The promise was irresistible: press a key, accept a suggestion, and watch functional code materialise in seconds. By late 2025, according to the JetBrains State of Developer Ecosystem survey of nearly 25,000 developers, 85 per cent of developers regularly use AI tools for coding and development work. Stack Overflow's 2025 Developer Survey reports that 84 per cent of respondents now use or plan to use AI tools, a notable jump from 76 per cent in 2024. The adoption curve has bent sharply upward, and there appears to be no flattening in sight.
Yet beneath the productivity statistics lies a troubling counter-narrative. When METR, a non-profit research organisation focused on AI capabilities, conducted a randomised controlled trial examining how early-2025 AI tools affect the productivity of experienced open-source developers, they discovered something unexpected. Developers using AI tools took 19 per cent longer to complete tasks than those working without them. Before the study, developers predicted AI would speed them up by 24 per cent. After experiencing the slowdown firsthand, they still believed AI had improved their performance by 20 per cent. The gap between perception and reality was stark and concerning.
This disconnect reveals something fundamental about how AI coding assistance is reshaping the software industry. The tools are genuinely powerful, the adoption is genuinely rapid, and the risks are genuinely systemic. What remains unclear is whether the industry possesses the collective wisdom to establish guardrails before the consequences become irreversible.
The Illusion of Accelerated Competence
The METR study recruited 16 experienced developers from large open-source repositories averaging over 22,000 stars and more than one million lines of code. These were not novices experimenting with AI for the first time; they had an average of five years of experience working on their specific repositories, representing 59 per cent of each repository's lifetime, over which time they made approximately 1,500 commits. Each developer provided real issues that would be valuable to their repository, and these were randomly assigned to either allow or disallow AI use.
Developers accepted less than 44 per cent of AI generations. This relatively low acceptance rate resulted in wasted time, as developers often had to review, test, and modify code only to reject it in the end. Even when suggestions were accepted, developers reported spending considerable time reviewing and editing the code to meet their high standards. The study focused on mature, complex environments where AI was less effective than in simpler settings examined in other research.
What makes this finding particularly significant is the experience level of the participants. These developers possessed exactly the foundational knowledge and contextual understanding that should, in theory, allow them to leverage AI most effectively. Yet they still experienced slowdowns. The implications for less experienced developers are sobering.
METR itself now labels the result historical. The trial ran from February to June 2025 using the tools of that period, primarily Cursor Pro paired with Claude 3.5 and 3.7 Sonnet, and the organisation cautions that its findings do not necessarily reflect current tools or workflows. That caveat deserves to be taken seriously, but it does not dissolve the underlying finding: the gap between what developers believed was happening and what the stopwatch recorded is a fact about human self-assessment under automation, not about any particular model release.
Stack Overflow's 2025 survey captures the ambivalence spreading through the profession. Trust in the accuracy of AI has fallen from 40 per cent in previous years to just 29 per cent in 2025. More developers actively distrust the accuracy of AI tools, with 46 per cent expressing distrust compared to 33 per cent who express trust, and only 3 per cent report highly trusting the output. Experienced developers are the most cautious, with the lowest “highly trust” rate at 2.6 per cent and the highest “highly distrust” rate at 20 per cent.
The biggest single frustration, cited by 66 per cent of developers, is dealing with AI solutions that are almost right but not quite. This often leads to the second-biggest frustration: debugging AI-generated code takes more time than expected, reported by 45 per cent of respondents. An overwhelming 75 per cent said they would still ask another person for help when they do not trust AI's answers.
Compounding Vulnerabilities in Skill Acquisition
The erosion of foundational skills presents a distinctive challenge because it compounds over time. A developer who never learns to debug effectively because AI handled early debugging tasks will struggle when AI-generated code introduces subtle errors that require deep understanding to resolve. Each gap in foundational knowledge creates dependencies on tools that cannot always be trusted.
Sonar's State of Code Developer Survey Report 2026, sampling 1,149 responses, found that junior developers expressed significant concern about the erosion of their personal coding abilities, with 50 per cent of junior developers voicing this worry. Additionally, 56 per cent of junior developers reported concern about a decline in codebase understanding. These are not abstract fears; they reflect lived experience of skills atrophying under AI dependence.
