, which enables the agent to rapidly respond to failures or bugs that often cause developers headaches.

“The DevOps agent works autonomously when there are alerts or things that will engage a human either in real time or later,” he explained. “It will do root cause incident management, come up with a safe mitigation plan, and shows all of its work along the way.”

Yanacek added that the agent will be proactive and continuously improve, studying previous incidents and identifying potential future issues.

“So it will find things around, maybe cost optimization of infrastructure, saying ‘hey, these are running underutilized’, or, ‘hey, your time to detect has been poor over time’,” he explained.

AWS has tracked an estimated root cause identification rate of around 86% using the agent to date, Yanacek told ITPro. Customers such as the Commonwealth Bank of Australia found that the agent was able to identify the root cause of software failure in just 15 minutes.

“It takes hours for this type of incident [to be identified] that they threw at it to try it out,” he noted. “So we’re seeing success with that.”

MORE FROM ITPRO

• AWS re:Invent 2025: All the news, updates, and announcements live from Las Vegas
• AWS targets IT modernization gains with new agentic AI features in Transform
• Microsoft's new Agent 365 platform is a one-stop shop for deploying, securing, and keeping tabs on AI agents

As businesses incorporate machine learning into their commercial strategies, the race to innovate and stay ahead of the market has highlighted some new challenges.

Traditionally, software development (DevOps) and machine learning (MLOps) teams have operated with separate workflows, tools, and objectives. In today’s environment, this leads to inefficiencies and redundancies that can hamper software delivery.

What are the risks of sticking with the status quo? How can the two teams be bridged together?

Siloed pipelines create blockers

DevOps pipelines are built around continuous integration and delivery (CI/CD), emphasizing speed and reliability. MLOps, on the other hand, introduces stages such as data preparation, training models, and validation. When these operations are managed separately, the handoff from data science to engineering can be slow and error-prone. Data scientists may work in one environment, while engineers work in another, often requiring manual steps that disrupt the overall software lifecycle.

Different toolchains only exacerbate the problem. DevOps and MLOps both require automation, reproducibility, and version control. However, keeping two systems running at the same time is a waste of resources when they’re designed to achieve the same goal.

Channel providers who serve these infrastructures typically have to deal with many of these cases, adding complexity without delivering extra value. Silos between teams further complicate matters, with broken communication and misaligned objectives.

Unlike traditional code, ML models often rely on dynamic, data-driven outputs that can change depending on their training data or hyperparameters used. As a result, they don’t always fit neatly into existing DevOps pipelines, meaning standard testing, validation, or security checks can be skipped or inconsistently applied.

These problems increase the time it takes to get AI-powered features to market. Limited traceability of model versions, training data, and hyperparameters makes troubleshooting and auditing cumbersome, raising concerns about governance, compliance, and accountability.

The case for unification

The solution, as many organizations are discovering, is to combine DevOps and MLOps into a single, cohesive software supply chain. This approach doesn’t overlook the unique requirements of machine learning, though. Indeed, it treats artificial intelligence (AI) as if it were any other software component, creating a system of consistent protocols, whether for code snippets or trained models.

DevOps and MLOps share some of the same goals: rapid delivery, automation, and reliability. Aligning around these goals helps organizations and channel partners to operate more efficiently, reduce redundant work, and foster better collaboration.

The way to achieve true unification is to treat ML models as first-class software artifacts. Like binaries, libraries, and configuration files, models should be versioned, tested, and distributed through the same automated pipelines. This ensures unified visibility, so teams can keep track of which model version aligns with which release, reducing confusion and ensuring reproducibility.

Integrating models into these workflows extends automation across the entire lifecycle, from preparing data to deploying it, which cuts down on human handoffs and speeds up delivery from start to finish.

This approach also improves collaboration between data scientists, engineers, and operations teams. Sharing infrastructure and using the same processes makes communication simpler and allows for smoother handoffs.

