How to Lead Developers in the AI Era: What the 2026 Data Tells CTOs and CIOs

By Danar Mustafa · Published November 11, 2026 · Last updated November 11, 2026

Short answer: In 2026, AI writes a large and growing share of production code. Developers in Sonar’s survey say 42% of their committed code is AI-generated, and Google reports 75% of its new code is. The bottleneck has moved from writing code to verifying it. Telemetry from 22,000 developers shows throughput up 34% per developer, while incidents per merged pull request rose 243% and time in review rose 441%. CTOs and CIOs should lead the system rather than the tools: invest in context, tests and review capacity, keep batches small, govern security, and measure flow, stability and outcomes together.

Featured graphic: “AI Writes More of the Code. Leaders Now Own the System.” Four stats: 42% of committed code is AI-generated (Sonar), 96% of developers don’t fully trust AI code (Sonar), median time PRs spend in review up 441% (Faros), and 44% of AI coding tasks had a known vulnerability (Veracode). The 2026 data in four numbers: high adoption, low trust, a review bottleneck and a security gap.

I have spent much of this year writing about how AI-first companies build software, from how Anthropic runs its engineering organization to how experts defer to AI agents on judgment calls. This piece is for the people who have to run it: the CTO, CIO or head of engineering with a team of developers, a budget, a security officer and a board asking what all the AI spending delivers.

What does the 2026 data say about AI in software development?

The 2026 data agrees on one point: AI is now part of everyday development, and the gains come with a cost further down the pipeline.

Adoption

• 72% of developers who have tried AI coding tools use them every day, and they expect AI’s share of committed code to rise from 42% to 65% by 2027 (Sonar State of Code 2026, 1,100+ developers).
• 73% of developers who use AI coding assistants or agents use them daily, and nearly a third of those spend four or more hours a day with them. Claude Code is the most used agent at 66% of agent users, ahead of GitHub Copilot at 59% (Stack Overflow Developer Survey 2026, 30,000+ respondents).
• 75% of Google’s new code is AI-generated (Sundar Pichai, April 2026). In August 2026, agent-authored pull requests on GitHub outnumbered human-authored ones for the first time (GitHub data via The Pragmatic Engineer).

Trust

• 96% of developers don’t fully trust AI-generated code, and only 48% always verify it before committing (Sonar).
• Only about 7% trust AI output for important work decisions; 48% trust it when they can easily verify the result (Stack Overflow).

Delivery

• Across 22,000 developers, epics per developer rose 66% and task throughput 33.7%. Bugs per developer rose 54%, incidents per merged PR 242.7%, and median time in review 441.5% (Faros AI Engineering Report 2026).
• DORA describes an “instability tax”: AI adoption raises throughput and delivery instability at the same time.

Security

• About 44% of AI coding tasks in Veracode’s tests produced code with a known vulnerability. The security pass rate moved only from 55% to 56% between reports, even as syntax became close to perfect.

Productivity, measured carefully

• METR’s randomized study found a 19% slowdown for experienced open-source developers in early 2025. Its late-2025 follow-up points to a speedup, but METR calls the evidence weak because many developers refused to work without AI.

How is AI changing the developer role?

The developer’s job is moving from writing code to directing agents, verifying output and owning the result. The volume change is large. Snowflake co-founder Benoît Dageville says he is more productive “but I also write five times more code.” Boomi CEO Steve Lucas says his teams write ten times as much as two years ago. Both quotes come from a Foundry feature by Mark Samuels, published in Computer Sweden on November 9, 2026.

At the individual level, the shift is even sharper. In The Pragmatic Engineer’s November essay, engineer Neil Kakkar describes going from 8–20 merged PRs a month to more than 200 at his startup Tano, running agents on three to five tasks at once. At Anthropic, Claude writes more than 80% of merged code, and the engineers who built its new source control system described their main job as telling Claude “no.”

What changes for the role:

• Specification becomes the main craft. The quality of the prompt, the acceptance criteria and the context files decides the quality of the output.
• Verification becomes the second craft. Bun creator Jarred Sumner, now at Anthropic, says AI writes nearly all code and tests, but the time spent on tests is the same as before AI: “You need to have a way to trust your code, and tests are probably the best way to.”
• Experience matters more. Tim Chilton, chief geospatial adviser at Ordnance Survey, warns that giving agents to people who cannot check their work leads to over-trusting AI. Anthropic’s own research finds expert users of Claude Code reach verified success about twice as often as novices.
• Specializations blur. The Pragmatic Engineer reports falling demand for mobile and frontend specialists and rising demand for generalists who can own a feature end to end.
• Juniors get squeezed. Anthropic cut the junior share of technical hires from 27% to 9% between early 2025 and 2026. DORA warns that AI can skip the “productive struggle” juniors need to build expertise.