Academic research examining ChatGPT-generated code found that more than 50 per cent of generated code snippets are integrated without modifications. Studies on GitHub Copilot reveal an increase in copied and repeated code. When students use Copilot, they spend 11 per cent less time manually writing code and 12 per cent less time conducting web searches. This might sound like efficiency, but it represents a fundamental shift in how they engage in programming.
Researchers have identified two novel patterns among novice programmers using Copilot. The first, termed “shepherding”, occurs when novice programmers type code that matches Copilot's suggestions but end up not accepting those suggestions. The second, termed “straying”, occurs when they accept incorrect Copilot-generated code, leading to debugging rabbit holes that stray further from correct solutions. In exit interviews, students reported concerns about not understanding how or why Copilot suggestions work.
The pedagogical implications are significant. Simply acquiring answers and code from AI tools can be a barrier to improving learners' critical thinking and problem-solving abilities. Research emphasises that while generative AI can drastically improve the efficiency of software development, it should be viewed as a complementary tool rather than a replacement for traditional programming skills. Without instructor-led constraints, students may gravitate toward the maximum help option, undermining deliberate practice.
The Mentorship Collapse
The erosion of junior developer skills becomes catastrophic when combined with the collapse of traditional mentorship structures. According to the AI Impact Report 2025, 38 per cent of respondents agreed that AI tools have reduced the amount of direct mentoring junior engineers receive from senior engineers. The mechanisms are straightforward: if an AI can answer a junior's question, why bother a senior? If AI generates acceptable code, what is there to review and teach?
LeadDev's AI Impact Report 2025 found that 18 per cent of organisations expect fewer junior hires over the next 12 months, compared with 10 per cent anticipating fewer senior engineer hires. Over the longer term, 54 per cent felt that the adoption of AI coding tools would reduce hiring for junior developers. Marc Benioff announced that Salesforce will hire no new engineers in 2025, stating that the company has increased productivity with AI technology by more than 30 per cent. This statement reverberated through the industry as a potential harbinger of widespread contraction in entry-level opportunities.
Industry forecasts project a mid-level developer shortage emerging from 2027 to 2030 as companies compete for scarce talent, followed by a senior developer crisis from 2030 to 2035 when organisations lack oversight capacity for AI systems. The short-term savings from hiring fewer juniors could backfire dramatically. Without a steady stream of early-career developers, companies may face a shortage of mid-level talent in just a few years.
Instead of seniors guiding juniors, many companies rely on AI tools as a substitute, leaving juniors without the traditional apprenticeship that builds careers. As industry observers have warned, rather than have seniors define work for juniors, companies instead focus seniors on using AI to generate code, creating a gap where juniors would find their first jobs. Remote work has compounded the problem, eliminating countless informal learning opportunities that previous developer generations took for granted: hallway conversations, overheard code review discussions, and the ability to tap someone on the shoulder to ask questions.
The Code Quality Reckoning
GitClear's analysis of 211 million changed lines of code, authored between January 2020 and December 2024, reveals the material consequences of AI-assisted development. The percentage of code associated with refactoring sunk from 25 per cent of changed lines in 2021 to less than 10 per cent in 2024. Lines classified as copy-pasted or cloned rose from 8.3 per cent to 12.3 per cent in the same period. The number of code blocks with five or more duplicated lines increased by eight times during 2024.
For the first time in GitClear's measurement history, 2024 was the year when the number of copy-pasted lines exceeded the number of moved lines. Code churn, the proportion of new code revised within two weeks of its initial commit, grew from 3.1 per cent in 2020 to 5.7 per cent in 2024. This indicates a rise in premature or low-quality commits that require immediate correction.
The reason, according to GitClear, is that code assistants make it easy to insert new blocks of code simply by pressing the tab key. It is less likely that AI will propose reusing a similar function elsewhere in the code, partly because of limited context size. Duplicated code may run correctly, but is often a sign of poor code quality since it adds bloat, suggests lack of clear structure, and increases risk of defects when the same code is updated in one place but not in others.
