The AI tool war is over—but whether winners actually benefit is another story—Software engineering in the AI era · Learn AI Slowly 175
The AI Tool Wars Are Over, But Will the Winners Be Adopted?
Learn AI Slowly #175
Let’s cut to the chase. By mid-2026, it’s clear that the top spot in the AI tool market isn’t being contested by four tools, but rather, it’s been taken over by Claude Code and Codex. To be precise, they’ve dominated the high-autonomy segment, which truly compresses the end-to-end delivery cycle.
GitHub Copilot still leads with a 29% adoption rate in the workplace, but that’s largely due to enterprise purchasing inertia. The growth curve has plateaued; Cursor, the previous generation’s experience king, is slowing down; and Google Antigravity, which entered the market with Gemini and a focus on cloud and enterprise compliance, has only reached 6% in two months and is still getting started.
In China, the only two tools that can simultaneously handle “autonomous agency + compliance + enterprise deployment” are Trae from ByteDance and Qoder (formerly known as 通义灵码, rebranded in May 2026) from Alibaba. However, to be honest, when it comes to autonomous agency, they still lag behind Claude Code and Codex by a generation.
Learn AI Slowly: Choosing the Right Tool for Your Organization
This article won’t answer the question “which tool is the strongest” - that’s a 2025 problem, and by 2026, it’s already outdated. When it comes to selecting a tool this year, there are three more important things to consider, and each one is easier to overlook than the last:
How much autonomy can your organization handle?
The higher the autonomy, the more code the tool produces, and the deeper it goes, the higher the requirements for your review capabilities. Without a solid foundation, implementing autonomous agents is like installing a large engine in a car without brakes.Can your code leave the country?
This is a hard constraint in industries like finance, telecommunications, government, and military. It directly determines whether you can use cloud-based tools like Claude Code and Codex that send code abroad.Do you think buying a tool will speed up delivery?
Probably not. AI compresses coding, but in strongly regulated industries, coding is often the cheapest part of the end-to-end delivery process.
Thinking through these three things is ten times more important than debating “Cursor vs. Claude Code”. Let’s break it down.
I. The Throne is Shared by Two, Not Four
First, let’s look at JetBrains’ research from January 2026 - the latest and largest tool market share survey in the industry, with over 10,000 professional developers and eight languages. The data looks like this:
Learn AI Slowly: AI-Powered Coding Tools Adoption Rates
| Tool | Recognition | Adoption Rate | Trend |
|---|---|---|---|
| GitHub Copilot | 76% | 29% | Plateau (procurement inertia; 56% in enterprises with 10,000+ employees) |
| Cursor | 69% | 18% | Slowing growth |
| Claude Code | 57% | 18% | 6x growth in 9 months (from 3%); 24% in North America; CSAT 91, NPS 54 (highest in the category) |
| OpenAI Codex | 27% | 3% | Accelerating (desktop version not released at the time of the survey, later reached 500,000+ weekly active users) |
| Google Antigravity | — | 6% | New entrant (launched in November 2025, reached 6% in two months) |
| JetBrains Junie CLI | — | 5% | LLM-agnostic, comes with its own model |
Data source: JetBrains AI Pulse Survey, January 2026, 10,000+ developers.
Note: The data is based on a survey of 10,000+ developers and reflects the adoption rates of AI-powered coding tools in the industry. The recognition and adoption rates are based on the respondents’ familiarity and usage of the tools, respectively. The trend indicates the change in adoption rate over time.
Learn AI Slowly
Looking at adoption rates alone, you might think Copilot is still the king. However, adoption rates are a lagging indicator - they measure “how many seats have been purchased” rather than “where the momentum is heading in the next 12 months”. When we overlay the growth curves, the picture changes dramatically: Claude Code grew from 3% to 18% in just 9 months, making it the fastest-growing tool in this survey. Codex, which was only at 3% during the survey, saw its weekly active users surge from 3 million to over 5 million in just four months after the survey (according to Sam Altman/OpenAI’s public statements). The npm monthly downloads of Codex CLI grew from 82,000 in April 2025 (launch month) to 41.8 million in May 2026 - a 510x increase (detailed data from gradually.ai). Claude Code’s annualized revenue grew from $0 to $2.5 billion in just 9 months (Anthropic’s February 2026 G-round disclosure). These two growth curves are almost unprecedented in the history of developer tools.
Learn AI Slowly: Unpacking the Trajectory of AI-powered Coding Tools
The growth curves of Copilot and Cursor are a different story altogether. Copilot’s 29% market share is largely propped up by large enterprises that have already completed their compliance checks and signed multi-year contracts. As a result, new seat additions are locked down by procurement processes, and developers who want to switch to Claude Code need to secure additional budget approvals. Despite this, Copilot remains the leader, but its growth is plateauing.
Cursor, on the other hand, is tied with Claude Code at 18%, but its growth trajectory is distinct. While Cursor is slowing down from a high base, Claude Code is taking off from a low base. The two curves are polar opposites. Cursor’s annualized revenue has already reached $2 billion by early 2026, with a team of just over 50 people, achieving a staggering $400 million in ARR per person. This makes it the fastest application-layer SaaS to reach $1 billion in ARR. Despite this, Cursor remains the most seamless experience for internet and startup teams, but its growth ceiling is now visible.
Note: ARR refers to Annual Recurring Revenue, a key metric for SaaS companies.