Governance is also strengthened by subjecting ML models to the same quality assurance, security scanning, and compliance checks as other software components. For channel partners tasked with safeguarding software supply chains, this consistency is essential.

Opportunities for the channel

For the IT channel, bringing DevOps and MLOps together is both a challenge and an opportunity.

Organizations want to use AI, but they often lack the skills or infrastructure to do so. Partners who help customers set up these pipelines enable them to deliver faster, more reliable, and compliant solutions. Channel providers are at the vanguard of AI-driven innovation when they bridge the gap between DevOps and MLOps.

Companies need to be able to quickly and safely migrate models from testing to production to realize AI’s potential. There has to be a single software supply chain where ML models are handled like first-class assets and workflows are automated from start to finish. For channel partners, this method helps customers grow their AI projects while making sure that quality, security, and governance are maintained throughout the software lifecycle.

As organisations race to adopt more software and models, the industry needs holistic governance. Currently, only 60% of companies have full visibility into software that is running in production. Combining DevOps and MLOps into one software supply chain can help companies achieve their shared goals of rapid delivery, automation, and reliability. This will create an efficient and secure environment for building, testing, and deploying the entire spectrum of software, from application code to machine learning models.

Google CEO Sundar Pichai claims software development has become “exciting again” since the rise of vibe coding, but some developers might disagree while bogged down in flawed code.

Speaking during a recent podcast interview, Pichai suggested the trend that’s taken the industry by storm will have positive long-term implications for both devs and non-technical individuals alike.

“It’s making coding so much more enjoyable,” he told host Logan Kilpatrick. “I feel things are getting more approachable, it’s getting exciting again, and the amazing thing is it’s only going to get better.”

Pichai noted that non-technical staff internally at the company are using AI to support workflows and finding them to be a valuable addition to the toolkit.

“There’s a sharp increase in the set of people who have submitted their first CL’s (changelists) and it’s because these tools are making it more accessible,” he said.

“Maybe you’re a product marketing person, you have an idea… in the past you would have described it. Now maybe you’re kind of vibe coding it a little bit and showing it to people, so you can tangible see that come to work.”

Pichai is the latest in a string of big tech execs to hail the potential of vibe coding over the last year. Indeed, Google Brain founder Andrew Ng specifically highlighted the democratizing effect of AI in coding earlier this month, with workers outside the software profession flocking to the tools.

“The bar to coding is now lower than it ever has been,” Ng said. “People that code, be it CEOs and marketers, recruiters, not just software engineers, will really get more done than ones that don’t.”

Developers aren’t quite sold on vibe coding

Software developers don’t appear fully sold on the use of AI for coding, however, with research showing that although there’s a growing appetite for these tools, they often create more problems than they solve.

Findings from Google’s own State of DevOps report last year, for example, revealed more than one-third (39%) of developers had little trust in AI-generated code even though they use them on a daily basis.

Meanwhile, Stack Overflow’s 2025 Developer Survey found nearly half (46%) of developers “don’t trust the accuracy” of AI outputs when used for coding tasks. This marked an increase compared to 31% of devs who aired concerns on this front in 2024.

A key factor behind this skepticism is that the “productivity gains” delivered by the technology are negated by developers having to debug faulty code.

More than two-thirds (67%) of respondents to a survey from Harness said they now spend more time debugging flawed AI-generated code compared to when they were operating in a manual capacity.

Keep security teams in the loop

Pichai did acknowledge that there are risks associated with vibe coding, particularly in terms of security – and he’s not wrong.

A study from Veracode in July this year found nearly half of code generated with AI is fully secure, while a separate survey from Cloudsmith pointed to a growing trend of complacency among developers using these tools.

The survey found only around one-third of devs review AI-generated code before deployment, leaving enterprises open to an array of potential vulnerabilities.

In the meantime, Pichai said vibe coding should typically be used in an experimental capacity, and security teams should always be involved in the process.

“I’m not working on large codebases where you need to really get it right,” he said. “The security has to be there, so those people should weigh in.”

