AI-Generated Code Statistics 2026
By Axis Intelligence Research
Co-author: Sarah Mitchell | Last updated: September 15, 2026 | License: CC BY 4.0
Three quarters of all new code at Google is now written by AI and approved by engineers, up from a quarter in October 2024. Across more than 100 models tested over four years, the mean security pass rate for that generated code is 56 percent. Volume has quadrupled its share. Safety has not moved.
Quick Answer
AI now authors 75 percent of new code at Google as of April 2026, against 20 to 30 percent of Microsoft repository code as of April 2025 (both company-reported). Independent benchmark testing puts the mean security pass rate of AI-generated code at 56 percent across 100+ models. According to Axis Intelligence Research, the Code Durability Index (CDI) for AI-era codebases has fallen to 0.28 from a 2023 baseline of 1.00.
Key Findings
- According to Google CEO Sundar Pichai, speaking at Google Cloud Next 2026 on April 22, 2026, 75 percent of all new code at Google is AI-generated and approved by engineers, up from 50 percent in autumn 2025.
- Veracode’s 2026 GenAI Code Security Report finds that across more than 100 models tested over four years, the average security pass rate of AI-generated code is 56 percent, while syntax correctness now exceeds 95 percent.
- GitClear’s analysis of 623 million code changes shows block duplication rose 81 percent between 2023 and 2026 while refactoring line moves fell from 13 percent to 3.8 percent of changed lines.
- According to Axis Intelligence Research, review attention per commit on GitHub fell 41.6 percent in a single year, because commit volume rose 25.1 percent while commit comments declined 27 percent.
- The U.S. Bureau of Labor Statistics projects software developer employment to grow 15.8 percent between 2024 and 2034, adding 267,700 jobs, the largest numeric gain among AI and IT occupations it tracks.
How Much Code Is Written by AI in 2026?
There is no global telemetry for this. What exists is a small set of company-reported disclosures, each measured differently, each unaudited, and each quoted far beyond the boundary its speaker set. Axis Intelligence Research maintains the ledger below as a dated record of what was actually said, by whom, and when, because the single most-repeated statistic in this field is also the one most often stripped of its scope.
AI code share disclosures by company
| Organization | Stated share | Scope as stated | Date | Basis | Source |
|---|---|---|---|---|---|
| 75% | All new code, AI-generated and approved by engineers | Apr 22, 2026 | Company-reported | Google Cloud Next 2026 remarks | |
| 50% | All new code | Autumn 2025 | Company-reported, restated Apr 2026 | Google Cloud Next 2026 remarks | |
| 25% | New code, reviewed and accepted by engineers | Oct 29, 2024 | Company-reported, Q3 2024 earnings call | Alphabet earnings call | |
| Microsoft | 20-30% | Code inside repositories, some projects | Apr 29, 2025 | Company-reported, LlamaCon remarks | Microsoft, reported by TechCrunch |
The Google trajectory is the load-bearing number of this entire subject. According to Axis Intelligence Research, Google’s stated AI authorship share rose 50 percentage points in the eighteen months between October 2024 and April 2026, from 25 percent to 75 percent. Pichai also stated that a complex code migration run by agents and engineers together finished six times faster than was possible a year earlier with engineers alone.
Read the wording precisely. Google says “AI-generated and approved by engineers.” Microsoft said “written by software,” in “some projects,” with better results in Python than in C++. These are not the same measurement, they are not audited, and neither company publishes the underlying telemetry. A share of generated tokens surviving into a merged commit is a different quantity from a share of characters accepted in an editor, which is different again from a share of pull requests opened by an agent. The prompt-first end of that spectrum, where code is generated with minimal line-by-line review, is measured separately in our vibe coding statistics report.
Sarah Mitchell: The 75 percent figure gets recited as though someone counted lines. Nobody counted lines, or at least nobody published a counting method. What the number reliably tells you is the direction and the speed of the internal mandate, and both are extraordinary. What it does not tell you is how much of that generated code survived review unchanged, which is the only version of the statistic an engineering leader could actually budget against. The rejection rate is the missing column in every disclosure on this table.