Don’t Underestimate Antigravity
Antigravity is the only one not in the top spot, but you shouldn’t ignore it. It’s Google’s “agent-first” programming tool, launched in November 2025, specifically designed for Gemini 3. At Google I/O 2026, it was upgraded to 2.0, becoming a complete agentic development platform with desktop, CLI, and SDK. It has three unique advantages that others don’t: Gemini models, Google Cloud’s enterprise compliance foundation, and Google Search’s real-time search. Its rapid growth to 6% penetration in two months is impressive, but 6% is still just 6% - it’s still in its early stages and hasn’t reached the top yet. You don’t need to wait for it in 2026, but remember that Google is using its enterprise muscle to push into this space. This might change the game, making it a “two-strong plus one well-funded challenger” scenario.
Putting these five back into the coordinate system, they’re not even on the same track:
Learn AI Slowly: Choosing the Right AI Tool for Your Organization
The diagram below illustrates a crucial point: these tools are distributed along a diagonal line, with the top-right corner representing the most powerful capabilities, but also the highest requirements for governance and review. Therefore, when selecting a tool, don’t just look at the model’s performance metrics; first, assess your organization’s governance capabilities.
Claude Code and Codex occupy the top-right corner, offering the most advanced capabilities, but they also demand the most stringent governance and review processes. Copilot, on the other hand, is located at the bottom-left, with the lowest barrier to entry and minimal risk, but it’s also less likely to provide significant efficiency gains.
License Purchased, but Delivery Still Slow: The Bottleneck is in Verification, Not Coding
The following section addresses a crucial aspect often overlooked in tool selection articles, yet it’s where heavily regulated industries spend the most money.
I’ve conducted AI training for telecom operators and closely followed their digitalization teams. One regional carrier’s experience stands out. Last year, they deployed Copilot for their development team, but after six months, the end-to-end delivery cycle remained largely unchanged. Although developers worked faster, with coding time reduced by over 30%, a single suite change or billing rule adjustment still took over a month to implement. The person in charge wasn’t oblivious to the issue; they suspected the bottleneck wasn’t in coding. However, the budget was still allocated based on license numbers, as the metrics used to report to upper management focused on “number of developers covered” and “seats purchased.” This is a common phenomenon in large enterprises: “knowing but unable to act,” where the obstacle lies not in understanding, but in measurement.
Learn AI Slowly
The real time-consuming part of the process is verifying the entire pipeline, which has little to do with the code itself. For a feature that involves modifying the billing module, the actual coding might take only two days. However, the subsequent steps can take weeks:
- Change Advisory Board (CAB) approval
- Algorithm registration (if a model is involved)
- MLPS assessment (China’s classified cybersecurity protection, equivalent to EU’s GDPR or Japan’s APPI)
- Cross-border data transfer assessment (equivalent to US’s SOC 2 or HIPAA)
- Pre-launch reconciliation and audit verification
Each of these steps can take several days to several weeks, adding up to a month. While AI has compressed the coding process by 30%, this part of the process remains a significant bottleneck.
It’s essential to acknowledge a common bias in the internet industry. Many articles about AI programming assume that “verification” refers to automated testing, unit tests, and linting. However, in the telecommunications and finance industries, “verification” encompasses algorithm registration, security assessments, data export assessments, CAB approvals, and reconciliation audits, which are unrelated to code and can take weeks.
Dismissing these critical steps as mere “testing checkpoints” can be misleading for readers in the finance and telecommunications sectors, as these are the most time-consuming and costly parts of their workflow.
Learn AI Slowly: The Unintuitive Truth About AI Tools in Heavily Regulated Industries
A crucial conclusion for decision-makers: In heavily regulated industries, AI tools can only compress the cheapest part of the entire delivery chain. If you want to speed up the end-to-end process, you need to either redesign the verification process (including CAB, filing procedures, and evaluation scheduling) or change the metrics you report to upper management. Simply buying tools won’t cut it.
Speaking of which, let’s flip the conventional wisdom that “the more tools you use, the better” on its head. One of the most counterintuitive facts of H1 2026 is: The more tools you use, the less developers trust them. A JetBrains survey in January 2026 found that 90% of developers use at least one AI tool, with adoption rates reaching a saturation point of around 90%. However, multiple surveys from the same period show that developers’ trust in AI-generated “production-level PR” has actually decreased compared to 2024 - with one report indicating a drop from 40% in 2024 to 29% in 2026. Data from enterprise customers of Cursor, Anthropic, and OpenAI points to the same phenomenon: the more tools you use, the less you trust them to run autonomously. This reflects a shift in the production relationship: developers are transforming from “code writers” to “code reviewers,” with the cognitive burden of reviewing code being even higher than writing it.
Note: CAB stands for Change Advisory Board, a widely used term in the industry. The Chinese company examples have been replaced with international equivalents, while the data and percentages remain unchanged.
Practical Implications: The Next 24 Months
The deciding factor in determining who will win in the next 24 months is not token speed, but rather the ability to “close the trust gap.” Cursor, Anthropic, and OpenAI are all investing in making their systems more “explainable, interruptible, and reversible.” No one is fixated on being the fastest. If you don’t understand this direction, you won’t comprehend the tool competition in 2026.
