Veracode has tested more than 150 large language models against the same security suite. Across models released since 2023, syntax pass rates climbed from about 50% to 95%. Security pass rates moved "from approximately 55% to… approximately 55%" [V5]. That shape — capability rising sharply, everything downstream of it flat — repeats across almost every credible number in the AI coding statistics collected below.
Key takeaways
Every figure here was retrieved from its primary source, named in the sentence that uses it, and dated. Where a number is a company self-report or a forecast rather than a measurement, it says so. Where studies disagree, both appear, settings labeled. Sections run from adoption through trust, productivity, quality, security, economics, and hiring.
An AI coding statistic, on this page, is any published figure about how developers use AI to write software or about what that code turns out to be like — and it is only usable once you know which of four kinds it is. A measured study observes behavior or code directly, like METR's stopwatch on 246 real tasks or Veracode's test suite across 150+ models. A self-reported survey records what developers say about their own work, like DORA's and Stack Overflow's adoption and trust numbers. A company statement is an organization describing itself, like Google's or Microsoft's share-of-code figures, with no published definition behind it. A forecast is a claim about a year that has not happened yet, like Gartner's 2028 projection. Numbers of different kinds are not comparable, and most of the apparent contradictions in AI coding statistics are two kinds being read as one.
This page is the numbers. The arguments live next door: our guide to testing AI-generated code covers method, and our piece on AI-augmented developers covers what changes inside a team. Every line below is written to survive being quoted alone.
For the companion dataset on the supply side of engineering talent, see our 2026 data study on software developers in the Philippines.
Nearly every working developer now uses them. The three largest 2025 surveys — DORA, Stack Overflow, and JetBrains — all put adoption above 80%, and each recorded an increase on the year before. AI coding tools adoption stopped being a trend worth tracking. It's a baseline.
DORA's 2025 State of AI-assisted Software Development report, published September 2025 and based on responses from roughly 5,000 software professionals, put AI adoption at 90%, a 14% increase year over year [V11]. Stack Overflow's 2025 Developer Survey, fielded in July 2025 with 33,662 responses, found 84% of developers using or planning to use AI tools, up from 76% the year before, with 51% of professional developers using them daily [V19]. JetBrains surveyed 24,534 developers across 194 countries between April and June 2025 and found 85% regularly using AI tools for coding, and 62% relying on at least one AI coding assistant, agent, or editor [N1].
Tool-side numbers agree. On Microsoft's July 2025 earnings call, Satya Nadella said Copilot had passed 20 million all-time users, up from 15 million in April 2025. Microsoft also reported the tool is in use at 90% of the Fortune 100 [N2].
Intensity matters more than headcount at this point. DORA 2025 found a median of two hours a day spent working with AI [N3]. Compare that with Gartner's April 2024 forecast, credited to analyst Philip Walsh, that by 2028, 75% of enterprise software engineers would use AI code assistants, up from fewer than 10% in early 2023, with 63% of organizations already deploying or piloting them across 598 respondents surveyed in Q3 2023 [N4]. Measured AI coding tools adoption ran past that forecast with two years to spare.
No. The surveys that record near-universal usage also record that developers don't believe what the tools produce.
DORA 2025 found 24% of respondents reporting a great deal or a lot of trust in AI-generated code, against 30% reporting little or no trust [V11]. Stack Overflow 2025 is blunter: 46% of developers actively distrust the accuracy of AI output, against 33% who trust it, and only 3.1% report trusting it highly [V19]. Favorability toward AI tools in the same survey sat at 60%, and 52% reported a positive productivity effect [V19]. Developers like these tools and don't believe them, at the same time.
The top-cited frustration explains why. In Stack Overflow's 2025 results, 66% named "AI solutions that are almost right, but not quite" as their leading complaint [V19]. Nearly-right output does not save review time; it relocates it.
Usage climbed year over year in every survey above. Trust did not.
Three well-run studies report speedups of −19%, +21%, and +55.8%. They don't contradict each other. They measured different work.