The measurable proxy: agent-authored pull requests
Where telemetry does exist, it is narrower and more useful. GitHub’s Octoverse 2025 reports more than one million pull requests created by the Copilot coding agent between May and September 2025, and that nearly 80 percent of new GitHub users tried Copilot within their first week. For anyone entering the profession in 2025 or later, AI-assisted authorship is not a technique acquired at seniority. It is the default posture from day one. Adoption mechanics across specific tools are covered in our AI coding assistant statistics report.
How Much of a Developer’s Day Involves AI-Generated Code?
Google Cloud’s 2025 DORA State of AI-assisted Software Development, fielded to nearly 5,000 technology professionals between June 13 and July 21, 2025, gives the cleanest task-level picture available.
| Measure | Value | Population | Source |
|---|---|---|---|
| Use AI at work | 90% | All respondents | DORA 2025 |
| Increase over 2024 measure | 14.1% | All respondents | DORA 2025 |
| Use AI to write new code | 71% | Those who write code | DORA 2025 |
| Use AI to modify existing code | 66% | Those who perform the task | DORA 2025 |
| Median AI interaction time | 2 hours | AI users, most recent workday | DORA 2025 |
| Median experience with AI tools | 16 months | AI users | DORA 2025 |
| Never use agent mode | 61% | All respondents | DORA 2025 |
Two hours is roughly a quarter of an eight-hour day, and the median respondent had only sixteen months of experience with these tools when surveyed. The agent number is the one that resets expectations: as of mid-2025, 61 percent of respondents never used AI in an autonomous mode at all. Predictive text and chat carried the workload. The million agent-authored pull requests on GitHub arrived in the months immediately after that survey closed, which is why the 2026 picture is best read as an early-agentic one rather than a mature one.
Stack Overflow’s 2025 Developer Survey, with more than 49,000 responses across 177 countries, puts overall AI tool use or planned use at 84 percent. The gap between 84 and 90 is a population artifact rather than a contradiction: DORA surveys technology professionals inside organizations, Stack Overflow includes learners and hobbyists.
Is AI-Generated Code Secure? The Benchmark Data
This is where the subject stops being about velocity. Veracode’s 2026 GenAI Code Security Report tests models against 80 coding tasks across four languages and four vulnerability classes, with each task solvable in either a secure or an insecure way and no security-specific prompting. Across more than 100 models over four years, the mean security pass rate is 56 percent.
The finding that matters is not the level. It is the flatness. Over the same window in which syntax correctness climbed from roughly 50 percent to above 95 percent, security performance stayed inside a narrow band. Models learned to compile. They did not learn to be safe.
Security pass rate by programming language
| Language | Security pass rate | Failure rate | As of | Source |
|---|---|---|---|---|
| Python | 62% | 38% | Mar 2026 | Veracode |
| C# | 58% | 42% | Mar 2026 | Veracode |
| JavaScript | 57% | 43% | Mar 2026 | Veracode |
| Java | 30% | 70% | Aug 2026 (four-year mean) | Veracode |
Java is the enterprise problem hiding in plain sight. Veracode’s hypothesis is training-data gravity: models absorbed millions of lines of legacy Java written before modern secure frameworks existed, and they reproduce what they saw most often rather than what is correct now. For organizations whose core transactional systems are Java, the generated-code risk profile is roughly twice that of a Python shop.
Security pass rate by vulnerability class
| CWE | Vulnerability | Pass rate | Failure rate | Source |
|---|---|---|---|---|
| CWE-327 | Insecure cryptographic algorithms | 86% | 14% | Veracode |
| CWE-89 | SQL injection | 82% | 18% | Veracode |
| CWE-80 | Cross-site scripting | 15% | 85% | Veracode |
| CWE-117 | Log injection | 13% | 87% | Veracode |
Sarah Mitchell: Look at the split and the mechanism explains itself. SQL injection and weak crypto are local pattern problems. The insecure construct and the secure construct sit within a few tokens of each other, the anti-pattern is flagged thousands of times in training data, and pattern matching handles it. Cross-site scripting and log injection require tracking untrusted input across function boundaries and files, deciding where the trust boundary sits, and sanitizing at that exact point. That is dataflow reasoning across a long context, and it is the part of the job current architectures are worst at. Anyone waiting for the next model generation to close this gap should note that Veracode’s model-by-model data shows purpose-built coding models averaging 51 percent against 52 percent for general-purpose models. Training a model harder on code does not train it toward safety.