III. Compliance and Enterprise Deployment: The “Coming of Age” of Tools
Even the strongest contenders have a hurdle to overcome before they can enter your company’s door: compliance and enterprise deployment. This section discusses several pitfalls that outsiders may easily overlook, but insiders will anticipate.
Warning: The sections on EU data residency and supplier governance in this part are biased towards a European/overseas perspective. Domestic readers who are only concerned with “how to deal with code that cannot leave the country” can skip directly to the fourth section (domestic Trae/Qoder) or the final inspiration.
Note: I’ve kept the original Markdown structure and translated the text to make it sound natural in English, avoiding translationese and Chinese sentence structures. I’ve also preserved the original terminology, such as “token” and “CoT”, and used idiomatic expressions to make the text more readable.
Claude Code’s EU data residency is a trap that makes you think you’re covered when you’re not. Let’s get straight to the point: if you go directly through claude.ai or the Anthropic API, your data lands in the US by default. Claude Enterprise, the enterprise SaaS tier, does not include EU data residency either — it also runs on US infrastructure by default. That’s the most common pitfall. To keep your code in the EU, there’s only one path: don’t buy directly from Anthropic — go through a cloud provider’s European region instead — AWS Bedrock’s EU profile (Frankfurt/Ireland/Paris) or Google Vertex AI’s EU region, and you’ll need to add the eu. prefix to the model ID to force EU residency. Claude Code can run on Bedrock with your data staying inside your own AWS environment, never leaving your infrastructure — that’s its key enterprise capability, but only if you take that route. There’s also a hidden gotcha: Claude went GA in Europe on Microsoft Foundry in July 2026, yet Anthropic’s documentation limits its data residency commitment to Vertex/Bedrock — Foundry isn’t included, and it’s only marked “Coming 2026” with no date. So the statement “we bought Claude Enterprise, we’re compliant” is most likely wrong — the question you should be asking is “which residency path are we on,” not “did we buy it.”
Codex’s enterprise push takes a different route: it comes straight to your data center. On May 18, 2026, OpenAI and Dell announced Dell AI Factory with OpenAI Codex at Dell Technologies World—deploying Codex into enterprise on-premises or hybrid cloud environments, keeping the code where “the data already lives.” Dell’s CTO put it this way: “Let enterprises deploy AI where their data already exists, giving customers a practical, secure path to scaling agents.” Add to that ChatGPT Enterprise’s EU data residency option (available since 2025, covering both storage and inference in European regions), and Codex has the broadest enterprise compliance footprint in this tier—EU residency in the cloud, Dell on the ground. That’s also why Codex’s weekly active users went from 3 million to over 5 million in four months: it’s not just that developers love it; it’s that it can get through the door at large enterprises.
Vendors’ governance posture is now part of supply-chain risk—this is the single most important takeaway for H1 2026.
Anthropic was designated a “supply chain risk” by the U.S. Department of Defense in the first half of 2026, after refusing the Pentagon’s demand for “unrestricted use” of its Claude model — and a federal judge has now issued a preliminary injunction. The details here carry far more weight than the headline suggests. The Pentagon’s ask: the military wanted to use Claude “for all lawful purposes“ — meaning unrestricted, no carve-outs. Anthropic CEO Dario Amodei drew the line at two things: no domestic mass surveillance, and no fully autonomous weapons systems. When negotiations collapsed, Trump took to Truth Social on February 27, 2026, directing all federal agencies to “immediately cease use” of Anthropic technology. Secretary of Defense Hegseth followed up by declaring that “any contractor, supplier, or partner doing business with the U.S. military must have no commercial dealings with Anthropic whatsoever.” By early March, the formal designation as a supply chain risk was in place. Anthropic fired back with a lawsuit in the Northern District of California, and on March 26, Judge Rita Lin granted the preliminary injunction. Her ruling reads: “The record strongly suggests that the supply chain risk designation was pretextual, and that the government’s true motive was unlawful retaliation.”
The most telling comparison: on the very same day Anthropic walked away, OpenAI announced a terms-of-use agreement with the Pentagon. One drew a line and lost a military contract; the other signed on the dotted line and won the business. I’m not here to judge who’s right or wrong. Choosing between Claude Code and Codex isn’t just a model decision—it’s a bet on whether a company is willing to pay a commercial price for its values. In 2026, with the pace of US-China tech decoupling still uncertain, a vendor’s governance stance, data policies, and supply-chain resilience have become formal selection criteria, right up there with features and pricing.
4. On the Domestic Front: Trae and Qoder Are the Contenders—But Autonomous Agents Are Still a Generation Behind
For finance, government, defense, and a significant portion of telecom core systems, code simply cannot leave the country. This section covers domestic options. Among Chinese vendors, the two that are genuinely pushing forward on all three fronts—autonomous agents, compliance, and enterprise-grade deployment—are ByteDance’s Trae and Alibaba’s Qoder. Let me lay out their enterprise editions for you.