METR, July 2025: 19% slower. METR ran a randomized controlled trial with 16 experienced open-source developers across 246 real tasks on repositories they already maintained, using Cursor Pro with Claude 3.5 and 3.7 Sonnet. Developers forecast that AI access would cut completion time by 24%. After finishing, they estimated it had cut completion time by 20%. Measured, AI access increased completion time by 19% [V1]. The setting is the point: the repositories averaged 22,000+ stars and over a million lines of code, and METR states plainly that "We do not claim that our developers or repositories represent a majority or plurality of software development work" [V2]. METR's February 2026 follow-up found returning developers at a −18% speedup with a confidence interval from −38% to +9%, and newly recruited developers at −4% with an interval from −15% to +9%, describing this as "only very weak evidence" of a speedup [V3].
Google, October 2024: about 21% faster. A randomized controlled trial with 96 full-time Google software engineers found AI shortened time on a complex enterprise task by about 21%, with what the authors describe as a large confidence interval [N8]. Enterprise task, internal tooling, summer 2024.
Peng et al., February 2023: 55.8% faster. The Copilot group "completed the task 55.8% faster" [V17]. The task was writing an HTTP server in JavaScript from scratch. GitHub's own 2022 study of 95 developers found the same 55% figure, 1 hour 11 minutes against 2 hours 41 minutes at P=.0017, with a completion rate of 78% against 70% [V18].
Read them as a range ordered by how much of the work is writing new code. Greenfield exercise: large gain. Bounded enterprise task: moderate gain. Mature codebase with an expert maintainer who has to understand existing context, match conventions, and be right: no gain, possibly a loss. GitHub's November 2024 trial of 202 developers with five or more years of experience adds a quality dimension, finding Copilot-assisted code had a 53.2% greater likelihood of passing all ten unit tests and scored 3.62% better on readability [V16].
At the organizational level the signal turns again. DORA's 2024 report, based on around 3,000 respondents, associated a 25% increase in AI adoption with a 1.5% decrease in delivery throughput and a 7.2% decrease in delivery stability, on the reading that code generation is not the bottleneck [V10].
One distinction governs this whole section. DORA 2025 found over 80% of respondents saying AI enhanced their productivity and 59% reporting a positive influence on code quality [N3]. Those are self-reports. METR's participants also self-reported a 20% speedup while the stopwatch recorded 19% slower [V1]. When a study measures and a survey asks, cite them differently.
Model capability and model security have moved on separate tracks. There's now longitudinal evidence for it.
Veracode's Spring 2026 GenAI Code Security report, published 24 March 2026 and covering more than 150 LLMs, found that "while syntax pass rates have climbed steadily from about 50% to 95% since 2023, security pass rates have remained essentially flat, hovering between 45% and 55%" [V5]. Their summary line: "Two years of 'revolutionary' model releases have moved the security needle from approximately 55% to… approximately 55%" [V5].
The by-class breakdown shows what the average hides. In the same Spring 2026 data, SQL injection passed at 82% and insecure cryptography at 86%, while cross-site scripting passed at 15% and log injection at 13%. Java scored lowest by language at 29%, and OpenAI's reasoning-focused models scored highest at 70–72% [N9]. Veracode's July 2025 edition found 45% of AI-generated samples failed security tests and introduced OWASP Top 10 vulnerabilities, with Java at a 72% failure rate and XSS undefended in 86% of relevant samples, noting that security performance remained flat regardless of model size [V4].
Maintainability signals point the same way. GitClear's January 2026 analysis of 623 million code changes found its duplication index up 81%, from 40.3 to 73.0 against 2023; copy-pasted lines rising from 9.4% in 2022 to 15.7% in the first half of 2026; and refactored lines falling from 13% to 3.8% of changed lines. Their conclusion: "The structural habits that keep codebases maintainable have eroded across every signal we measure" [V9]. The 2025 edition, covering 211 million changed lines, had already logged copy/paste rising from 8.3% to 12.3% and refactoring falling from 25% of changed lines in 2021 to under 10% in 2024 [V8]. Two windows on the same data, one direction.
The same erosion has a design-side counterpart, and it hides in the same place: design debt and what a UX audit surfaces is the interface-layer version of a duplication index nobody is watching.