The best result in the Summer 2026 dataset was GPT-5.5 at a 68 percent pass rate, with six of eleven tested models clustering between 50 and 53 percent. Reasoning-focused variants reached 70 to 72 percent in earlier testing, which is the one architectural signal pointing anywhere useful: deliberate step-by-step generation functions as an internal review pass. Even at 72 percent, roughly one generated snippet in four carries a known flaw.
The signal in production repositories
Benchmarks are controlled. GitHub’s Octoverse 2025 shows what reaches real repositories. Broken Access Control overtook Injection as the most common CodeQL alert, flagged in more than 151,000 repositories, a 172 percent year-over-year rise. GitHub attributes part of this to misconfigured CI/CD permissions and to AI-generated scaffolds that skip authentication checks, and notes the category now leads in Python, Go, Java and C++.
The defensive picture is not uniformly bad. Average fix time for critical severity vulnerabilities fell from 37 days to 26 days year over year, and 26 percent fewer repositories received critical alerts, with automated remediation carrying much of that improvement. Both the offense and the defense are being automated. The CISA and NSA joint guidance on memory safe languages and CISA’s Product Security Bad Practices both put the burden on the manufacturer rather than the tool, which is the correct allocation when the tool has a 44 percent chance of choosing the unsafe implementation. Broader vulnerability trends sit in our AI security statistics coverage.
Does AI-Generated Code Make Teams Faster? What Controlled Studies Show
Self-reported productivity is close to unanimous. More than 80 percent of DORA respondents said AI increased their productivity, and 59 percent said it improved their code quality against 10 percent who said it worsened it.
Measured productivity tells a more complicated story. METR’s randomized controlled trial, run February to June 2025 with 16 experienced open-source developers across 246 real tasks in repositories they already knew, found that allowing AI tools made tasks take 19 percent longer. The same developers forecast a 24 percent speedup beforehand and still estimated a 20 percent speedup after finishing the work.
That result is now widely quoted without its sequel, which changes the reading. METR published a follow-up in February 2026 covering late-2025 tools with 57 developers, 143 repositories and more than 800 tasks. Returning developers showed an estimated 18 percent speedup and newly recruited developers 4 percent, but both confidence intervals cross zero, and METR judged its own central estimate unreliable. Between 30 and 50 percent of participants said they were withholding tasks from randomization because they did not want to do them without AI. METR’s own conclusion is that developers are probably faster in 2026 than in early 2025, and that the experiment can no longer measure by how much.
| Study period | Measured effect | Sample | Reliability as stated by the authors |
|---|---|---|---|
| Feb-Jun 2025 | 19% slower | 16 devs, 246 tasks | Published RCT result |
| Aug-Dec 2025 (returning) | 18% faster | 10 devs | CI -38% to +9%, judged unreliable |
| Aug-Dec 2025 (new) | 4% faster | 47 devs | CI -15% to +9%, judged unreliable |
Sarah Mitchell: The honest position in September 2026 is that nobody has a clean measurement of AI coding speedup, and the reason is instructive. The measurement broke because adoption succeeded. You cannot run a control arm when a third to a half of your participants refuse to submit the tasks where the treatment would help most. That is not a flawed study, it is an evaluation regime hitting the same wall that benchmark saturation hit two years ago. Anyone citing “19 percent slower” as the current state of the field in 2026 is quoting a February 2025 tool generation, and anyone citing vendor speedup claims is quoting a marketing department. The defensible statement is that the throughput is visible in commit counts and the per-task effect is not yet measurable.