Trae (ByteDance) — the furthest along among domestic players in autonomous agents. Trae CN Enterprise Edition officially launched in December 2025. Internally, over 92% of ByteDance engineers use it, and personal-edition registrations have surpassed 6 million. The enterprise push is serious: it offers two deployment tiers — “Enterprise Edition” (standardized, zero-maintenance) and “Enterprise Dedicated Edition” (higher-grade security isolation for organizations with strict compliance requirements that need private network access). On security: end-to-end encrypted code transmission, zero cloud storage, models not trained on your data, no log retention. On performance: it indexes ultra-large repositories up to 100,000 files / 150 million lines of code, with enterprise-grade GPU clusters delivering millisecond-level responses. It plugs into internal knowledge bases and the MCP protocol, and can wire code generation, review, and testing directly into your existing CI/CD and DevOps pipelines. SSO, productivity dashboards (tracking AI generation rate and AI code volume), spend caps, and usage monitoring are all included. It also has a very “ByteDance” growth play: the consumer version is permanently free, using that as a flywheel. SOLO mode (a unified workspace combining editor, terminal, browser, and docs — you give it a requirement and it plans, writes, debugs, and deploys on its own) is free to use — that’s its core weapon in going head-to-head with Claude Code and Cursor on autonomy. Real-world deployments already include Huifu (a Chinese digital payments company) and Douyin Life Services (a ByteDance service). Huifu piloted it starting September 2025, rolled out to over a hundred developers, and peaked at over 70% daily active usage.
Qoder (Alibaba, formerly Tongyi Lingma) — the most mature enterprise-tier structure and the smoothest fit for China’s domestic tech stack. In May 2026, Alibaba Cloud officially rebranded Tongyi Lingma as Qoder CN, expanding it from an IDE plugin into a full-scenario matrix covering coding, office productivity, terminal, and mobile. Its enterprise edition is split into two clearly defined tiers: Enterprise Standard follows a per-seat license subscription model—out-of-the-box, with unified account provisioning, usage analytics, and audit logs. Enterprise Dedicated (VPC) is the one built for strictly regulated organizations—private deployment inside your VPC, data never leaving the corporate network, SSO, org-specific knowledge bases, custom model fine-tuning, advanced code review, 99.9% SLA, a dedicated technical advisor, and 7×24 support. Under the hood, it natively supports switching between multiple domestic models—Qwen, GLM, DeepSeek, Kimi, MiniMax—with data staying within China’s borders, in line with the Cybersecurity Law and Data Security Law. Here’s why I say it fits your telecom and financial environments particularly well: your infrastructure is likely already on Alibaba Cloud, and Qoder’s account system, RAM permissions, and Yunxiao (Alibaba’s DevOps platform) enterprise management are all ready to go—so migration friction is minimal.
Having said that, let me pour some cold water: in the “autonomous agent” tier, domestic tools still lag the US by a generation. The enterprise editions from several major vendors (private deployment + algorithm filing + 信创 (domestic IT infrastructure) adaptation) have basically cleared compliance — that’s not where the gap lies. The real gap is in autonomy — Claude Code can modify a dozen files on its own, run shell commands, manage Git, and open PRs; Codex can spin up multiple sub-agents working in parallel on isolated copies and then merge the results. This kind of long-horizon, high-autonomy execution is something Trae and Qoder are still chasing — Trae is closing the gap via its SOLO mode, but the gap remains, especially in complex reasoning and long-chain autonomous execution. So for the requirement of “a mature team in a heavily regulated industry wanting autonomous agents + code that never leaves the country,” domestic tools currently deliver half the picture: compliance is sorted, but the agent capability is a generation behind. That gap is itself an opportunity — and it’s exactly why this deserves a deliberate design effort on your part to map out the implementation path, rather than just buying a tool and calling it a day.
Baidu’s 文心快码 Comate (Agent Hub + code graph, strong in large-scale engineering and high-compliance scenarios) and Zhipu’s CodeGeeX (broad language coverage, weaker agent capability) are also worth considering as supplements depending on your specific scenario — I won’t go into detail here.
5. How to Choose: Maturity × Data Residency Boundary
Condense the previous four sections into one actionable selection framework. Start with two dimensions—both are essential.
Dimension one: organizational maturity determines how much autonomy you can handle. Organizations just starting out (developers barely using AI, no established code review or testing standards) should begin with low-autonomy completion tools like Copilot—lowest barrier to entry, minimal risk, and a way to get people comfortable with AI collaboration first. Organizations with some foundation (developers who’ve used AI, basic engineering standards in place) can move up to Cursor or domestic tools like Trae / Qoder, where the experience upgrade translates into greater efficiency gains. Mature organizations (strong engineering teams with code review, automated testing, security scanning, and canary releases all in place) are ready for high-autonomy agents like Claude Code and Codex. Why maturity is the gate: the higher the autonomy, the more code the tool produces and the deeper the changes it makes—which demands far more from your review and validation capabilities. Pragmatic Engineer’s research offers a hard reality check: 75% of companies under 10,000 employees chose Claude Code, while 56% of companies above 10,000 still stick with Copilot. That’s not preference—that’s organizational capability.
The second dimension: governance guardrails determine which tier of tools can even get through the door. Whether code can leave the country is the first hurdle. Claude Code, Codex, Cursor, and Copilot all route code to overseas clouds, and code in finance, government, defense, and parts of telecom core systems is simply not allowed to leave. So the idea of “rolling it out company-wide” basically doesn’t hold in heavily regulated industries—you can’t roll it out until you pass the tool-admission clearance. For code that can leave, Claude Code has the highest capability ceiling and Codex has the broadest enterprise compliance footprint; for core domains where code can’t leave, start with Trae or Qoder’s enterprise editions (VPC private deployment) as the foundation, then layer in 文心快码 (Baidu’s Comate) or CodeGeeX by scenario.