AI tools are the worst they'll ever be

Notably, the Google chief believes this is the worst vibe coding and AI tools will ever be, pointing to examples like autonomous taxi company Waymo. Initial skepticism and concerns about safety have given way to acceptance among commuters.

With AI coding tools, the same rules apply. Continuous improvements mean the technology will become more reliable moving forward, helping cement its place in the mainstream not only for non-technical individuals but for devs working on the frontline.

“There's something I always used to tell about Waymo, and whenever people talked to me about it is, ‘remember, this is the worst Waymo will ever drive’,” he said.

“This version of all these tools…vibe coding with Gemini 3 in AI Studio, it’s both amazing to see and it’s the worst it’ll ever be. Both are simultaneously true. You’re going to see a lot of progress ahead.”

MORE FROM ITPRO

• Want to supercharge your vibe coding skills? Here are the best AI models developers can use to generate secure code
• Vibe coding security risks and how to mitigate them
• ‘Slopsquatting’ is a new risk for vibe coding developers – but it can be solved by focusing on the fundamentals

AI tools offer great potential to clear up time for developers and software engineers – but can also be manipulated to introduce malware and other threats through a new attack vector known as ‘slopsquatting’

Slopsquatting is an attack method in which hackers exploit common AI hallucinations to trick engineers into mistakenly installing malicious packages.

In short, hackers track non-existent packages hallucinated by AI coding tools and then publish malicious packages under these names on public repositories such as PyPI. The seemingly legitimate packages are then installed by victims who trust their AI code suggestions.

ITPro spoke to Dustin Kirkland, SVP of Engineering at Chainguard, to learn more about slopsquatting and where it sits in the wider issue of risky AI code.

“It’s kind of a modern twist on typosquatting, we’ve seen that for many years all the way down to simple URLs, you accidentally leave one letter out of ‘Google’ and end up on a malicious site, or something like that,” Kirkland adds.

The term ‘slopsquatting’ combines ‘typosquatting’ and ‘AI slop’, a pejorative term for low-effort content generated with AI, Kirkland said

“For at least ten years, typosquatting has been a problem in the Python and Java universes, where it's quite easy for almost anyone to register a Python package with PIP Python and PIP install.

Kirkland told ITPro that porting this attack methodology into AI comes with risky implications, as developers are increasingly engaged in vibe coding to produce business-critical code at scale.

“I would say an old school human coder, especially in the open source world where I've spent my entire career, every line of code was typically reviewed and approved by a human maintainer.

“And now the ability of an AI to generate literally gigabytes of code, millions, if not billions of lines of code, starts to put this out of the reach of even some of the most prolific maintainers.

“And so the scary risk is that these sorts of problems leak into systems that don't get as much human verification.”

But Kirkland sees potential for AI assistants to police one another, with designated agents taught to identify signs of slopsquatting, typosquatting, and other common attacks using predefined algorithms.

“[W]hen using something like AI here, one of the real advantages over the human way of doing it is when there is identified a new way of a malicious actor slopsquatting, we can create one algorithm and roll it out comprehensively by updating a single model,” he explained.

AI risks aren’t top of mind for leaders

Chainguard’s 2026 Engineering Reality Report took in responses from 1,200 software engineers and senior technology leaders from across the US, UK, France, and Germany.

The report also found widespread enthusiasm for using AI tools to mostly or entirely automate tasks in the engineering workflow.

For example, over two thirds (68%) of respondents said testing, monitoring, and quality assurance had been automated in this way, with a similar figure registered for security patching and vulnerability remediation (67%) as well as code review (65%).

However, the report also shed light on the core concerns holding software engineers back from full AI adoption.

The top concern among respondents was the lack of security and privacy associated with AI, with 17% saying as much, while other core concerns included accountability and trust in code and the use of shadow AI.

Kirkland said these concerns can be eased as firms set out AI usage policies, with Chainguard having rolled its own out at the start of 2025.

This “living document” clearly sets out trusted AI tools employees can use, which reduces operational risk and helps provide oversight for the packages and libraries developers install.