Review-time defect data is consistent with that. CodeRabbit's December 2025 report examined 470 open-source GitHub pull requests, 320 AI-co-authored and 150 human-only, and found 10.83 issues per PR in the AI group against 6.45 in the human group, with logic issues 75% more common and readability issues more than three times as frequent [V14]. Security vulnerabilities ran up to 2.74 times higher and error-handling gaps close to twice as common [N10]. Quote this one with its caveat attached: AI authorship was inferred through signal detection rather than disclosed, which makes it an observational comparison, not a controlled trial.
More issues per pull request is a review-capacity problem before it is a tooling problem, which is the practical argument for deciding when to hire a QA engineer rather than quietly absorbing the load into developer time.
The oldest finding here is still the most uncomfortable. The Stanford study presented at CCS '23 found that participants with access to an AI assistant built on OpenAI's codex-davinci-002 "wrote significantly less secure code" and "were more likely to believe they wrote secure code" [V15]. Lower quality and higher confidence, in the same population.
This is the one category where AI-generated code opens a new attack surface rather than a familiar one at higher volume.
The USENIX Security '25 package-hallucination study generated 576,000 code samples across 16 LLMs and recorded 205,474 unique hallucinated package names, with hallucination rates of at least 5.2% for commercial models and 21.7% for open-source models [V6]. Socket's April 2025 analysis reported that 19.7% of all recommended packages were non-existent, and — the detail that turns a nuisance into an exploit — that 43% of hallucinated packages were repeated every time across ten reruns of the same prompt [V7]. A hallucination that recurs deterministically is a registry name an attacker can register and wait on. Seth Larson, Developer-in-Residence at the Python Software Foundation, named the technique slopsquatting [V7].
Every widely quoted figure in this category is a company describing itself. None is an independent measurement, and none of the companies has published the definition it used.
On Google's Q3 2024 earnings call, Sundar Pichai said "Today, more than a quarter of all new code at Google is generated by AI, then reviewed and accepted by engineers" [V13]. By April 2025 that had become "well over 30%" [N5]. Satya Nadella said in April 2025 that engineers were using AI to write 20% to 30% of code in Microsoft's repositories [N6]. Mark Zuckerberg said Meta intended AI to handle half of its software development "within the next year" — a stated intention about the future, not a measurement of the present [N7].
Treat all four as executive commentary. Whether a figure counts accepted tab-completions, whole functions, or only lines that survived review changes it by an order of magnitude, and no company has said which it means. The distinction matters most where nothing is being reviewed at all, which is the pattern behind a vibe coding MVP that looks finished before it is.
Public pricing gives the cost side a floor. GitHub Copilot lists Free at $0 with 2,000 completions per month, Pro at $10 per user per month, Pro+ at $39, and Max at $100 [N11].
For scale, the most specific thing on the record came from Nadella in 2024: GitHub Copilot alone was a larger business than all of GitHub had been when Microsoft acquired it in 2018 [N12].
Cursor gives the clearest growth curve. Anysphere, its maker, surpassed $500 million in ARR at a $9.9 billion valuation in June 2025, was valued at $29.3 billion in November 2025, and reached $2 billion in annualized revenue in February 2026 [N13].
Tool licenses are the small line on an engineering budget. The large one is people, which we broke down separately in the true cost to hire a developer in 2026.
Not in the postings data, which runs against the story most readers have already absorbed. US software development listings have grown while overall postings fell — though postings measure demand, not hires.
Indeed's Hiring Lab reported on 8 July 2026 that US software development job postings "have grown by almost 15% since the launch of Claude Code in late February, 2025, while overall job postings fell by 7% over the same period" [N14]. Software development postings are not tracking the wider postings market. They are moving the other way.
The composition of that growth is the more useful finding. Of the increase between May 2025 and May 2026, 71% came from senior roles, and 37% came from jobs that mention AI in their title [N14]. Demand is concentrating at the level where the job is judgment: reviewing, integrating, deciding what not to ship. Not volume of code produced.
One caution before anyone quotes this as proof that AI creates jobs: postings are a demand signal, not hires, and a growth figure indexed to a product launch date describes a period rather than a cause. What the data does support is a change in the shape of demand, and that change lines up with what the quality research predicts.