Compressing the previous sections into a single decision path—three questions, four routes:
How this path works: first ask whether code can leave the country (if not → domestic private deployment as the baseline, but autonomous agents are still a generation behind); then ask about organizational maturity (don’t deploy autonomous agents before the guardrails are in place); finally ask whether you need end-to-end autonomous agents (if yes → Claude Code / Codex, the two leaders). Note the “generation gap” at the first fork—in heavily regulated industries, mature teams that want “autonomous agent capability + code that never leaves the country” currently face an unmet need, and that gap itself is the opportunity.
Before a decision tree ever lands in your organization, score your own maturity against three quick criteria (you can run through this in 30 seconds—and it directly answers Q2):
- ① Do more than 50% of your developers use AI at least once a week? (Industry average says 90% have tried it, but “at least weekly” is the only reliable sign of real adoption.)
- ② Do you have mandatory code review plus automated test coverage above 60%? (The “+” matters: tests have to actually catch AI-written code, not just touch lines.)
- ③ Is canary release a routine practice? (Not “we did it once”—but “new features go through canary by default.”)
All three met = mature. Go straight for Claude Code / Codex on the left column. One or two met = you have a foundation; look at Cursor / Trae / Qoder. None met = you’re just starting out. Begin with Copilot or a domestic private deployment to lay the groundwork, and get your guardrails in place before you talk about upgrading.
A pragmatic playbook: use Claude Code for the hard problems where data can leave the country, Codex for high-volume parallel batch runs, and Copilot for broad-coverage autocomplete. For core domains that cannot leave the country, deploy the enterprise editions of Trae or Qoder as the foundation. Don’t go all-in on a single tool—the MCP protocol is making multi-tool interoperability a reality, and a multi-vendor strategy is now both technically feasible and compliance-driven. The Pragmatic Engineer’s “senior engineer best practices” show that 70% of engineers use 2 to 4 tools simultaneously, switching based on the task at hand.
That wraps up the framework. But the actual mix depends on your specific data egress boundaries, maturity level, and industry—this layer can’t be decided by a single article; it has to reflect your company’s real situation. That’s also why I’ve left my contact information at the end.
Six: The Higher the Autonomy, the Heavier the Governance—Don’t Put a Big Engine in a Car Without Brakes
As capability ceilings rise, the corresponding cost is review burden. CodeRabbit’s report from late 2025 analyzed 470 open-source GitHub PRs and concluded that AI-assisted code contains 1.7× more defects than purely human-written code (10.83 vs. 6.45 per PR on average), with security vulnerabilities higher by 1.82× to 2.74× depending on the subcategory (XSS 2.74×, insecure direct object references 1.91×, improper password handling 1.88×, unsafe deserialization 1.82×). Apiiro’s September 2025 scan of Fortune 50 enterprise repositories (data covering Dec 2024–Jun 2025) was even more concrete: AI-generated code drove monthly security findings from roughly 1,000 to 10,000+ (a 10× jump), with privilege escalation vulnerabilities up 322% and architecture-level design flaws up 153%; over the same period, syntax errors fell 76% and logic bugs fell 60% (which is why developers feel faster, while the dangerous class of vulnerabilities quietly creeps up). This data isn’t saying AI-written code is unusable—it’s saying AI writes more, writes faster, and defects and vulnerabilities scale proportionally. Once tool output ramps up in volume, review burden rises quickly—code grows faster than review bandwidth, and mid-level reviewers saturate fast.
Together, these two data points tell one story: your tooling’s output capacity has gone up, but your review capacity hasn’t kept pace—which means you’re accumulating more dangerous debt at a faster rate. This is especially true for autonomous agents. Tools like Claude Code can modify a dozen files and open a pull request on their own, with an extremely high ceiling on what they can do—but also a large surface area for things to go wrong. In January–February 2026, Carlini publicly documented a widely cited example: Anthropic researcher Nicholas Carlini ran 16 Claude Opus 4.6 agents in parallel for two weeks, spanning roughly 2,000 sessions and about $20,000 in API costs, to write from scratch a 100,000-line Rust-based C compiler that can compile the Linux 6.9 kernel (x86/ARM/RISC-V), passes 99% of the GCC torture test, and runs FFmpeg, Redis, PostgreSQL, QEMU, and Doom. Put that level of autonomy into an organization with no code review, no automated testing, no security scanning, and no canary releases, and it’s only a matter of time before something goes wrong.
So before you let autonomous agents loose, build four things first: mandatory human code review (AI pull requests don’t get a free pass), automated testing (AI changes have to actually run), security scanning (AI code gets scanned to the same standard as human-written code), and canary releases (AI changes ship to a small percentage of traffic first). These four are your brakes. Get the brakes installed before you talk about how big an engine to put in. That’s also why I put organizational maturity as the first dimension in my evaluation framework — maturity, in practice, means how complete your braking system is.
Another easily overlooked trap: shadow AI—AI tools that employees are using without IT approval. JetBrains’ January 2026 survey found that 90% of developers are already using AI tools; multiple industry surveys converge on the same conclusion—most developers admit to using AI tools in their work that never went through formal IT approval (UpGuard 2025 puts the figure at around 80%). You think you’re still in the “evaluation” phase, but your developers have long been pasting code into all kinds of offshore tools that never passed compliance review. One finding from Pragmatic Engineer’s February 2026 survey is even more sobering: 56% of senior engineers say they rely on AI tools for more than 70% of their engineering work—this isn’t “AI helps me write a few lines of code,” it’s “AI is already the default way of working.” If you don’t give them compliant tools, they’ll use non-compliant ones. The cost of shadow AI goes far beyond IT losing a few licenses—it means compliance failures, loss of IP control, and code leakage risk all happening at once.
