AI coding tools are getting better at producing software quickly. The harder question for engineering teams is whether humans can verify that software at the same speed.
That distinction matters because developer productivity is not simply a measure of how many lines of code can be generated. Production software still has to be understood, tested, reviewed, secured and maintained. As generative tools increase the amount of code developers can produce, a growing body of research suggests that the scarce engineering resource may shift from writing code to judging whether generated code deserves to ship.
This creates a new bottleneck for software organizations: verification.
Faster code generation does not always mean faster engineering
The productivity evidence around AI coding is real, but highly dependent on context.
A large Microsoft Research study combined randomized field experiments at Microsoft, Accenture and another Fortune 100 company covering 4,867 software developers. Researchers found that developers given an AI coding assistant completed 26.08% more tasks, with less-experienced developers showing higher adoption rates and larger productivity gains.
That is strong evidence that AI can accelerate some development work.
Yet a randomized controlled trial by METR produced almost the opposite result when researchers studied experienced open-source developers working inside repositories they already knew deeply. Across 16 developers and 246 real tasks, allowing early-2025 AI tools caused developers to take 19% longer to complete their work. Before the experiment, developers predicted that AI would make them 24% faster, and even afterward they believed it had saved them about 20% of their time.
The findings are not necessarily contradictory.
Microsoft’s experiments spanned thousands of developers in corporate environments, while METR focused on experienced maintainers solving real problems in mature codebases where understanding project context and quality standards mattered heavily.
Together, they point toward an important engineering principle: the more a task depends on accumulated context, judgment and familiarity with a system, the less useful raw code-generation speed may become as a productivity metric.
Security work is moving from writing to reviewing
The shift becomes particularly visible in secure software development.
Research presented at the 2026 USENIX Symposium on Usable Privacy and Security studied 15 professional software engineers using AI assistance on security-relevant coding tasks. The researchers concluded that coding assistants were shifting security thinking from writing code toward reviewing it.
More strikingly, the study found that none of the observed developers specified security requirements in their initial prompts, even when they possessed the relevant security knowledge.
This suggests that AI can change not only how quickly code appears, but when developers think about security.
Traditional secure-development practices encourage engineers to consider security requirements while designing and implementing software. An AI-first workflow can reverse that sequence: ask the system to produce functional code first, then inspect the output for vulnerabilities later.
That creates what might be called a verification debt. Generation becomes immediate; scrutiny becomes deferred.
Trust remains an unresolved part of the workflow
Developers themselves appear aware of the problem.
A 2025 study published at the IEEE/ACM International Conference on Software Engineering examined how developers determine whether AI-generated code is trustworthy. Researchers found that comprehensibility and perceived correctness were the most common factors developers used to evaluate suggestions.
Yet developers frequently changed their decisions about AI-generated code, ultimately retaining only 52% of the original suggestions observed in the study.
Another randomized workplace study presented at ICSE-SEIP found that sustained use made developers view AI coding tools as more useful and enjoyable, but their perceptions of AI-generated code’s trustworthiness remained unchanged. Researchers emphasized the need to balance productivity gains with increased scrutiny and critical evaluation.
This is an important distinction for product teams building developer tools.
Adoption does not necessarily produce trust. A developer can use an AI assistant every day, appreciate its speed and still refuse to merge its output without substantial human inspection.
AI-generated dependencies create another verification problem
Some risks are difficult to spot through ordinary code review.
A USENIX Security 2025 study tested 16 popular code-generating models across 576,000 generated code samples and examined whether models invented software packages that did not exist.
Researchers found package-hallucination rates of at least 5.2% for commercial models and 21.7% for open-source models, identifying 205,474 unique hallucinated package names.
That behavior creates a software-supply-chain attack opportunity.
An attacker can register a nonexistent package name repeatedly suggested by an AI system and place malicious code behind it. A future developer who receives the same hallucinated recommendation may then install what appears to be a legitimate dependency.
The security problem therefore does not necessarily exist inside the generated source code itself. It can originate in what the AI tells developers to trust outside the codebase.
That expands verification from reviewing syntax and logic to validating dependencies, provenance and the external software ecosystem.
More code can also mean less code ownership
Automation may also weaken developers’ understanding of what they produce.
A 2026 study published in IEEE Transactions on Software Engineering asked 69 participants, including professional developers, researchers and students, to complete programming tasks with and without AI support.
Participants using AI achieved more than twice the median task completeness, but afterward showed a 12.5% lower ability to answer technical questions about the code they had implemented.
That gap matters because software engineering extends far beyond first implementation.
Someone eventually has to debug an outage, explain an architectural decision, modify an unfamiliar component or determine why a dependency behaves differently after an update.
Code that arrives faster but is understood less deeply can shift cost into future maintenance.
Developer tools now need to optimize verification
The obvious response is not to reject AI coding tools. Research already shows meaningful productivity gains in many settings.
Instead, developer-tool companies may need to treat verification as a first-class product problem.
A 2025 field experiment studying LLM-assisted code review found that developers valued AI support particularly for large or unfamiliar pull requests. Researchers concluded that hybrid designs combining proactive AI reviews with developer-controlled interaction offered a better balance between efficiency, trust and reviewer control.
That points toward the next competitive layer in developer software.
The first generation of AI coding products competed on how much code they could generate. The next may compete on whether they can explain changes, reveal provenance, flag uncertain dependencies, surface security assumptions, generate meaningful tests and help reviewers decide where human attention is most valuable.
Engineering organizations may also need different productivity metrics. Measuring generated code, completed tickets or pull-request volume can miss the hidden cost transferred to reviewers and maintainers.
The important metric may become verified engineering work, not generated engineering work.
AI has dramatically reduced the cost of producing code. It has not eliminated the cost of understanding it.
And as generation continues getting cheaper, human judgment may become the most expensive—and most important—part of the software-development pipeline.
