Guide
How AI is changing the way software gets shipped
AI has made writing code dramatically faster. But software isn't finished when the code is written: it still has to be reviewed, tested, secured, released and kept running. Here is how AI is changing each of those stages, what the research says, the new risks, and the tools and habits that help teams ship safely.
Plan and hand off
What AI does now: AI turns ideas and meeting notes into requirements, user stories and tickets, and AI agents can now pick up a ticket and start the work themselves. The handoff from product to engineering increasingly goes to an AI, not only a person.
- 90% of software professionals now use AI at work, typically for about two hours a day (Google's DORA research, 2025). blog.google
The new riskA vague ticket used to produce a question from a developer. Handed to an AI agent, it produces confident code that solves the wrong problem.
What good teams doWrite tickets with clear acceptance criteria, and name a person who owns every change, whoever or whatever writes it.
Tools that help
Write the code
What AI does now: Coding assistants suggest code as developers type, and coding agents take a whole task, change many files and open a pull request (a proposed change) for a person to check.
- At Anthropic, merged code changes rose from about 2,500 a day in May 2026 to over 30,000 a day in September, as AI wrote more of the code. The company had to rebuild its source control to cope. anthropic.com
- 84% of developers use or plan to use AI tools (Stack Overflow Developer Survey 2025). survey.stackoverflow.co
The new riskWriting code is no longer the slow part. Everything after it, from review to deployment, now gets far more to handle.
What good teams doKeep AI-written changes small and focused, so a person can actually review them.
Tools that help
Review and test
What AI does now: AI reviewers comment on pull requests, explain what a change does, suggest fixes and write tests. People still approve what goes live.
- In Google's 2024 DORA research, teams using more AI saw delivery throughput fall by 1.5% and stability by 7.2%, and 39% of respondents had little or no trust in AI-generated code. infoq.com
- 66% of developers say their biggest frustration is AI answers that are "almost right, but not quite", and more developers distrust AI accuracy (46%) than trust it (33%). survey.stackoverflow.co
The new riskReviewers become the bottleneck, or start approving changes they haven't really read. Tests written by the same AI as the code can pass while checking the wrong thing.
What good teams doUse AI review as a first pass, never the only one, and have a person check that the tests prove what matters.
Tools that help
Secure it (DevSecOps)
What AI does now: AI scans code for vulnerabilities, suggests fixes for security alerts, and checks that no passwords or keys have slipped into the code.
- In Veracode's tests of over 100 AI models, AI-written code contained a known type of security flaw in 45% of tasks. veracode.com
- AI models often recommend software packages that don't exist: at least 5.2% of suggestions from commercial models and 21.7% from open-source ones, with over 205,000 different made-up names. Attackers can publish malware under those names. arxiv.org
- 23.8 million passwords and keys were leaked in public GitHub repositories in 2024, up 25% in a year. blog.gitguardian.com
The new riskMore code, written faster, by tools that don't prioritise security, means more vulnerabilities and leaked keys reaching production.
What good teams doRun security and secret scanning automatically on every change, check that every new package is real and trusted, and keep keys in a secrets manager.
Tools that help
Deploy
What AI does now: AI writes deployment pipelines and infrastructure settings, and AI agents can run the commands that release software or change servers.
- In 2025 an AI coding agent at Replit wiped a live database during a code freeze, despite instructions not to change anything. The data was recovered from a backup. techtarget.com
The new riskAn AI agent with access to live systems can do real damage in seconds, and mistakes in infrastructure settings can expose data to the whole internet.
What good teams doGive AI agents the least access they need, keep test and live systems separate, require human approval for anything that touches production, and test your backups.
Tools that help
Run and fix
What AI does now: AI agents watch live systems, investigate alerts, suggest the likely cause of an outage and draft the fix, often in the middle of the night.
- Google's 2025 DORA research found AI doesn't fix a team, it amplifies what's already there: strong teams get better, and struggling teams see their problems grow. cloud.google.com
The new riskTrusting an automated fix without understanding it, or losing the human skills needed when the AI is wrong.
What good teams doLet AI investigate and suggest, keep people deciding on fixes to live systems, and review every incident afterwards.
Tools that help
A checklist for teams shipping with AI
- A person owns every change. Whoever or whatever wrote it, a named person approves anything that goes live.
- Small changes, real reviews. Keep AI-written changes small enough to read properly, and use AI review as a first pass only.
- Scan everything automatically. Security, secret and package checks run on every change, not only before a big release.
- Least access for AI agents. No agent touches live systems or customer data without a human approving it.
- Secrets stay out of code. Keys and passwords live in a secrets manager, never in code or a Git repository.
- Measure delivery, not just speed. Track how often releases fail and how fast you recover, not only how much code gets written.
How we chose the evidence
We relied on independent research and large surveys first: Google’s DORA reports, the Stack Overflow Developer Survey and peer-reviewed studies. Where figures come from companies that sell security or AI tools, such as Veracode, GitGuardian or Datadog, we say so. Tools are examples, not paid placements, and many have free plans. New to the terms? See DevOps, CI/CD and DevSecOps. For the coding tools themselves, see the best AI tools for coding.