7. What This Means for Decision-Makers
Insight #1: Tool selection is an organizational decision, not a technical one. What you’re choosing isn’t just a tool—it’s how your organization will work. Picking Copilot means “human-led, AI-assisted.” Picking Claude Code means “AI-autonomous, human-supervised.” These two paths demand completely different organizational capabilities. The real cost of choosing wrong isn’t the subscription—it’s that the tool forces your organization to operate in a way you can’t sustain. The first move is to elevate this from a CTO-level technical decision to a CEO/COO-level organizational one.
Insight #2: The higher the autonomy, the heavier the governance—install the brakes before you accelerate. Before deploying autonomous agents, four things are non-negotiable: code review, automated testing, security scanning, and canary releases. CodeRabbit’s data—1.7× more defects and 1.82–2.74× more security vulnerabilities—is the most direct warning against running agents without guardrails. Governance must go live before capability does.
Insight Three: In heavily regulated industries, pass the “tool clearance” gate before scaling—and change what you measure. You think the bottleneck slowing delivery is coding? Usually not. It’s in the validation chain—Change Advisory Board, filing, testing, audit. But the metrics you report upward—seat count, adoption rate, lines of code—hide exactly these bottlenecks, so budget flows to tools instead. To cure the “we know but can’t move” disease, change the metrics: stop measuring AI ROI by license volume and lines of code; measure end-to-end delivery cycle time, change failure rate, validation pass time, and production incident count. Change the metrics, and budget will shift from “buying more seats” to “attacking the validation bottleneck.”
Insight Four: A vendor’s governance stance is now part of your supply chain risk. Anthropic was flagged as a supply chain risk for refusing the military’s “unrestricted use” request; OpenAI signed with the military the same day. When selecting vendors, beyond features and price, look at three things: data handling policy (whether code is retained and for how long), compliance posture (whether the vendor will accommodate your regulatory requirements—and whether they’ll pay a commercial price for their values), and supply chain resilience (don’t bet your lifeline on a single offshore vendor). Multi-vendor isn’t a nice-to-have; it’s a risk-control necessity. (For telecom, financial, and government decision-makers in China: your primary constraint is cross-border data transfer, not vendor governance stance—the latter is more of an overseas lens, so don’t let it overshadow what matters.)
Insight Five: The trust gap is the real battleground for the next 24 months. Your developers are already using AI, yet their trust in AI output has actually dropped compared to two years ago (from 40% down to 29%). That means your evaluation criteria need one more dimension: can you confidently let go of the code it writes—explainable, interruptible, rollback-able, accountable.
Reverse self-check (be honest when answering): When you chose your tools, did you start with “what level of autonomy can my organization actually absorb,” or “what’s hot, let’s buy it”? Before deploying autonomous agents, are your code review, testing, security scanning, and canary releases in place? When you report AI coding ROI to the board, are you using seat counts or end-to-end delivery cycle time? Can your core-domain code leave the country, and do you have a corresponding domestic alternative? Have you assessed your vendors’ governance stance and data policies? Is your team’s trust in AI output trending up or down?—If any of these six questions makes you squirm, your tool-selection framework needs another revision.
What’s Next
In the next article (Part 5), we look at the other half of the tool ecosystem—how app builders and AI IDEs (Bolt, Lovable, Replit, v0) are redefining what “development” even means. They’ve lowered the barrier to building to nearly zero, but the security and compliance bar must not follow suit—that’s another shadow AI crisis unfolding, and a quieter one.
Want to Put This Framework to Work in Your Company?
Once AI coding tools enter an enterprise, the real questions usually come down to a few concrete issues: which code and data can be fed into the model, how much agent autonomy the team can handle, how far existing validation processes need to be extended, and what metrics should define success for the pilot.
We currently offer three types of engagement:
Enterprise training: Using your company’s real projects, we work through tool selection, usage boundaries, validation processes, and governance mechanism design.
Advisory consulting: Focused on a specific decision—for example, whether Claude Code is a good fit, how Trae or Qoder can be deployed in a heavily regulated environment, or how to design a 90-day pilot plan.
Executive briefings and industry talks: Covering AI coding, software engineering transformation, enterprise AI adoption, and organizational governance.
Articles can provide general frameworks, but actual implementation still needs to be redesigned around your company’s data boundaries, regulatory requirements, engineering maturity, and existing delivery processes. You can reach us at coach@iaiuse.com.
Further reading: The Signboard Methodology v1.0 (Learn AI Slowly, No. 187), which lays out a 7-step framework for enterprise AI transformation.
About This Series
“Software Engineering Transformation in the AI Era” is a research series aimed at CIOs, CDOs, CTOs, and digital transformation leaders across telecommunications, finance, manufacturing, and e-commerce. It focuses on how AI coding tools are reshaping software delivery processes, organizational structures, governance mechanisms, and management metrics.