The throughput is indeed visible. GitHub recorded 986 million commits in the Octoverse year, up 25 percent, with merged pull requests averaging 43.2 million per month, up 23 percent. DORA’s 2025 modelling found AI adoption now associated with higher software delivery throughput, a reversal of its 2024 finding, while the association with higher delivery instability persisted. In 2024, DORA estimated that each 25 percent increase in AI adoption came with a 1.5 percent throughput reduction and a 7.2 percent instability increase. The throughput half of that has flipped. The instability half has not. Tool-level evaluation criteria for teams choosing between assistants are set out in our AI coding assistants enterprise guide.
What Happens to Code Quality When AI Writes the Majority of It?
GitClear’s Maintainability Gap research tracks 623 million code changes from 2023 to 2026 across commercial and open-source repositories, classifying each changed line by operation. It is the only longitudinal dataset that measures structural habits rather than developer opinion, and every signal it tracks has moved in the same direction.
| Signal | 2023 | 2026 YTD | Change | Type |
|---|---|---|---|---|
| Block duplication (per million changed lines) | 40.3 | 73.0 | +81% | Risk |
| Within-commit copy/paste | baseline | +41% | +41% | Risk |
| Error-masking constructs | baseline | +47% | +47% | Risk |
| Two-week code churn | baseline | +15% | +15% | Risk |
| Function connectivity (calls per 1,000 changed lines) | 343 | 223 | -35% | Reuse |
| Moved code (refactoring) share | 13% | 3.8% | -71% | Reuse |
| Long-term update share (code older than 12 months) | 1.7% | 0.46% | -74% | Reuse |
Source: GitClear, The Maintainability Gap, 2026.
The refactoring collapse is the clearest single fact in this dataset. Moved code stood at 21 percent of changed lines in 2022. It is 3.8 percent in the first half of 2026, while copy/paste climbed from 9.4 percent to 15.7 percent over the same window. According to Axis Intelligence Research, that inverts a 2.23-to-1 preference for refactoring over duplication in 2022 into a 4.13-to-1 preference for duplication in 2026, a swing of roughly nine times in the relative odds.
Long-term maintenance is the quieter number. Changes touching code older than twelve months have fallen to 0.46 percent of all changes. Codebases are growing outward in new first-version components while their older strata go untouched. That is not a deficit that shows up in a sprint report. It shows up in year three.
The Code Durability Index (CDI): An Axis Intelligence Research Metric
Seven divergent signals are hard to cite and harder to track over time. Axis Intelligence Research built the Code Durability Index (CDI) to compress them into one number: the ratio of structural reuse behaviour to structural risk behaviour in the code being shipped.
Formula. Every input is indexed to its 2023 value, where 2023 equals 100. All seven inputs come from a single measurement methodology, GitClear’s operation classification, so the ratio compares like with like.
Reuse index R = mean(function connectivity, moved code share, long-term update share)
Risk index K = mean(block duplication, copy/paste, error masking, two-week churn)
CDI = R / K (2023 baseline = 1.00)
Inputs and computation, as of June 30, 2026:
| Component | 2023 | 2026 YTD | Indexed |
|---|---|---|---|
| Function connectivity | 343 | 223 | 65.0 |
| Moved code share | 13% | 3.8% | 29.2 |
| Long-term update share | 1.7% | 0.46% | 27.1 |
| Reuse index R | 100 | 40.4 | |
| Block duplication | 40.3 | 73.0 | 181.1 |
| Within-commit copy/paste | 100 | +41% | 141.0 |
| Error-masking constructs | 100 | +47% | 147.0 |
| Two-week churn | 100 | +15% | 115.0 |
| Risk index K | 100 | 146.0 |
CDI = 40.4 / 146.0 = 0.28
The reading. According to Axis Intelligence Research, the Code Durability Index stands at 0.28 as of June 30, 2026, against a baseline of 1.00 in 2023. That is a 72.3 percent decline in the ratio of reuse behaviour to risk behaviour across three years of AI adoption scaling.
What moved it. Both halves contributed, and roughly equally in direction if not in magnitude. Reuse behaviour fell to 40 percent of its 2023 level while risk behaviour rose to 146 percent of it. A codebase can absorb one of those. Absorbing both at once means the compounding cost of a change grows even as the cost of producing a change falls.