To prevent slopsquatting in the short term, Kirkland suggested firms could look to methods such as more closely verifying package registries and signatures to prevent those from unknown sources being installed.

In the long term, Kirkland told ITPro he sees slopsquatting and cybersquatting as a solvable problem. He added that with AI security tools in place, it’s increasingly likely that only the most sophisticated attacks will get through.

“Just being somewhat contemporary and topical here, when was the last time you heard of an art museum having jewels stolen, right? That's typically, that's typically the story of movies and blockbuster hits and yet, here we are in 2025 and the world's most famous art museum had some of its most famous jewels stolen.”

In the same way, Kirkland is confident that automated security algorithms that check the popularity, age, and author of packages will ensure that slopsquatting and similar attacks become the exception rather than the rule.

MORE FROM ITPRO

• Senior developers are all in on vibe coding, but junior staff lack the experience to spot critical flaws
• Vibe coding security risks and how to mitigate them
• Google Brain founder Andrew Ng thinks everyone should learn programming with ‘vibe coding’ tools

Google Brain founder Andrew Ng believes everyone should dab their hand at “vibe coding” as a way of beefing up their programming skills, but some industry experts aren’t quite so keen on the idea.

Speaking at Snowflake’s annual ‘Build’ conference, Ng suggested those looking to build applications shouldn’t do it manually and instead turn to AI tools to speed up the process.

"Don't code by hand. Don't do the old way," he told attendees, per reports from Business Insider. "Get AI to help you to code.”

“That will make people in all job functions much more productive and have more fun."

Vibe coding is the word of the year, literally. In October, Collins Dictionary granted it the annual award following its explosive rise to prominence over the last nine months.

The practice, which involves using natural language prompts to generate code and speed up development processes, has been hailed as a great breakthrough in software development and has gained significant traction across the tech industry.

Indeed, it’s become a burgeoning industry. Some of the most-watched startups globally – such as Cursor, Replit, and Lovable – specialize in ‘vibe coding’ while big AI providers like Anthropic and OpenAI have also jumped on the bandwagon.

Proponents of the practice, like Ng, argue vibe coding helps take the drudge work out of software development and lowers the barrier to entry for non-technical individuals.

“The bar to coding is now lower than it ever has been,” Ng told attendees. “People that code, be it CEOs and marketers, recruiters, not just software engineers, will really get more done than ones that don’t.”

Nigel Douglas, head of developer relations at Cloudsmith, agreed that this aspect of vibe coding has marked benefits. It's democratizing what was once an exclusive domain of expertise.

"AI-assisted vibe coding can be incredibly helpful for beginners as it takes away a lot of the initial intimidation,” he told ITPro. “

"Users can experiment and ask questions in natural language and immediately see how the code behaves,” Douglas added. “This kind of low-friction environment often helps people grasp core concepts faster because they can learn through doing rather than memorizing syntax or other programming languages.”

Looking at it from this perspective, proponents of the trend aren’t wrong. Since OpenAI co-founder Andrej Karpathy coined the term in February this year, countless applications worldwide have been built using AI tools, often by those with no prior experience in development.

Is vibe coding risky?

But is the trend all it’s cracked up to be? Some critics suggest that relying on AI tools to build software comes with significant risks, both in terms of security and the long-term impact on developers themselves.

Others, meanwhile, say using the technology in software development often isn't worth the hassle.

Analysis from Fastly earlier this year, for example, found that while developers are using AI tools to speed up production, the gains delivered by the technology are offset by the fact they spend a big chunk of their time fixing flawed or faulty code.

More than two-thirds (67%) of developers reported spending more time debugging AI-generated code compared to before they started using these tools.

Moreover, relying too heavily on AI tools and essentially giving the technology the keys to the kingdom can have dire consequences. As ITPro reported in August, an incident involving one of the aforementioned vibe coding darlings, Replit, proved disastrous for one startup founder.