The series continuously tracks academic papers, vendor materials, and industry reports, with a research library of over 200 sources. Each key claim is tagged with an evidence level, distinguishing between verified facts, vendor claims, industry observations, and the author’s own reasoning.
I have nearly 8 years of experience in large-enterprise consulting and business analysis, including a tenure at IBM where I worked on projects in telecommunications, finance, insurance, and manufacturing. Since then, I’ve remained hands-on in product and AI application development—covering requirements analysis, product design, and cross-team delivery—across carrier-grade products, internet products, and AI applications.
The judgments in this series on tool selection, validation workflows, and organizational governance draw from this hands-on experience, cross-validated against public research and industry case studies. All project-specific content has been anonymized; some industry scenarios are typical problem reconstructions, with supporting references listed at the end of the article.
References (source-by-source citations + evidence levels + stance annotations)
- JetBrains AI Pulse Survey 2026.1 (Tier 1): 10,000+ professional developers, 8 languages. GitHub Copilot: 76% awareness / 29% workplace adoption / growth stalled (56% at companies with 10,000+ employees); Cursor: 69% / 18% / growth slowing; Claude Code: 57% / 18% / 6× growth in 9 months, 24% in North America, CSAT 91 / NPS 54; Codex: 27% / 3% (pre-desktop); Antigravity: 6% (entered Nov 2025); Junie CLI: 5%. 90% of developers use at least one AI tool; 70% use 2–4. https://www.jetbrains.com/research/ai-coding-assistant-usage/
- Pragmatic Engineer Newsletter (Feb 2026, primary source): Survey of 15,000 developers; Claude Code is the most loved at 46% (vs Cursor 19%, Copilot 9%); 75% of companies under 10,000 employees choose Claude Code, while 56% of companies over 10,000 choose Copilot; 70% use 2–4 tools simultaneously. https://newsletter.pragmaticengineer.com/p/ai-tooling-2026
- Anthropic Series G announcement (Feb 2026, primary source, vendor perspective): Claude Code went from zero to $2.5B annualized revenue in 9 months. Corroborated by Reuters, Forbes, SaaStr, and others.
- Microsoft FY26 Q1/Q2 earnings (Jan 28, 2026, cited directly from Microsoft investor relations, vendor perspective): GitHub Copilot has 4.7M paid subscriptions, up +75% YoY (per Q2 FY26 earnings); Copilot Pro+ consumer subscriptions up +77% QoQ in Q2. ~77,000 enterprise customers is the figure disclosed in FY24; not refreshed in FY26, retained with source noted.
- Cursor / Anysphere Series D (Nov 2025, Tier 1): $2.3B raised, $29.3B valuation. ARR grew from $100M (Jan 2025) to $2B (Feb 2026), the fastest application-layer SaaS to reach $100M ARR ever. CNBC, The Information.
- Sam Altman / OpenAI public statements (Apr–Jun 2026, primary source, vendor perspective): Codex weekly active users went from 3M (early April) → 4M (Apr 21) → 5M+ (Jun 2, of which 20% are non-developers); token usage growing +70%+ MoM; Codex CLI npm monthly downloads grew from 82K in Apr 2025 (launch month) to 41.8M in May 2026 — a 510× increase. Corroborated by gradually.ai, Neowin, Constellation Research.
- OpenAI × Dell partnership (May 18, 2026, primary source, vendor perspective): Announced at Dell Technologies World: Dell AI Factory with OpenAI Codex, bringing Codex to on-premises/hybrid cloud enterprise environments; covers Codex + ChatGPT Enterprise. https://openai.com/index/dell-codex-enterprise-partnership- OpenAI EU Data Residency (starting Feb 2025, first-hand, vendor perspective): European data residency for ChatGPT Enterprise/Edu/API; in-region GPU inference (US/EU) expanding in Jan 2026. https://openai.com/index/introducing-data-residency-in-europe/
- Claude Code on AWS Bedrock + EU residency (tier-1): Claude via claude.ai/Anthropic API defaults to US infrastructure; Claude Enterprise (SaaS) does not include EU data residency; EU residency requires AWS Bedrock EU profile (Frankfurt eu-central-1 / Ireland / Paris) or Vertex AI EU, with model ID prefixed by
eu.; Microsoft Foundry GA in Europe in Jul 2026, but data residency commitments do not cover Foundry (“Coming 2026”). compound.law, InfoQ, bespinian. https://www.infoq.com/news/2026/07/claude-foundry-ga-europe - Anthropic–US DoD dispute (2026 H1, tier-1, news facts + legal filings): The Pentagon demanded unrestricted use of Claude “for all lawful purposes”; Dario Amodei’s red line: no domestic mass surveillance, no fully autonomous weapons; Feb 27, 2026 Trump directed federal agencies to stop using it, Hegseth listed it as a “supply chain risk”; Mar 4 DoD formal designation; Anthropic sued Mar 9 (ND Cal, 3:26-cv-01996, Judge Rita Lin); Mar 26 preliminary injunction (“the stated reason is likely a pretext, the motive is unlawful retaliation”); Apr 8 appeals court denied Anthropic’s stay request; same day OpenAI announced a deal with the Pentagon. Mayer Brown, Wikipedia, Arms Control Association, Breaking Defense, CNBC. https://www.mayerbrown.com/en/insights/publications/2026/03/pentagon-designates-anthropic-a-supply-chain-risk-what-government-contractors-need-to-know
