The State of AI-Native Software Delivery 2026

How much code AI writes now

Figure 01 — one solved stage, five open onesReport map

Code generation is the capability the industry solved. The five lanes downstream of it are the subject of the sections that follow. Illustrative, not to scale.

The clearest public record comes from Google's own disclosures: a quarter of new code in October 2024, well over 30% by April 2025, about half by late 2025, and 75% by April 2026, in each case AI-generated and reviewed or approved by engineers.¹ Microsoft put its share at 20 to 30% in April 2025.²

The broad market is behind the frontier but moving in the same direction. 90% of developers use AI at work per DORA; 84% use or plan to use AI tools per Stack Overflow's 49,000-respondent survey; 90% of engineering teams use AI coding tools per Jellyfish, up from 61% a year earlier.³ At the intensity end, 34% of organizations already report that more than 60% of their code is AI-generated.⁴ Telemetry is more conservative than the self-reports: across DX's 425 instrumented organizations, 22% of merged code was AI-authored in late 2025, rising past 27% in early 2026, and the gap between measured and self-reported numbers recurs throughout this report.⁵

The adoption shows up in aggregate volume: GitHub recorded nearly one billion commits in 2025, up 25% year over year, with more than 1.1 million public repositories now importing an LLM SDK.⁶ Code generation is a solved and widely deployed capability. The next six sections examine what happens to that code after it is written.

What happened to delivery speed

DORA's two-year arc is the industry's most careful measurement, and it splits the question in half. In 2024, every 25% increase in AI adoption was accompanied by an estimated 1.5% decrease in delivery throughput and a 7.2% decrease in delivery stability. In 2025, throughput turned positive while the instability finding persisted.⁷

DORA's own words for the throughput shift are "a key shift from last year", and the stability finding is now in its second consecutive year. The 2025 framing is that AI acts as an amplifier of the system it lands in.

Self-report and measurement disagree

Self-reported results are strong: 64% of engineering teams report achieving at least a 25% velocity increase from AI.⁸ Measured results are narrower. Bain puts the typical realized gain at 10 to 15%, with the saved time often not redirected; BCG's verdict on engineering organizations is "widespread adoption, shallow impact", with half of CIOs unable to quantify GenAI's effect; and in METR's randomized trial, experienced open-source developers took 19% longer with AI tools while believing they had been 20% faster.⁹ Telemetry lands between the extremes: DX measures an average 3.9 hours saved per developer per week in its 2026 analysis, real but bounded by the fact that coding occupies only about 14% of a developer's day, per Microsoft's time-allocation research.⁵

Quality and stability

GitClear's analysis of 211 million changed lines documents how the code itself changed during 2024: an eightfold increase in blocks of duplicated code, the share of new code churned within a month of authorship climbing from 5.5% in 2020 to 7.9% in 2024, and 2024 as the first year on record in which copy-pasted lines exceeded moved, that is refactored, lines. Its 2026 follow-up, spanning 623 million changes, found refactoring down 70% against 2022 levels while duplicated blocks rose 81%.¹⁰ Across both datasets, volume rose while maintainability metrics declined.

The security data follows the same pattern. Veracode found 45% of AI-generated code introduced security vulnerabilities, with an 86% failure rate on cross-site scripting, and its Spring 2026 update, spanning 150+ models, concluded that two years of model releases left the security pass rate essentially unchanged at roughly 55%.¹¹ CodeRabbit's analysis of 470 real pull requests found AI-co-authored PRs carrying 1.7x more issues; Sonar found one leading model improving its benchmark pass rate 6.3% while its high-severity bug rate rose 93%.¹²

These defects are reaching production: 72% of organizations report at least one production incident caused by AI-generated code, and 45% of deployments involving AI-generated code lead to problems.¹³ This is the mechanism behind DORA's persistent instability finding, and it compounds the queue problem: every incident pulls senior attention back out of the review pipeline that was already the constraint.

The review bottleneck

The single clearest dataset of the year is LinearB's telemetry across 8.1 million pull requests from 4,800 organizations. It shows exactly where the generated volume piled up.

Developer surveys are consistent with the telemetry. The top frustration in Stack Overflow's survey, cited by 66%, is AI solutions that are "almost right, but not quite"; 45% say debugging AI-generated code is more time-consuming.¹⁵ The checks at the end of the pipeline also miss a substantial share of defects: 43% of AI-generated code that passes QA and staging still requires manual debugging in production, with an average of three redeploy cycles to verify a single AI-suggested fix.¹⁶

The infrastructure gap

Below the review queue sits the layer the industry automated least, and the 2026 data made the mismatch explicit. In a 2026 survey of 406 IT and platform leaders, 67% say development is moving ahead of infrastructure in AI adoption, and 93% of organizations have experienced at least one AI-caused infrastructure incident. A third of infrastructure teams say they would apply AI-generated HCL directly to production without any review; only 19% have built governance foundations for AI.¹⁷

The infrastructure estate was strained before AI arrived: 35% of teams tie configuration drift to multiple costly production incidents in the past year, 90% agree their IaC orchestration falls short, and only 34% would trust AI agents to make autonomous production changes.¹⁸

The capability gap in benchmarks

Frontier models resolve up to 97% of real application-code issues, while the best published result on realistic IT-operations scenarios is 56.2%, and most models remain below 50%. Within a single model the split is starker: GPT-4 passes 86.6% of standard Python tasks and 19.4% of Terraform generation tasks.¹⁹ Agents write applications well and operate infrastructure poorly, which means the infrastructure layer either stays human-gated, and remains the bottleneck, or gets restructured so agents never need to touch it.