Which steps in the development process change?

Every stage changes, but the biggest shift is where the time goes. Writing code gets cheaper. Specifying, reviewing, testing and operating it get more expensive.

Process diagram of five lifecycle stages. Plan and specify: specs and context files become the main input; leaders should invest in context. Build: 5-10 parallel agent sessions per developer; leaders should enforce small batches. Review: human review is the bottleneck; leaders should put agent review first and have humans review intent and risk. Test and verify: the new core craft; leaders should fund verification like a product. Deploy and operate: incidents per PR rising; leaders need feature flags, rollback and observability. Where the work moves when agents write the code, and what leaders should do at each stage.

Stage	What changes in 2026	What leaders should do
Plan and specify	Specs, acceptance criteria and context files become the agent’s main input. Work increasingly starts from a Slack message to an agent.	Treat context as infrastructure: repository instructions, skills, architecture docs and internal data the agents can read. DORA lists “AI-accessible internal data” as one of seven capabilities behind AI value.
Build	Engineers run 5–10 agent sessions in parallel. PR output across the industry is roughly double since January.	Keep batches small, cap work in progress and give every change one accountable owner.
Review	Human review cannot keep up. The Pragmatic Engineer calls it “theater” at many companies.	Put agent review and automated checks before human review, and focus humans on intent, architecture and risk.
Test and verify	Tests, evals, fuzzing and security scans carry the trust that line-by-line review used to provide.	Fund verification as a product, with owners and budget. Require tests before scaling agent output.
Deploy and operate	Incidents per merged PR rise. Only 20% of developers use AI for deploying or operating production systems.	Use feature flags, fast rollback, observability and incident review that tags agent-authored changes.

Two things stay the same, and The Pragmatic Engineer stresses both. Complex work still needs a real planning phase. And no company it visited lets PMs, designers or other non-engineers ship to production on their own. They prototype and file fixes, and engineers decide what goes live.

What do the measurements actually show?

They show a speed trap: individuals produce more, while the system absorbs the cost as review load, bugs and incidents.

Bar chart from Faros AI telemetry of 22,000 developers. Gains: epics per developer +66%, task throughput +33.7%, PR merge rate +16.2%. Costs: bugs per developer +54%, monthly incidents +57.9%, PRs merged with no review +31.3%, incidents per merged PR +242.7%, median time in review +441.5%. More output per developer, and much more strain downstream.

Four sources, four angles:

• Faros AI (telemetry, 22,000 developers, April 2026): the gains in epics and throughput are real, but code churn rose 861% and PRs merged without any review rose 31%. Faros calls the rising review load the “senior engineer tax” and argues that headcount cuts based on output gains are risky.
• DORA (Google Cloud, 2026): AI “amplifies” the organization it lands in. Teams with strong platforms, version control, small batches and good internal data gain. Others create “localized pockets of productivity that are often lost in downstream chaos.” DORA expects a J-curve: a temporary dip before long-term gains, which it calls “the tuition cost of transformation.”
• Sonar (survey, 1,100+ developers): verification is the new bottleneck. 38% say AI code takes more effort to review than human code.
• METR (randomized trials): controlled evidence on speed is still weak, partly because developers no longer want to work without AI.

Two-panel chart. Left: 72% of developers use AI tools daily, 42% of committed code is AI-generated, 96% don’t fully trust AI code, 48% always verify before committing, 38% say AI code is harder to review, and 7% trust AI for important decisions. Right: security pass rates for AI-generated code: cryptography 87%, SQL injection 83%, all tasks 56%, cross-site scripting 15%, log injection 12%. Adoption has outrun both trust and security.

My reading: the question for leaders is no longer whether AI makes developers faster. It does, at the task level. The question is whether your delivery system can absorb the extra volume without losing quality, and the 2026 data says most cannot yet.

How should engineering teams be organized in the AI era?

Teams get smaller per project, but team structure still matters. Katelyn Lesse, head of engineering for the Claude Platform at Anthropic, told The Pragmatic Engineer that individual projects rarely have more than two engineers, because each already runs several agents that step on each other’s toes. Yet she also says her teams are still “two-pizza teams” that own a piece of software, iterate on it and carry on-call.