What would reverse it. The index is a ratio, so it recovers if either term moves. Refactoring budgets, duplicate-block tripwires in CI, and explicit review for error-masking constructs act on the risk term directly. Agentic tooling that reads the whole repository before writing, rather than completing a file in isolation, would act on the reuse term, and function connectivity is the component to watch for evidence of that.
Scope. CDI measures structural habit in code that reaches commits. It says nothing about correctness, security posture, or business value, and it does not isolate AI as the cause. It is a directional instrument for the same reason a change failure rate is: the trend carries the information, not the absolute level. Methodology version and any component change will be disclosed on this page.
A second Axis figure: review attention per commit
Octoverse 2025 reports commit volume up 25.1 percent year over year and comments on commits down 27 percent, with comments on issues and pull requests essentially flat at plus 0.35 percent. Both inputs come from the same platform telemetry and the same measurement year, so they combine cleanly.
Review attention per commit = (100 - 27) / (100 + 25.1) = 0.584
According to Axis Intelligence Research, commit-level review attention per commit fell 41.6 percent during the Octoverse 2025 measurement year. The volume of code entering repositories grew by a quarter while the human commentary attached to it fell by more than a quarter. GitHub separately reports that 72.6 percent of developers using Copilot code review said it improved their effectiveness, which is the plausible substitution: machine review is absorbing work that human review used to do. Whether machine review catches what human review caught is the open question, and the Broken Access Control alert curve is not an encouraging early answer.
A calculation Axis Intelligence Research declined to publish
The obvious headline would multiply Google’s 75 percent authorship share by Veracode’s 44 percent insecure-generation rate to produce a global “insecure lines shipped” figure. We will not publish that number, and the reason belongs in the open.
The two inputs are methodologically incompatible. Veracode measures unprompted, unreviewed, single-function generation under adversarial task design. Google’s figure describes code that passed engineer approval, in a repository with mandatory review, static analysis and a security organization. Multiplying them would treat a laboratory failure rate as a production defect rate and silently delete the review layer that exists precisely to catch these flaws. The row remains in the dataset flagged as retracted, with this reasoning attached.
Which Languages Are Absorbing AI-Generated Code?
Language choice is now downstream of AI reliability, which is a genuinely new dynamic. In August 2025, TypeScript overtook both Python and JavaScript to become the most used language on GitHub by monthly contributor count, reaching 2,636,006 contributors after adding more than a million in a year, a 66.6 percent rise.
GitHub’s reading is that type systems act as guardrails for generated code, catching model errors at compile time rather than in production. The security data supports the intuition from a different angle: the languages where models perform best on secure generation, Python at 62 percent and C# at 58 percent, are not the same as the languages with the strongest static guarantees, but Java at 30 percent shows what happens when a model’s training corpus predates the safe idiom. Nearly 80 percent of new repositories now use one of six languages, so the concentration effect is real.
Sarah Mitchell: This is the first time in my memory that a language won a popularity contest on the strength of how well it constrains a non-human author. Frameworks scaffolding TypeScript by default explains part of it. The rest is teams discovering that a type error caught at build time is the cheapest possible place to catch a model’s mistake, and that untyped generated code pushes that discovery into production. Language rankings across the broader ecosystem are tracked in our GitHub Copilot statistics report.
Is AI-Generated Code Reducing Software Developer Employment?
The federal projection data does not show a contraction. According to the U.S. Bureau of Labor Statistics, software developer employment is projected to grow 15.8 percent between 2024 and 2034, adding 267,700 jobs, the largest numeric increase among the AI and IT occupations BLS tracks and roughly five times the 3.1 percent growth projected for all occupations. Data scientists lead the same table at 33.5 percent.
There is a source vintage discrepancy worth stating rather than smoothing. The Occupational Outlook Handbook projects 10 percent growth for 2025 to 2035 with about 106,100 annual openings. That figure covers a broader combined occupation group of software developers, quality assurance analysts and testers, and uses a later base year. The two numbers describe different populations over different decades. Axis Intelligence Research publishes both rather than averaging them, because averaging incompatible definitions produces a number that means nothing.