While disaster was ultimately averted on this occasion, experts told ITPro at the time the incident highlighted the risks associated with AI coding tools.

Don’t overlook the fundamentals

Security-related issues surrounding vibe coding mean this isn’t a recommended practice in the enterprise, industry experts told ITPro. Tal Zarfati, lead architect at JFrog, agreed with Ng and Douglas on the accessibility front.

However, he warned it “introduces new layers of risk if not approached carefully”.

“While enhancing developer productivity, [vibe coding] significantly amplifies software supply chain risks, especially when third-party models are used without scrutiny,” he said.

Zarfati added that developers relying too heavily on AI could leave their organization exposed to an array of AI-related threats or vulnerabilities such as slopsquatting, where attackers “exploit naming gaps in AI-generated code suggestions”.

“The risks go deeper as model-based training attacks, prompt injections, and guardrail bypasses in generative AI tools introduce vulnerabilities that traditional security practices often overlook,” he continued. “These issues are amplified when vibe-coded apps are embedded into a secure software supply chain.”

Chrissa Constantine, a senior cybersecurity solutions architect at Black Duck, told ITPro that users diving headlong into vibe coding also risk skipping vital learning curves.

“Accessibility doesn’t erase fundamentals,” Constantine said. “Overreliance on AI can lead to shallow learning, fragile codebases, and security risks.”

“Beginners who skip core development and engineering concepts, such as data structures, debugging, and architecture, may struggle when AI-generated code breaks or scales poorly.”

Ultimately, vibe coding should be viewed as a way to “complement, not replace” foundational skills, Constantine added.

MORE FROM ITPRO

• Hackers are using AI to dissect threat intelligence reports and ‘vibe code’ malware
• Vibe coding security risks and how to mitigate them
• Want to supercharge your vibe coding skills? Here are the best AI models developers can use

AI is fueling a drastic transformation of Agile development practices, according to new research, as enterprises target more efficient software delivery.

Findings from the 18th annual State of Agile Report, published by Digital.ai, suggest the methodology has reached a “major turning point” as AI moves from being a “supportive tool to an orchestrator” in delivery cycles.

“Artificial intelligence is transforming software development and delivery faster than any wave before it,” Digital.ai CEO Derek Holt commented. “In the last three years, AI has moved from research labs into every corner of the enterprise, reshaping how we plan, build, test, secure, and release software.”

The common talking points and appeal of AI tools, such as enhanced productivity, go hand in hand with the basic fundamentals of Agile methodology: more efficient development practices.

This emerging symbiotic relationship between AI and Agile comes at a critical time, the report noted. AI adoption among respondents has surged from 64% in last year’s edition to 84% this year.

With questions over return on investment (ROI) looming, IT leaders are being pushed to both justify investments in the technology and deliver positive business outcomes.

Running parallel to this AI ROI focus is rising pressure on tech leaders and developer teams alike to deliver ROI with Agile itself. More than three-quarters (76%) of respondents cited “increased scrutiny” on whether the methodology produces tangible benefits.

The study noted that this pressure is “reshaping investments and role assignments”, yet only half feel they’re capable of delivering software projects reliably and on time.

Elsewhere, teams are being stretched thin, with 79% revealing they’re being “asked to do more with less”. More than three-quarters (77%) said they feel increased pressure to accelerate innovation.

Notably, 78% of respondents said they face challenges adapting to repeated leadership and “structural changes” at their organization, which is having an adverse effect on efficiency and coherence.

Agile is adapting to a changing environment

While teams face mounting pressure, the report notes that the methodology “continues to evolve to meet modern demands”.

Investment in the practice is rising, the study found, with 41% of respondents increasing spending on this front over the last two years. This, Digital.ai noted, shows “continued confidence” in its value within the enterprise.

Flexibility is also another key positive takeaway from the report, with 74% now using hybrid, blended, or “homegrown” Agile models based on their individual needs and preferences.

Elsewhere, increased accountability and cross-functional collaboration are delivering positive results. Nearly one-third (29%) of respondents are now “accountable for connecting Agile work to business outcomes and 26% are influencing product and portfolio planning,” the study found.