Patterns that are working in 2026:

1. One owner per change. With agents producing many parallel changes, clear ownership prevents duplicate and conflicting work.
2. Product and engineering merge at the small end. At Tano, Kakkar acts as both engineer and PM, and the team plans weekly. Larger organizations keep PMs, but expect them to prototype and write evals.
3. Shared agent platforms. Most mid-sized tech companies built their own agent harness: Stripe (Minions), Uber (Minion), Block (Goose), Shopify (River), Ramp (Inspect), Spotify (Honk). A platform team that owns the harness, permissions and context is becoming standard.
4. Deliberate mentoring. DORA recommends pairing junior engineers with seniors to review AI-generated architecture and encouraging manual coding on complex components.
5. Protected focus and working hours. Kakkar says he feels “more mentally tired at the end of each day” and now stops at 6 PM. Parallel agents mean constant context switching.

Culture is the multiplier. As Kakkar puts it: “culture is a necessary – and sufficient – condition of success at every AI-era startup.”

How do you ensure code quality when AI writes most of the code?

Move quality checks earlier and make them automatic, so humans spend their review time on what machines cannot judge.

• Shift feedback to the author. DORA recommends giving automated feedback while code is being written, before it reaches a reviewer.
• Use context-aware review agents that enforce your standards before a human looks at the change.
• Work in small batches. Large AI-generated changes are hard to review and hard to roll back.
• Write tests first, then scale. Tests and evals are the only form of trust that scales with agent volume.
• Review intent and risk. Humans should check whether the change does the right thing, fits the architecture and carries acceptable risk.
• Watch for judgment calls. Anthropic’s study found experts followed an agent’s lean on 86% of open analytical decisions without noticing. Architecture and design choices need the human’s view before the agent’s recommendation.
• Don’t cut estimates too early. DORA warns that the gap between an AI prototype and production-grade code is often underestimated.

Gill Haus, CIO of Chase’s consumer bank, sums up the precondition in the Computer Sweden feature: without reliable end-to-end automation, you create more manual processes.

How do you keep AI-generated code secure?

Treat AI as an untrusted contributor whose code must pass the same or stricter gates as anyone else’s. Veracode found AI models handle cryptography (87% pass rate) and SQL injection (83%) reasonably well, but fail most tests for cross-site scripting (15%) and log injection (12%). Syntax is solved; security is not improving at the same rate.

A security baseline for 2026:

• Include security in model selection. Veracode’s best-performing model passed 68% of tests; most others were between 50% and 53%.
• Scan in the workflow. Static analysis, secret scanning and dependency checks run on every agent change before merge.
• Focus review on weak spots: input handling, output encoding, logging, authentication and authorization.
• Govern packages and credentials. Non-developers building apps need guardrails around credentials and risky packages, a point CIOs in the Computer Sweden feature raise repeatedly.
• Give agents their own identity and least privilege. Agents should never hold broad, long-lived credentials. This year, several frontier labs disclosed models that broke out of test environments and breached real systems.
• Write an agent policy. Specify when staff may explore with an agent, delegate work to one or deploy one. François-Xavier Pierrel of TF1 warns that once volume grows without compliance and policies, AI becomes “a critical mess.”

Which metrics should CTOs and CIOs track?

Track the whole system across six areas. Output metrics alone reward the speed trap.

Scorecard with six categories. Flow: lead time, deployment frequency, work in progress. Stability: change failure rate, incidents per merged PR, time to restore. Verification: time in review, share of PRs with tests and agent review, PRs merged with no review. Security: vulnerabilities by origin, secrets and risky packages blocked, time to remediate. Outcomes: features delivered, customer value, cost per delivered change including tokens. People: developer experience and fatigue, senior review load, junior mentoring time. An AI-era engineering scorecard. Each category has a warning sign to watch for.

Area	Metrics	Warning sign
Flow	Lead time for changes, deployment frequency, work in progress per developer	More work started, not more finished
Stability	Change failure rate, incidents per merged PR, time to restore service	Incidents growing faster than PRs
Verification	Time to first review and time in review, share of PRs with tests and agent review, PRs merged without review	Longer queues and more unreviewed merges
Security	Vulnerabilities by origin (human or AI), secrets and risky packages blocked, time to remediate	Injection and XSS flaws in AI code
Outcomes	Features delivered, customer-facing value, cost per delivered change including tokens	Output up, outcomes flat
People	Developer experience and fatigue, senior review load, junior learning time	Seniors buried in review, burnout

What to avoid: lines of code, PR count and AI acceptance rate as targets. They measure activity. DORA’s advice is to “measure impact, not output,” and its team puts it simply: “We don’t measure AI by the code it writes but by the bottlenecks it clears.” For token costs, see my article on AI tokenomics.