What BLS does project to decline are occupations where AI substitutes for the whole task rather than part of it: customer service representatives at minus 5.5 percent, claims adjusters at minus 5.1 percent, procurement clerks at minus 8.7 percent. Code generation, on the current evidence, substitutes for part of the task and adds a review obligation to the remainder.
Methodology
Collection. Every figure in this report was retrieved from a primary source document during production on September 15, 2026, with the URL and retrieval date recorded in the accompanying dataset. Sources are the publishing organization’s own report, filing, blog or government release. No figure was taken from a secondary compilation, and no figure was estimated from memory.
Source set. Google (Cloud Next 2026 remarks), Google Cloud DORA (State of AI-assisted Software Development 2025, n≈5,000, fielded June 13 to July 21, 2025), Veracode (2026 GenAI Code Security Report and Spring 2026 update, 80 tasks, four languages, four CWE classes, 100+ models), GitClear (The Maintainability Gap, 623 million analyzed changes, 2023 to 2026), GitHub (Octoverse 2025, measurement year September 1, 2024 to August 31, 2025), METR (RCT July 2025 and design update February 2026), Stack Overflow (2025 Developer Survey, 49,000+ respondents, 177 countries), U.S. Bureau of Labor Statistics (Employment Projections 2024-34 and Occupational Outlook Handbook), CISA and NSA (secure development guidance).
Formulas. CDI is defined above with all seven inputs, their 2023 and 2026 values, and the arithmetic shown. Review attention per commit is (100 minus 27) divided by (100 plus 25.1) using Octoverse commit-comment and commit-volume changes. The paste-to-refactor ratios are direct quotients of GitClear’s copy/paste and moved-code shares for the stated years. All arithmetic was recomputed programmatically against the dataset before publication.
Scope of the estimates. Company authorship shares are self-reported and unaudited, and are labelled as such throughout. Benchmark pass rates measure unprompted single-function generation and are not production defect rates. GitClear’s dataset skews toward organizations using code-analytics tooling. Survey figures carry self-selection effects, and METR has publicly stated that its own late-2025 estimate is unreliable for that reason. Where two sources disagree or use incompatible definitions, both are published with their scope stated.
Comparability rule. Axis Intelligence Research combines figures across sources only where the underlying methodology permits it. One combination was declined on those grounds and is retained in the dataset as a retracted row with its reasoning.
About This Dataset
The dataset behind this report, ai-generated-code-statistics-2026.csv, contains 105 rows covering AI code authorship shares, adoption and task-level usage, security benchmark results by language and CWE, maintainability signals, controlled productivity studies, code volume telemetry, U.S. employment projections, and every Axis-calculated figure with its method note. Each row carries value, unit, as-of date, segment, source organization, source document, source URL, retrieval date, primary-source flag, Axis-calculated flag and data type.
License. Released under CC BY 4.0. Free to use, republish and redistribute with attribution.
Citation format: Axis Intelligence Research, AI-Generated Code Statistics 2026, 2026.
Cite this report
APA: Axis Intelligence Research. (2026). AI-generated code statistics 2026: Share of code, quality, security and maintainability data. https://axis-intelligence.com/ai-generated-code-statistics/
MLA: Axis Intelligence Research. “AI-Generated Code Statistics 2026: Share of Code, Quality, Security and Maintainability Data.” Axis Intelligence, 12 Sept. 2026, axis-intelligence.com/ai-generated-code-statistics/.
Chicago: Axis Intelligence Research. “AI-Generated Code Statistics 2026: Share of Code, Quality, Security and Maintainability Data.” Axis Intelligence, September 15, 2026. https://axis-intelligence.com/ai-generated-code-statistics/.
Frequently Asked Questions
If AI writes 75 percent of new code at Google, what percentage survives code review unchanged?
No company publishes that figure. Google states that its 75 percent is “AI-generated and approved by engineers,” which confirms review happened but not how much was rewritten during it. According to Axis Intelligence Research, the rejection or rewrite rate is the single most important missing column in every corporate AI authorship disclosure to date, because authorship share without it measures generation volume rather than accepted output.