Digital.ai said this means enterprises are shifting from focusing primarily on basic activity metrics to measuring broader long-term strategic impact.

Why AI could be a game changer for Agile

So where does AI actually fit into the equation with supporting Agile development practices? As with other business areas, the technology is being used as a force multiplier by teams, helping to drive productivity and streamline processes.

Over three-quarters of respondents said they’re using the technology to “save time or reduce manual effort” and simplify tasks by auto-generating documentation or summarizing retrospectives.

Teams are excited about the long-term prospects of integrating the technology within Agile workflows, the report found.

“The broader opportunity is even more compelling,” the study states. “When we asked all respondents, including those not yet using AI where it could help in their roles, the appetite extends well beyond efficiency.”

“Nearly nine-in-ten see value in detecting delivery risks earlier and surfacing real-time insights.”

Teams have a ‘pragmatic’ optimism with AI

Over the last two years, concerns about AI integration actively impacting workers have gained significant traction. In the case of Agile, however, respondents said they welcome the influx of AI tools as a way to enhance teams.

“Even with automation accelerating, the mood is overwhelmingly positive,” the study noted.

“While some worry AI could disrupt or reduce their roles, the majority see AI as enhancement rather than threat, believing it will change how they work but not replace what they do, or that it will enhance their productivity and decision-making.”

While optimism prevails across the majority of respondents, Agile teams are keen to ensure that the technology is integrated in a responsible manner.

Considerations such as security, privacy, and compliance all ranked among the top issues flagged by respondents, Digital.ai found, while the quality of AI outputs also emerged as a lingering concern.

A key factor here lies in the quality of data at the disposal of teams, with one-in-five revealing they “don’t trust their data at all” – an issue that’s affecting confidence.

“The skepticism about AI outputs makes sense,” the study said. “These systems hallucinate, present false information as fact, and need validation.”

“AI isn’t infallible – it requires governance, human oversight, and clear boundaries around where automation is safe and where human judgement remains essential.”

MORE FROM ITPRO

• Doubts cast on Agile's future, with 65% of projects more likely to fail
• Agile development has a security problem
• Four major software development lifecycle models and how they work

UK software developer salaries are surging according to new research, driven largely by growing demand for AI skills.

Figures from Stack Overflow show that while US-based developers still boast the highest global pay, their counterparts across the Atlantic are closing the gap at a notable pace.

According to Stack Overflow, AI and machine learning engineers now command a median salary of £112,000, while engineering manager pay stands at around £102,000.

Elsewhere, median salaries for cloud infrastructure engineers have reached £98,500.

The study noted that salary growth rates are a welcome sign and underscore the growing influence of the country’s tech sector. Despite this, they still lag behind US pay rates, with leading development roles often exceeding $189,000 (£141,900).

There are positive signs in terms of future growth, however. Stack Overflow noted that recent investment pledges from companies such as Microsoft and Google could “finally put [UK developer salaries] on a par with the US”.

In-demand roles and “uneven” salary growth

Stack Overflow identified a host of in-demand roles that enterprises have been crying out for in 2025. Back-end developers, for example, earn a median salary of £81,000, marking a 6.5% increase compared to £76,000 just last year.

Looking at global salary growth rates, Stack Overflow said there has been “uneven growth” in several areas. Product managers, for example, recorded the largest increase in pay from last year (29.3%) alongside game developers and front-end devs.

Conversely, established developer roles are experiencing lower salary growth rates, potentially signaling a "stabilization in mature technical disciplines”.

“More established roles such as data engineers, cloud infrastructure engineers, and QA or test developers, recorded only marginal increases,” the company said in a blog post.

The UK has developer talent challenges

While salary growth rates are a positive signal of the strength of the UK’s developer community, concerns have been rising over long-term sustainability of talent pipelines.