- TRAE CN Enterprise Edition launch (Dec 18, 2025, tier-1, vendor perspective): 92% of ByteDance engineers use it internally; 6M+ individual registrations; dual deployment options — Enterprise Edition and Dedicated Enterprise Edition (private network isolation for the latter); full-chain encryption + zero cloud storage + models not trainable on customer data; indexes up to 100K files / 150M lines; SSO, efficiency dashboards, MCP; deployed at Huifu (Chinese fintech) and Douyin Life Services (ByteDance service). CSDN, Sina Tech, ZOL (citing official release). https://www.csdn.net/article/2025-12-18/156057918- Qoder CN (formerly Tongyi Lingma) Enterprise Edition (May 2026, primary source, vendor perspective): In May 2026, Tongyi Lingma was rebranded as Qoder CN, expanding its matrix across coding, office productivity, endpoints, and mobile. It offers an Enterprise Standard Edition (per-seat licensing) and an Enterprise Dedicated Edition (VPC private deployment, data stays within the internal network, SSO, model fine-tuning, 99.9% SLA, dedicated advisor, 7×24 support). Underlying models are multiple domestic options (Qwen/GLM/DeepSeek/Kimi/MiniMax). Alibaba Cloud official documentation. https://help.aliyun.com/zh/lingma/qoder-cn-account-and-subscription
- Google Antigravity (Nov 2025 + I/O 2026, primary source): Launched in Nov 2025 as an agent-first coding tool (built for Gemini 3, per The Verge); upgraded to 2.0 at Google I/O 2026 (a full agentic development platform with desktop + CLI + SDK); JetBrains 2026.1 reports a 6% adoption rate. Sources: Wikipedia, The Verge, Google official.
- CodeRabbit (Dec 17, 2025, first-hand data): 470 open-source GitHub PRs (AI vs. human). Total defects 1.7× (10.83 vs. 6.45 per PR); security vulnerabilities by subcategory 1.82–2.74× — XSS 2.74×, insecure direct object references 1.91×, improper password handling 1.88×, insecure deserialization 1.82×; readability issues 3×. https://www.coderabbit.ai/whitepapers/state-of-AI-vs-human-code-generation-report
- Apiiro (Sep 4, 2025, vendor perspective): Scans of Fortune 50 enterprise repositories (data period Dec 2024–Jun 2025). Monthly security findings in AI-generated code surged from ~1,000 to 10,000+ (10×), with privilege escalation vulnerabilities up 322% and architecture-level design flaws up 153%; syntax errors down 76%, logic bugs down 60%. Sources: The Register, Cloud Security Alliance Labs.
- GitHub × Accenture study (first-hand data, vendor perspective, GitHub Blog Apr 2024): 450+ Accenture developers, 6-month controlled experiment. PRs per developer +8.69%, merge rate +15%, developers retained 88% of Copilot-generated code characters (after review). Note: The widely cited “55% faster” figure comes from a separate small-sample controlled experiment by GitHub on a JavaScript HTTP service task — it is unrelated to the Accenture study and is often misattributed.
- MIT Economics working paper (primary source): Microsoft experiment (1,663 participants) PR +12.9%–21.8%; Accenture experiment (311 participants) PR +7.5%–8.7%. https://economics.mit.edu/sites/default/files/inline-files/draft_copilot_experiments.pdf
- Stack Overflow Developer Survey 2025 (primary source): 84% of developers use AI tools; JetBrains 2026.1 reports that figure rising to 90%.- UpGuard 2025 / Journal of Accountancy (secondary): Roughly 80% of developers admit to using AI tools that were not approved by their IT department (shadow AI).
- Declining developer trust (secondary, multiple sources): The share of developers who trust AI-generated code is projected to be around 29% in 2026, down from 40% in 2024; code churn rose from 3.1% in 2020 to 5.7% in 2024. Figures per Uvik Software and others.
- Carlini / Anthropic (Jan–Feb 2026, primary, first-hand research): Anthropic researcher Nicholas Carlini ran 16 Claude Opus 4.6 agents in parallel for two weeks—about 2,000 sessions and roughly $20K in API costs—to write a 100,000-line Rust-based C compiler from scratch. The compiler builds Linux 6.9 (x86/ARM/RISC-V), passes 99% of the GCC torture test, and runs FFmpeg, Redis, PostgreSQL, QEMU, and Doom. Sources: InfoQ, Anthropic blog.
- Anonymization note: The telecom operator scenarios in this post are based on the author’s own experience with AI internal training and digital team tracking in the carrier space, and have been anonymized. Passages on banking, manufacturing, and e-commerce used to illustrate “the same logic applies across industries” are typical industry extrapolations, not specific client consulting results. Please cite with anonymization in mind.
buymeacoffee
![[Bottleneck Shift] When Code Is Nearly Free, Where Has the Bottleneck of Software Engineering Gone? The Transformation of Software Engineering in the AI Era — Learn AI Slowly #173](https://cdn.iaiuse.com/img/2026/08/10/fb10b9116141238daf5a49ae7d60f446.webp)
![[Your Organizational Structure Has Already Decided Your Software’s Fate] Conway’s Law — The Management Law Underestimated for 56 Years AI Era Software Engineering Transformation — Learn AI Slowly #171](https://cdn.iaiuse.com/img/2026/04/06/97308b44819c0d12a4fd8e758b91ddd0.webp)
