What the Data Says in August 2026

Industry data, published 2025-2026

The industry research has caught up with the argument. It is worth being precise about what it actually says.

Adoption is near-universal. Trust is not.

Stack Overflow's 2025 Developer Survey had over 84% of respondents using or planning to use AI tools while trust in those same tools fell to 29%, an 11-point drop year over year, and the most experienced developers were the most skeptical of all. The 2026 survey, published in October, stopped asking that trust question and asked when developers trust AI instead: 83% now use at least one AI tool, 48% trust its output only when they can easily verify it, and 6.6% would trust it with an important decision. That is not a contradiction waiting to be resolved. It is the correct response to a tool that is confidently wrong at a low but non-zero rate, held by the people who carry the accountability when it is.

AI is an amplifier, not a fix

DORA's 2025 State of AI-assisted Software Development, drawn from roughly 5,000 practitioners, landed on the finding that matters most: AI magnifies what your organization already is. It makes strong delivery systems faster and weak ones worse. Adoption now correlates with higher throughput and higher instability, and DORA is blunt that AI adoption "not only fails to fix instability, it is currently associated with increasing instability." The report also found that time saved in code creation gets reallocated to auditing and verification.

That last sentence is the bottleneck shift, measured by someone other than me. If the savings move to verification, then verification is where the system needs to be rebuilt, and that is an organizational decision rather than a tooling purchase.

DORA's 2026 follow-up, The ROI of AI-assisted Software Development, gave the reallocation a name: the verification tax, the review and validation cost that cheap authoring shifts onto humans. It also introduced a J-curve, productivity dipping before it rises, which is the honest shape of any operating model change and the reason a 60-day velocity promise is a mistake. Promise a baseline in three weeks and a first measured delta at 90 days. The budget conversation that shape forces is Your AI Numbers Are Going to Look Worse Before They Look Better.

The productivity paradox, measured twice

Faros AI's 2025 report, telemetry from more than 10,000 developers across 1,255 teams, is the single most important dataset in this field and the one most often misquoted. Tasks completed per developer rose 21%. PRs merged per developer rose 98%. PR review time rose 91%, average PR size rose 154%, and bugs per developer rose 9%. Company-level throughput, DORA metrics, and quality KPIs showed no significant correlation with AI adoption at all.

The 2026 edition, now 22,000 developers and 4,000 teams, is worse in the direction that matters. Tasks per developer up 33.7% and PR merge rate up 16.2%, against bugs per developer up 54%, incidents per PR up 242.7%, median review time at 5x, code churn up 861%, and deployments per week down 11.7%. PRs merged with no human review at all rose 31.3%, and a quarter of PRs are now reviewed by an AI agent. Individual output went up. Organizational delivery went down. That is the whole bottleneck shift in two years of telemetry.

The short loop is close to solved. The long arc is not.

METR's time-horizon research tracks the task length at which an agent succeeds half the time, and that number has been roughly doubling every seven months. Agents are close to reliable on work that takes a human minutes. They degrade sharply on work measured in hours, where mistakes compound across many steps and no one is checking the direction. The model is strong inside the task and weak about which task, in what order, against what architecture.

This is why I keep putting the human decision at the boundary rather than inside the loop. The boundary is exactly where the models are weakest, and it is the part that does not improve on a seven-month doubling schedule.

Perceived speed and measured speed diverge

METR's randomized controlled trial put 16 experienced open-source maintainers on 246 real tasks in their own repositories. With AI tools they were 19% slower. They had forecast being 24% faster, and after the study they still believed they had been 20% faster. The February 2026 update with late-2025 tools found the original cohort still around 18% slower and a new cohort at 4% slower, with confidence intervals wide enough that METR called it very weak evidence and is redesigning the study, partly because developers now refuse to work without AI. Two things survive the caveats: self-reported speed is not a measurement, and the effect on experienced engineers in mature codebases is not settled. Both are reasons to instrument rather than survey.

The maintainability bill arrives later

GitClear's 2026 study of 623 million code changes, indexed to 2023, has code-block duplication up 81%, error-masking constructs such as empty catches up 47%, cross-file function calls down 35%, and refactoring's share of all changes down from 21% in 2022 to 3.8%. GitClear's own framing is the right one: the headline is not that AI writes bad code. It is deferred structural maintenance, one individually harmless commit at a time.

CodeRabbit's December 2025 review of 470 open-source PRs found AI co-authored PRs carried 1.7x the issues of human-only ones, 1.75x the logic errors, and 1.57x the security findings. Human PRs had more spelling mistakes. That is roughly the trade: the machine stops making the errors a linter catches and starts making the ones a reviewer has to think about.

Security is not improving with model size

Veracode's 2026 report has 44% of generated samples failing OWASP Top 10 checks, barely moved from 45% a year earlier. The best model passes 68%, most sit between 50 and 53, and model size has no measurable effect. Cross-site scripting defenses pass 15% of the time and log injection 12%. One more from the same shelf: a USENIX Security 2025 study of 576,000 generated samples found 19.7% of recommended packages did not exist, and 43% of the hallucinated names came back on every re-query, which makes them registrable. Slopsquatting is not a theoretical risk. It is a lockfile-mode and registry-allow-list problem, and it belongs in the pipeline, not in a training deck.

Oversight erodes where AI review is added

Quality improves where AI review is introduced, and human review quietly disappears at the same time. Qodo's 2025 report had 81% of teams using AI code review seeing quality improvements, and Qodo's own product data in the same report shows that once an AI review tool is enabled, 80% of PRs receive no human comment at all. The 2026 edition, titled Verification Is the New Bottleneck, surveyed 500 developers and 300 engineering leaders separately: both groups rank reviewing and validating AI-generated code as the top constraint on delivery, and only 3.7% of the leaders say their existing processes are sufficient as agents take on more work. GitHub reached 60 million Copilot code reviews by March 2026, more than one in five reviews on the platform, and is now previewing AI review approvals that count toward required reviews. Both things are true and you have to manage the second. An AI approval satisfying a human approval requirement is the exact control failure that turns a review tier into a rubber stamp, and I would leave that setting off on anything touching auth, money, or PII until the no-comment-merge metric is instrumented. The audit-side version of that argument is Who Signs for Agent-Written Code?

Usage is universal. Redesign is rare.

McKinsey's State of AI surveys have 88% of organizations using AI in at least one business function and about 6% qualifying as high performers, meaning 5% or more of EBIT attributable to AI. The August 2026 edition holds the pattern: 80% report individual productivity gains, 37% report any enterprise-level EBIT impact, and roughly three quarters of the high performers have fundamentally redesigned workflows, against a quarter of everyone else. Redesign is where the return is. Everyone else bought the tooling and kept the process.

The money is under scrutiny

Big Tech AI capital expenditure is running past $600 billion a year. Meanwhile Forrester has enterprises deferring about a quarter of planned AI spend into 2027, and fewer than a third of decision-makers able to tie the value of AI to their organization's financial growth. Bain's 2026 Technology Report puts the gap in numbers: funding the compute build-out needs about $6 trillion a year in AI revenue by 2031, and the consumer and enterprise AI it can see comes to $1.2 to $1.8 trillion. The line I would put on a wall: the technology worked, the value has not arrived yet.

None of this is an argument against AI. It is an argument that the remaining constraint is organizational, not technical.

The teams getting real value are the ones that rebuilt review, verification, and ownership around the new code volume. The teams that bought seats and waited are the ones filling out the ROI surveys. That gap is not going to be closed by a better model, and every data point above says the same thing from a different direction. What the rebuild contains, rule by rule, is in An Operating Model, Not a Tooling Purchase.