Should our Java teams treat AI-generated code differently from our Python teams?
The benchmark data says yes. Veracode’s four-year mean puts Java at a 30 percent security pass rate against 62 percent for Python, meaning roughly seven in ten Java generations chose the insecure implementation when no security guidance was given. Veracode attributes this to models trained heavily on legacy Java that predates modern secure frameworks. A Java codebase warrants stricter static analysis gates on generated code than a Python one.
Which vulnerability classes do AI models fail on most often, and why those?
Cross-site scripting (CWE-80) at a 15 percent pass rate and log injection (CWE-117) at 13 percent. Both require tracking untrusted input across multiple functions and files to identify the correct sanitization boundary. Models handle SQL injection (82 percent) and weak cryptography (86 percent) well because those are local pattern-recognition problems solvable within a few tokens. The split maps directly onto the difference between pattern matching and dataflow reasoning.
Does the METR study still show that AI makes experienced developers slower?
Not as a current finding. The 19 percent slowdown was measured on February to June 2025 tooling with 16 developers. METR’s February 2026 follow-up estimated an 18 percent speedup for returning participants and 4 percent for new ones, but both confidence intervals cross zero and METR judged the result unreliable because 30 to 50 percent of participants withheld tasks they did not want to attempt without AI. METR’s stated position is that developers are probably faster now and that the experiment can no longer measure by how much.
Why is Broken Access Control now the top CodeQL alert?
It overtook Injection during 2025, flagged in more than 151,000 repositories at 172 percent year-over-year growth. GitHub attributes the rise to misconfigured CI/CD permissions and token scopes plus AI-generated scaffolds that produce endpoints looking structurally correct while omitting authorization checks. The category now leads in Python, Go, Java and C++, having previously been concentrated in specific stacks.
What does the Code Durability Index actually measure, and can I recompute it?
CDI is the ratio of three structural reuse signals to four structural risk signals, each indexed to its 2023 value, all drawn from GitClear’s operation-classification methodology. The 2026 reading is 0.28 against a 1.00 baseline. Every input, its 2023 and 2026 value, and the arithmetic are published in the methodology section above and in the dataset, so any competent analyst can reproduce the reading from the stated inputs or recompute it with different weights.
Is refactoring actually disappearing, or is AI just changing what refactoring looks like?
The measured operation is disappearing. Moved code fell from 21 percent of changed lines in 2022 to 3.8 percent in the first half of 2026 while copy/paste rose from 9.4 percent to 15.7 percent, and function connectivity fell 35 percent, meaning new code increasingly does not call into existing code. If AI were performing consolidation in an unmeasured way, connectivity would rise rather than fall. Three independent signals point the same direction.
How should an engineering leader budget for AI-generated code review in 2026?
Start from the measured asymmetry: generation cost is falling while review obligation is rising. Commit volume grew 25.1 percent in the Octoverse year while commit comments fell 27 percent, a 41.6 percent decline in review attention per commit by Axis Intelligence Research’s calculation. Practical controls that map to the data are duplicate-block tripwires in CI, mandatory static analysis on generated diffs with stricter thresholds for Java, explicit review for error-masking constructs, and a protected refactoring budget rather than an aspirational one.
Are AI coding tools reducing demand for software developers?
Federal projections say no for this occupation specifically. BLS projects 15.8 percent growth for software developers from 2024 to 2034, adding 267,700 jobs, against 3.1 percent for all occupations. The occupations BLS projects to decline under AI adoption are ones where the technology substitutes for the entire task, such as customer service representatives at minus 5.5 percent. Code generation currently substitutes for part of the task and adds review work to what remains.
Do agentic coding tools change these numbers?
They are the main reason to expect the 2027 data to look different. As of mid-2025, 61 percent of DORA respondents never used AI in agent mode, so most measurements here describe assisted authorship rather than autonomous authorship. GitHub recorded more than a million Copilot coding agent pull requests between May and September 2025, after that survey closed. Agent-authored code changes both terms of the durability question at once: more volume, and less human contact per unit of it.