Previous figures from Stack Overflow found the average age of UK developers stands at 39 years old, with the company’s 2025 Developer Survey noting that 74% of professionals had more than a decade of coding experience.

Naturally, this was a cause for celebration which underlined the workforce’s strong technical capabilities. Yet speaking to ITPro in the wake of the study’s release, Stack Overflow warned the UK’s aging developer workforce could struggle to keep pace as a result of skills shortages.

Jody Bailey, chief product and technology officer at Stack Overflow, told ITPro the developer workforce will require more support from industry, academia, and government in the coming years to ensure a steady flow of new talent.

MORE FROM ITPRO

• UK software developers are still cautious about AI, and for good reason
• Senior developers are all in on vibe coding, but junior staff lack the experience to spot critical flaws
• Clunky tech is costing software developers 20 working days a year

Red Hat has announced the launch of new AI features as the company targets streamlined developer workflow efficiency.

The company said the launch of Red Hat Developer Lightspeed, a portfolio of AI solutions, will equip developer teams with “intelligent, context-aware assistance” through virtual assistants.

Available on the Red Hat Developer Hub, the first of these AI tools is accessible through the hub’s chat interface.

The company said this will help speed up non-coding-related tasks, including development of test plans, troubleshooting applications, and creating documentation.

This AI assistant can be used via both publicly available and self-hosted large language models (LLMs).

Red Hat targets app modernization gains

Elsewhere, a new AI assistant will be available in Red Hat’s migration toolkit for applications (MTA) suite. Speaking to ITPro, James Labocki, senior director of product management at Red Hat, said the tools will help developers simplify application modernization.

“The challenge I think that we see is, especially in large enterprises, a lot of them have developed custom languages, custom libraries, and custom frameworks,” he said.

“So code modernization can often be a challenge, and especially as those custom languages and frameworks percolate and organically move through organizations and get adopted,” he added.

“The question of how do you maintain currency of software is really a challenge for many of our customers, and this happens not just at the code level, but even at the operating system level, at all layers of the stack.”

New AI-powered features in MTA aim to address these challenges directly, Labocki explained. The AI assistant will help automate source code refactoring directly within a developer’s integrated development environment (IDE), for example.

It’s not a simple code editor, however, with Red Hat noting that it “understands migration issues and how to solve them”, allowing users to input queries in natural language to troubleshoot migration issues.

Continuous learning on the part of the assistant also targets long-term improvements, according to Red Hat. With each migrated application, the assistant will provide more accurate code solutions over time, thereby speeding up future processes.

“Let's say I have a statically coded IP address, and I know I'm moving into containers, and that's an anti-pattern, so I need to modify this code,” Labocki explained.

“They [developers] could then simply right click and say ‘please fix this’ - that will then reach out to the LLM of their choice…and will come back with a fix.

“The benefit of this that we see is that by having the static code rules and the examples and the patterns inside the static code analysis, and feeding that into the model we're getting, I would say more accurate answers than simply using an off the shelf model.”

Understanding the developer environment

The launch of the new AI assistants forms part of a push at Red Hat which aims to make it “easier for them [developers] to understand their environment,” Labocki told ITPro.

“When I have a question about a software template, it can answer those sorts of things,” he noted. “If I have a question about documentation, it’s just much easier to chat than to have to go open up a giant HTML file and web page, do a Control-F and find things.”

Labocki said initial internal use of the tools has so far delivered promising results, and long-term the aim is to further alleviate strain placed on development teams.

“Some of the early work that our engineers have done – and this was literally last week – I had a demo where one of our engineers was showing one of our product managers an example software template asset to modify it, and it did it correctly,” he explained.

“I think we're still early, but I think it's promising…Instead of having to understand TypeScript to define a software template in backstage, I could simply [do it] in Developer Hub, which is based on the backstage, be able to ask for it, and then it goes ahead and modifies it.”

MORE FROM ITPRO

• Red Hat is giving developers free access to RHEL
• Red Hat targets greater partner autonomy with latest channel updates
• Red Hat just made three big changes to its developer hub