Trust and governance

Usage and trust are moving in opposite directions. 84% of developers use or plan to use AI tools, up from 76%. Trust in AI accuracy fell from 43% to 33% in the same year, more developers now actively distrust it (46%) than trust it, and only 3% report high trust. DORA measures the same unease: 30% of developers report little or no trust in AI-generated code, while 90% use it.²⁰

Governance trails adoption roughly three to one. 34% of organizations report more than 60% of code is AI-generated; 18% have policies governing AI coding assistants. ISACA puts formal, comprehensive AI policy at 28% of organizations worldwide; the Cloud Security Alliance puts comprehensive AI security governance at 26%.²¹ The exposure is measurable: commits assisted by a leading AI coding agent showed a 3.2% secret-leak rate against a 1.5% baseline across all public commits, AI-service credentials leaked grew 81% year over year, and 2025 set the all-time record for exposed secrets on public GitHub.²²

Regulatory deadlines add to the pressure: the EU AI Act became fully applicable on August 2, 2026, and the Commission's draft Article 50 guidelines drew the first regulatory line through AI-generated code specifically, exempting source code from content-marking while documentation from the same tools stays in scope.²³

What separates the leaders

Every source that segments its respondents finds the same shape: a small group converting AI into organizational results, and a majority stuck at individual gains. McKinsey's top quintile achieves 16 to 30% improvements in productivity, time to market, and customer experience, with 31 to 45% gains in software quality; only about 5% of surveyed companies meet its "AI high performer" bar. Bain's process-transformers reach 25 to 30% against the typical 10 to 15%.²⁴

The common factor among the leaders is platform quality rather than model choice. DORA 2025 states it directly: "A high-quality platform amplifies the effects of AI adoption on organizational performance." Platform adoption is now near-universal, at 90% of organizations, with 76% running dedicated platform teams; quality is what varies.²⁵ Harness quantifies the same lever at the delivery end: moving from low to moderate continuous-delivery automation more than doubles the likelihood of realizing velocity gains from AI, from 26% to 57%.¹³

Gartner's prediction that 80% of large engineering organizations would run platform teams by 2026 arrived on schedule.²⁶ The question for 2026 is whether the platform converts AI speed into delivery or queues it.

Outlook: 2027

Three developments will shape next year's edition of this report.

Agents move from assistants to actors

Agent adoption is early and wary: 52% of developers either don't use agents or stick to simpler AI tools, and 81% have security or privacy concerns about them.¹⁵ Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027, on escalating costs, unclear business value, or inadequate risk controls.²⁷ The projects that survive will be the ones whose delivery systems were built for machine-speed change, with bounded autonomy and guardrails enforced by the platform rather than by review.

Governance rules start to arrive

Formal requirements are arriving from several directions: NIST's control overlays for AI systems, including agent deployment, are in draft; the EU AI Act's transparency regime is live; and customer security questionnaires are already asking AI-governance questions that most organizations cannot yet answer.²⁸ The 18% of organizations with a policy governing AI coding assistants is likely to be the fastest-moving statistic in next year's data.

The infrastructure bottleneck

Every dataset in this report points the same direction: the constraint on AI-era software delivery is shipping code rather than writing it, and the infrastructure layer is where the queue is longest and the automation weakest. Organizations that restructure that layer, so infrastructure derives from the code agents already write well, convert the volume into delivery. Organizations that respond by adding review capacity will keep the constraint and see queue times grow through 2027.

About Encore

Encore is a development platform for the AI era, built for a world where AI multiplies software delivery 10–100x rather than making each developer slightly faster. Developers and AI agents declare the infrastructure they need — databases, queues, buckets, cron jobs — directly in ordinary TypeScript or Go, and Encore provisions it in your own AWS or GCP account.

The same application model runs locally, in preview environments, and in production, so changes are validated against real infrastructure before they reach the production loop. There is no separate Terraform layer for anyone, human or agent, to write and keep in sync.

01import { api, SQLDatabase, Topic, Bucket } from "encore.dev";
02 
03// declare what you need, Encore provisions it
04const db = new SQLDatabase("orders");
05const events = new Topic<OrderEvent>("orders");
06const receipts = new Bucket("receipts");
07 
08export const create = api({ method: "POST" }, async (o) => { ... });

$ git push encore
✔ Building application graph
✔ Provisioning Postgres (RDS) · Pub/Sub (SNS+SQS) · Object Storage (S3)
✔ Deploying 6 services to your AWS account (ECS Fargate)
✔ Wiring distributed tracing + metrics
 
→ Live at https://staging-orders-r2qa.encr.app· 42s
→ Dashboard at https://app.encore.dev/orders

Why this matters for this guide

• Finding 3 (review bottleneck): platform guardrails absorb infrastructure review, so human attention goes to business logic.
• Finding 4 (staging leaks): local, preview and production environments are structurally identical, removing the works-in-staging class of failure.
• Finding 5 (infrastructure gap): agents never touch IaC, because there is none. Infrastructure derives from the application code they already write well.
• Finding 6 (governance): credentials and infrastructure state live in the platform, outside the repository and outside AI reach, with an automatic audit trail.
• Finding 7 (the platform multiplier): the delivery automation that doubles realized AI gains is the default, not a program.