A 90-day plan for engineering leaders

1. Weeks 1–2: Baseline. Measure the six scorecard areas before you scale anything. Without a baseline, you cannot tell gains from churn.
2. Weeks 2–4: Write the agent policy. Define approved tools, data access, when agents may act alone and who is accountable for their output.
3. Weeks 3–6: Invest in context. Repository instructions, architecture docs and skills that agents can read. Connect AI tools to internal documentation.
4. Weeks 4–8: Build the verification layer. Tests, review agents, security scanning and small-batch rules in CI.
5. Weeks 6–10: Redesign review. Agent review first, human review of intent and risk, and a rule that nothing merges without at least one form of review.
6. Weeks 8–12: Protect people. Mentoring for juniors, limits on parallel work, and a check on senior review load.
7. Every quarter: Find the next bottleneck. In 2026 it moved from writing to review to infrastructure. Expect it to move again.

And one thing not to do: cut headcount based on output gains. DORA strongly discourages it, and Faros warns that the work of keeping AI output safe and correct has grown.

FAQ

How much code is written by AI in 2026? Developers in Sonar’s 2026 survey say 42% of their committed code is AI-generated, rising to an expected 65% in 2027. Google reports 75% of its new code is AI-generated, and Anthropic says Claude writes over 80% of its merged code.

Does AI make developers more productive? At the task level, yes. Faros AI telemetry shows task throughput per developer up 34% and epics up 66%. At the system level, gains are offset by more bugs, more incidents and longer review times. Randomized studies like METR’s still give mixed and weak evidence.

What is the biggest bottleneck in AI-assisted development? Verification. Median time PRs spend in review rose 441% in Faros AI’s data, 38% of developers say AI code is harder to review, and only 48% always verify AI code before committing.

Is AI-generated code secure? Often not. Veracode found 44% of AI coding tasks produced code with a known vulnerability, with very low pass rates for cross-site scripting (15%) and log injection (12%).

What metrics should engineering leaders use for AI? Measure flow (lead time, work in progress), stability (change failure rate, incidents per PR), verification (review time, unreviewed merges), security (vulnerabilities by origin), outcomes (features delivered, cost per change) and people (fatigue, review load, mentoring).

Should companies reduce developer headcount because of AI? Both DORA and Faros AI advise against cutting headcount based on output gains, because review, testing and incident work increase with AI-generated volume.

How should developer teams be structured with AI agents? Smaller project teams with one owner per change, a shared agent platform, strong test automation and deliberate mentoring for juniors. Long-lived teams that own systems and on-call remain important.

What is the DORA “instability tax”? DORA’s term for the rise in software delivery instability that accompanies AI adoption. Throughput improves first, and stability only improves if teams strengthen testing, small batches and platform foundations.

Final take

AI has already changed how code gets written. The 2026 data shows it has not yet changed how most organizations deliver software safely. Leaders who measure lines of code will see a boom. Leaders who measure incidents, review queues and outcomes will see the real picture: a system under strain that needs new investment in context, verification, security and people.

Leading developers in the AI era means owning that system. Sanofi’s chief digital officer Emmanuel Frenehard put it in the Computer Sweden feature: the train has left the station. The job now is making sure it doesn’t derail.

Sources: Mark Samuels, “Så kan it-ledare behålla kontrollen när AI skriver allt mer kod,” Computer Sweden (November 9, 2026), quotes translated from the Swedish edition; Sonar, State of Code 2026 Developer Survey; Gergely Orosz and Neil Kakkar, “How software engineering is changing,” The Pragmatic Engineer (November 3, 2026), and The Pragmatic Engineer’s LDX3 keynote write-up (October 2026); Stack Overflow Developer Survey 2026 and The Register’s coverage; Faros AI, AI Engineering Report 2026; DORA, ROI of AI-assisted software development and Balancing AI tensions; TechTarget on DORA 2025; Veracode 2026 GenAI Code Security Report; METR uplift update (February 2026); Semafor on Google’s AI-generated code; Anthropic, How employment is changing at Anthropic and Agentic coding and returns to expertise. Survey data is self-reported; Faros AI, Sonar and Veracode sell tools related to their findings; telemetry results are correlational.