Google's 2024 DORA report found that while AI adoption increased individual output by 21 per cent more tasks completed and 98 per cent more pull requests merged, organisational delivery metrics remained flat. More alarmingly, AI adoption correlated with a 7.2 per cent reduction in delivery stability. The 2025 DORA report confirms this pattern persists: AI adoption continues to have a negative relationship with software delivery stability. Speed without stability is accelerated chaos.
Security Debt at Machine Speed
The security implications of widespread AI code generation are particularly alarming. The Veracode 2025 GenAI Code Security Report found that 45 per cent of AI-generated code samples fail security tests. When LLMs generate code, they prioritise working code over secure code. Research indicates that when LLMs are given a choice between a secure and an insecure method, they choose the insecure path nearly half the time.
This creates a dangerous divergence: the functional capabilities of AI are accelerating rapidly, while its security capabilities remain stagnant. With AI adoption in software development skyrocketing, some reports indicate 97.5 per cent of companies now use AI in their engineering processes, and organisations are producing far more code, far faster. Since the proportion containing security flaws remains consistently high at around 45 per cent, the absolute volume of new vulnerabilities entering corporate codebases is exploding.
IBM's 2025 Cost of a Data Breach Report reveals that 13 per cent of organisations reported breaches of AI models or applications, with 97 per cent lacking proper AI access controls. Shadow AI breaches cost an average of $670,000 more than traditional incidents and affected one in five organisations in 2025. The global average cost of a breach actually fell 9 per cent to $4.44 million, down from $4.88 million a year earlier, yet the United States average climbed to $10.22 million. The business case for robust security controls is therefore sharpest precisely in the market generating the most AI-assisted code.
The term “vibe coding” emerged in early 2025 to describe the practice of building entire applications using natural language prompts via large language models. In this paradigm, the developer often forgets that the code even exists, shifting focus from syntax and logic to high-level intent. A systematic grey literature review found that the most common quality assurance practice among vibe coders was 36 per cent skipping QA entirely, accepting AI-generated code without validation.
The failure patterns are measurable rather than anecdotal. Veracode's testing found that Java fared worst of the languages examined, failing security tests in 72 per cent of tasks, and that AI tools failed to defend against cross-site scripting in 86 per cent of the relevant code samples. Practitioners have documented cases of insecure systems built through vibe coding, including applications that lacked authentication, authorisation, or contained hardcoded secrets.
The Environmental Footprint of Casual Generation
Beyond the immediate consequences for code quality and security, AI-assisted development carries substantial environmental costs that rarely enter productivity discussions. MIT research explains that data centres consumed an estimated 415 terawatt-hours of electricity in 2024, representing about 1.5 per cent of global electricity consumption. An April 2025 report from the International Energy Agency predicts that the global electricity demand from data centres will more than double by 2030, to around 945 terawatt-hours.
The IEA describes AI as the most important driver of this growth. AI has been responsible for around 5 to 15 per cent of data-centre power use in recent years, but this could increase to 35 to 50 per cent by 2030. The deployment of AI servers across the United States could generate additional annual carbon emissions from 24 to 44 million tonnes CO2-equivalent between 2024 and 2030, depending on the scale of expansion.
The energy consumption of individual AI queries is significant and growing. Research indicates that a single short GPT-4o query consumes 0.42 watt-hours, exceeding the footprint of a Google search by approximately 40 per cent, whilst other estimates place a standard text query on the same model nearer 0.3 watt-hours. Reasoning-heavy models consume dramatically more. Researchers estimate that GPT-5 averages around 18 watt-hours per query, with complex answers reaching 40 watt-hours, roughly sixty times the cost of a routine exchange at the average and more than a hundred times at the upper bound.
ChatGPT had reached approximately 900 million weekly active users by March 2026, and serves more than 2.5 billion queries per day. If an average query uses 0.34 watt-hours, that amounts to 850 megawatt-hours per day, enough to charge thousands of electric vehicles. This adds up to nearly one trillion queries each year. One year's energy consumption is roughly equivalent to powering 29,000 US homes for a year.