If demand is concentrating at the judgment end, the buying question stops being how many developers to add and starts being which arrangement covers review, design, and QA — the trade-off we set out in our buyer's guide to software development staffing models.
Adoption is effectively universal and still climbing: 90% in DORA 2025, 84% in Stack Overflow, 85% in JetBrains [V11, V19, N1]. Trust has not followed, and in both major surveys more developers distrust AI output than trust it [V11, V19]. Quality signals are moving the wrong way on two independent longitudinal datasets [V5, V9]. Productivity depends so heavily on setting that the same body of research contains a measured 19% slowdown and a measured 21% speedup [V1, N8]. Hiring is shifting toward senior roles [N14].
Read together, they say one thing to an engineering leader: the constraint has moved. Writing code is cheap now. Reviewing it, integrating it, and being accountable for it is where the work went, and nothing above suggests that part got easier.
DORA's framing is the right one. "AI is an amplifier. It magnifies the strengths of high-performing organizations and the dysfunctions of struggling ones" [V12]. Their AI Capabilities Model names small batches as the direct counterweight: "AI can easily generate massive blocks of code, which are hard to review and test. Enforcing the discipline of small batches counteracts this risk" [V12]. That is a capability an organization either has before it scales AI use, or discovers it needed afterward.
You-Source staffs teams the way these numbers argue for: AI-augmented engineers who treat review discipline as the non-negotiable part of the workflow. That is what Dev on Demand, our monthly cancel-anytime engineering subscription, is built to deliver.
The three largest 2025 developer surveys all put adoption above 80%. DORA's 2025 report recorded 90% adoption among roughly 5,000 software professionals [V11], Stack Overflow's 2025 Developer Survey found 84% of its 33,662 respondents using or planning to use AI tools [V19], and JetBrains found 85% of 24,534 developers across 194 countries regularly using AI tools for coding [N1]. Each figure was an increase on the year before, and all three are self-reported survey numbers rather than measured usage.
Veracode's Spring 2026 GenAI Code Security report, covering more than 150 LLMs, found security pass rates essentially flat between 45% and 55% since 2023, while syntax pass rates over the same period climbed from about 50% to 95% [V5]. Its July 2025 edition found 45% of AI-generated samples failed security tests and introduced OWASP Top 10 vulnerabilities, with Java failing at 72% and security performance flat regardless of model size [V4]. The Stanford study presented at CCS '23 found that participants with access to an AI assistant "wrote significantly less secure code" and "were more likely to believe they wrote secure code" [V15].
The longitudinal maintainability data points that way. GitClear's January 2026 analysis of 623 million code changes found its duplication index up 81% against 2023, copy-pasted lines rising from 9.4% in 2022 to 15.7% in the first half of 2026, and refactored lines falling from 13% to 3.8% of changed lines [V9]. CodeRabbit's December 2025 report found 10.83 issues per pull request in AI-co-authored code against 6.45 in human-only code across 470 open-source pull requests [V14]. That last figure carries a caveat: AI authorship was inferred through signal detection rather than disclosed, which makes it an observational comparison, not a controlled trial.
Slopsquatting is the practice of registering a package name that LLMs repeatedly hallucinate, so that a developer who installs the suggested dependency pulls in attacker-controlled code. Seth Larson, Developer-in-Residence at the Python Software Foundation, named the technique [V7]. The USENIX Security '25 package-hallucination study recorded 205,474 unique hallucinated package names across 576,000 generated code samples from 16 LLMs [V6], and Socket's April 2025 analysis found that 43% of hallucinated packages recurred every time across ten reruns of the same prompt [V7]. A hallucination that recurs deterministically is a registry name an attacker can register in advance.
Sundar Pichai said on Google's Q3 2024 earnings call that "more than a quarter of all new code at Google is generated by AI, then reviewed and accepted by engineers" [V13], and by April 2025 that had become "well over 30%" [N5]. Both are company statements, not independent measurements. Google has not published whether the figure counts accepted tab-completions, whole functions, or only lines that survived review, and that choice changes the number by an order of magnitude.