While training AI models is energy-intensive, running them through inference consumes even more power, accounting for over 80 per cent of AI's total electricity use. The gain in energy consumption will be driven mostly by AI inference rather than AI training. The Schneider Electric report estimates that all generative AI queries consumed 15 terawatt-hours in 2025 and will use 347 terawatt-hours by 2030.
The carbon footprint of AI systems alone could be between 32.6 and 79.7 million tonnes of CO2 emissions in 2025, equivalent to that of New York City, while the water footprint could reach 312.5 to 764.6 billion litres. Google's carbon emissions rose 48 per cent over the past five years and Microsoft's by 23.4 per cent since 2020, largely due to cloud computing and AI. The IEA estimates that data-centre emissions will reach 1 per cent of global CO2 emissions by 2030 in its central scenario, or 1.4 per cent in a faster-growth scenario, making this one of the few sectors where emissions are set to grow alongside road transport and aviation.
Concentration of Quality Assurance Responsibility
As AI generates ever more code, the burden of quality assurance concentrates among fewer expert reviewers. Qodo's 2026 analysis of enterprise code review tools observes that AI-assisted development now accounts for nearly 40 per cent of all committed code, and global pull request activity has surged. Leaders frequently report that review capacity, not developer output, is the limiting factor in delivery. When code can be generated faster than it can be reviewed, the natural safeguard of careful human inspection begins to fail.
The most successful engineering organisations in 2025, according to Qodo's analysis, shifted routine review load off senior engineers by automatically approving small, low-risk, well-scoped changes, whilst routing schema updates, cross-service changes, authentication logic, and contract modifications to humans. But this tiered approach requires sophisticated tooling and organisational discipline that many companies have not yet developed.
The concentration of review responsibility creates its own risks. When a small number of experts must validate ever-increasing volumes of AI-generated code, review quality inevitably suffers. Fatigue sets in, shortcuts become tempting, and the very safeguards designed to catch AI errors begin to erode. The cycle compounds: more AI code, fewer reviewers, less thorough review, more problems reaching production.
Qodo's research found that 82 per cent of developers use AI coding assistants either daily or weekly, suggesting AI has moved beyond experimentation and into the core development workflow. Among teams using AI for code review, quality improvements jump to 81 per cent. This shows that quality gains are tightly linked to how AI is implemented, not just how often it is used. Yet only a fraction of organisations have implemented the governance structures necessary to realise these gains safely.
Educational Interventions and Scaffolded Workflows
The research on educational interventions offers some grounds for optimism, though the path forward requires deliberate effort rather than passive adoption. Researchers have developed tools like CodeFlow Assistant, a generative AI tool that provides four levels of scaffolding guidance, from flowcharts to cloze coding to basic coding solutions to advanced coding solutions, supporting novice programmers in mastering skills ranging from foundational understanding to advanced application.
Scaffolding as a pedagogical approach involves providing temporary support to learners as they develop new skills. Instructors might offer sample prompts and clear examples of how to interact with AI. As students become more familiar with the AI tool, these supports can be gradually reduced, encouraging students to take more control of the learning process.
To ensure deliberate practice on comprehensive and accurate hypothesis construction, students can engage in tasks like making test suites more complete and correctly mapping explanations to bugs. LLMs can take over tasks indirectly related to core learning goals, including generating diverse bugs and fixes, freeing students from code writing, while also supporting scaffolding, generating hints, and providing immediate feedback throughout the practice.
Research emphasises that AI-generated code should be a starting point rather than a final product, and students must learn to review, test, and improve on AI output. Instructors should design assessments that evaluate students' problem-solving processes rather than just code outcomes. Students can be required to explain how AI contributed to their work or identify potential errors in AI-generated suggestions. Such strategies can foster deeper learning and critical thinking.
The adoption statistics in education are striking. Reported usage of AI among students increased sharply over recent years: in 2023, only 36.8 per cent of students reported active use, rising to 63.9 per cent by 2024, and by 2025, 91.7 per cent of respondents reported active use. The tools are already embedded in educational practice; the question is whether that embedding will develop foundational skills or undermine them.
Industry Guardrails and Governance Frameworks
The three fundamental guardrails when adopting AI-assisted coding tools are code quality, code familiarity, and code and test coverage. The good news is that the core of these guardrails can be automated. One of the simplest and most effective ways to reduce security risk from AI-generated code is to start with pull request checks. PR checks integrate directly into existing development workflows, scanning new code for vulnerabilities before it is merged into the main branch. They are easy to configure, centrally managed, and provide immediate feedback.
Organisations should focus on educating teams about the specific strengths and limitations of AI coding assistants. Engineering managers and software developers inherently know that creating software is a highly iterative process, continually improving, optimising and securing code before it moves to production. Most developers prefer working with their own code over reading, understanding and fixing the code of others, including AI-generated code.
One effective tactic is to make access to AI coding assistants contingent on the local security setup. Organisations can ask developers to submit a screenshot showing a security plugin installed and configured before granting a licence to tools like GitHub Copilot. It is a lightweight ask that sets a clear expectation: if you are using powerful code-generation tools, you are also responsible for validating that output locally.
Mandates and strict policies may succeed in the short term, but often meet resistance and reduce long-term engagement. The better approach is incentivising adoption, not enforcing it. This requires cultural change alongside technical controls.
Australia's Department of Industry, Science and Resources published guidance in October 2025 outlining six essential practices for safe and responsible AI governance. Adopting these guardrails will create a foundation for safe and responsible AI use and make it easier for organisations to comply with potential future regulatory requirements. Singapore's Infocomm Media Development Authority published the world's first formal framework for agentic AI systems on 22 January 2026 at the World Economic Forum in Davos, mandating limits on autonomy, human approvals and lifecycle monitoring to counter risks like unauthorised actions or automation bias.
The European Union became the first major jurisdiction to adopt a comprehensive framework for regulating AI with the EU Artificial Intelligence Act, which came into force in August 2024, divides AI systems into risk-based categories, and rolls out rules in phases to give organisations time to prepare. Those phases have since slipped. Negotiators reached provisional agreement on the Digital Omnibus on AI on 7 May 2026, the European Parliament formally endorsed it on 16 June 2026, and the Council gave its final green light on 29 June 2026. The package defers high-risk obligations for stand-alone systems under Annex III from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products under Annex I to 2 August 2028, whilst adding a new prohibition to Article 5 covering AI-generated non-consensual intimate imagery and child sexual abuse material. AuditBoard's survey shows that only 25 per cent of companies have a fully implemented governance programme, highlighting how policy maturity still lags adoption. The direction of travel is instructive. The obligations tightened concern content that is viscerally harmful and politically legible, whilst those governing how high-risk systems are actually built, tested and documented are the ones postponed by sixteen months or more. Governance is not merely lagging adoption in the enterprise; the regulatory timetable itself has now been instructed to wait.
Preserving Critical Thinking While Leveraging Speed
The central challenge is not whether to use AI assistance but how to use it in ways that preserve the cognitive skills that make developers valuable. Finding a balance between tool usage and coding independently is crucial; failing to do so may result in eroded skills. A balanced approach is essential, where AI tools are used to complement rather than replace traditional coding practices and teaching methods.
Some developers who relied heavily on AI tools found themselves struggling with tasks that previously came naturally when working without those tools. One developer reported feeling “so stupid because things that used to be instinct became manual, sometimes even cumbersome.” Just as athletes still perform basic drills, the only way to maintain an instinct for coding is to regularly practise the grunt work.
The fix for the mentorship gap is pairing AI assistance with human mentorship. Juniors use AI to draft solutions, then review with a senior who explains what is good and what needs changing. The AI speeds up the work, the senior ensures learning happens. Organisations should make mentorship explicit rather than assuming it will happen naturally. Creating structures for regular pairing sessions, code review discussions, and architectural conversations is essential. Sharing reasoning, not just conclusions, gives junior developers exposure to thinking processes, not just outputs.
Cognitive resilience and ethics awareness will give people a creative edge through the use of critical thinking capabilities and moral reasoning when collaborating with AI. In the next decade, workforce success will be defined by the ability to integrate across disciplines and work with AI systems rather than a single skill. Emphasising continuous learning and appropriate guardrails will remain essential to ensure that the human element in software development shines through.
Preventing Irreversible Consequences
The question facing the industry is whether current trends can be reversed or whether certain consequences have already become locked in. Reliance on AI is growing among younger and heavier users. Roughly one in three Gen Z workers say they could not do their job or that it would be significantly harder without AI. Among power users, more than one in three report similar levels of dependence. When skills have atrophied and alternative approaches have been forgotten, recovery becomes exponentially more difficult.
AI literacy is fast becoming a basic requirement in most jobs. Yet, nearly half of employees using AI tools at work received no training, and over one-third had only minimal guidance from their employers. Fewer than one in ten small or medium-sized enterprises offer formal AI training programmes. Adoption is happening informally and often without oversight, leaving workers and organisations exposed.
More formal governance structures remain less widespread. About three in ten workplaces report having governance policies that address approvals, disclosures or quality monitoring. The gap highlights how policy maturity still lags adoption, even as AI becomes more embedded in everyday work.
The environmental costs add urgency to the need for responsible adoption. Smart siting, faster grid decarbonisation, and operational efficiency could cut data centre impacts by approximately 73 per cent for carbon dioxide and 86 per cent for water compared with worst-case scenarios. Locating facilities in regions with lower water-stress and improving cooling efficiency could slash water demands by about 52 per cent. However, the AI server industry is unlikely to meet its net-zero aspirations by 2030 without substantial reliance on highly uncertain carbon offset and water restoration mechanisms.
Cascade failures could occur where technical debt in one system triggers failures across interconnected government and military networks. Cyber insurance companies are beginning to adjust their policies, requiring disclosure of AI tool usage, implementing higher premiums for companies with high percentages of AI-generated code, mandating security audits specifically focused on AI-generated vulnerabilities, and excluding coverage for certain types of AI-related security incidents. These market mechanisms may prove more effective than regulation in forcing behavioural change.
Building Sustainable Practices
Successful companies implement frameworks including mandatory code reviews, architectural planning before coding, comprehensive testing of AI-generated code, security validation, and ensuring human teams understand their systems. The key is using AI to enhance rather than replace human expertise.
Mandatory human-in-the-loop review is a key principle in AI governance and a primary detective control in the AI development lifecycle. Certified senior developers bring the architecture mindset that AI lacks. They validate outputs rigorously, catch shallow fixes before they pile up, and turn AI into a disciplined extension of the team rather than a loose cannon. Without them, velocity is just borrowed time.
Forrester predicts that by 2025, more than 50 per cent of technology decision-makers will face moderate to severe technical debt, with that number expected to hit 75 per cent by 2026. Small changes break unrelated systems. Reviews get waved through. Refactors stop happening. The real technical debt reveals itself not as bad code, but as unowned code no one fully understands and everyone is afraid to change.
The 2025 DORA report introduced rework rate as a fifth core metric precisely because AI shifts where development time gets spent. Teams produce initial code faster but spend more time reviewing, validating, and correcting it. Monitoring cycle time, code review patterns, and rework rates reveals the true productivity picture that perception surveys miss.
AI can become a complement to expertise, but it cannot be a replacement for it. As the technology evolves, so too must our capacity to understand it, question it and guide it toward public good. The recommendation is to pair innovation with ethics, speed with reflection and excitement with education. Guardrails and skills development, including basic AI literacy, are not opposing forces; they are the two hands that will support progress.
The tools are powerful. The adoption is accelerating. The risks are real but not yet irreversible. The industry's response over the next few years will determine whether AI coding assistance becomes a sustainable enhancement of human capability or a compounding liability that erodes the very skills it was meant to augment. The choice remains, for now, in human hands.
