AI Coding Assistants in Real Teams: Productivity Evidence and Risks

AI coding assistants have gone from autocomplete to agents that take an issue, write the code, run the tests and open a pull request. Almost every developer now uses them in some form. The question for engineering leaders and founders is no longer whether to adopt them, but how to adopt them without trading speed for defects, security holes and code nobody understands.

The evidence is more nuanced than either the hype or the backlash suggests. Controlled studies have found slowdowns as well as speedups. Large surveys show near-universal adoption alongside low trust. Security research shows AI-generated code often picks the insecure option when it has a choice.

This guide summarises what the research says as of late 2026, what has changed in the tools, and the practices that make AI-assisted development work in real teams, including ours.

How AI coding tools evolved

Three generations now coexist:

• Inline completion: suggestions as you type. The original Copilot experience.
• Chat and edit in the IDE: ask for a refactor, a test or an explanation across several files.
• Coding agents: given a task, the agent plans, edits files, runs commands and tests, and iterates. These run in the terminal, the IDE or the cloud. GitHub made its Copilot coding agent generally available in September 2025: you assign an issue, it opens a draft pull request and requests your review.

Each generation shifts more work from writing code to specifying tasks and reviewing results. That shift is where most of the productivity gains, and most of the risks, come from.

What the productivity evidence says

The headline studies point in different directions, and the reasons are instructive.

The original METR study is the most cited because it was a randomised trial and the result was surprising. METR's own February 2026 update is just as important: it says developers are probably more sped up now than in early 2025, but that 30% to 50% of participants withheld some tasks because they did not want to do them without AI, which makes clean measurement hard. In other words, the tools improved and developers became so dependent on them that the experiment itself broke.

The 2025 DORA report adds the organisational view: AI amplifies what a team already does. Teams with good platforms, small batches and fast feedback benefit; teams with tightly coupled systems and slow review see little gain and more instability.

Where AI helps most, and least

From the research and from practice, AI tends to help most with:

• Boilerplate, scaffolding and CRUD endpoints.
• Writing tests for existing code, especially edge cases.
• Unfamiliar languages, frameworks and APIs.
• Small, well-specified tasks with clear acceptance criteria.
• Explaining legacy code and drafting migration plans.

It helps least, or hurts, with:

• Large, mature codebases with implicit conventions the model does not know.
• Subtle concurrency, performance and security-sensitive code.
• Ambiguous tasks where the hard part is deciding what to build.
• Experienced developers working in code they know intimately, which matches the METR setting.

The security and quality evidence

Veracode's 2025 GenAI Code Security Report tested more than 100 language models on 80 coding tasks and found that the generated code introduced security flaws in 45% of tasks. Java was the worst, with failure rates above 70%; models failed to defend against cross-site scripting in 86% of relevant cases and log injection in 88%. When a model had a choice between a secure and an insecure way to write something, it chose the insecure option in close to half of cases.

Other risks to manage:

• Hallucinated dependencies: suggested packages that do not exist, which attackers can register.
• Licence contamination: code that closely matches licensed sources.
• Secrets in prompts: developers pasting credentials or customer data into tools without enterprise controls.
• Comprehension debt: code merged that nobody on the team fully understands, which slows every later change.
• Agent actions: coding agents that can run commands can also delete files or touch production if permissions allow.

Practices that make AI-assisted development work

These are the practices we have found matter most, and they line up with what DORA calls foundational capabilities:

1. Small batches: keep AI-generated pull requests small. A 2,000-line agent PR is unreviewable.
2. Tests first or tests with: require tests in every AI-assisted change; ask the agent to write failing tests before the fix.
3. Human ownership: the developer who opens the PR owns it fully, whether a person or an agent wrote the lines.
4. Automated gates: static analysis (SAST), dependency and licence scanning (SCA), secret scanning and type checks on every PR.
5. Context files: maintain a repository guide (conventions, architecture, commands) that agents read, so output matches your codebase.
6. Approved tools only: enterprise plans with data controls, no training on your code, and audit logs.
7. Review focus: reviewers concentrate on design, security and edge cases; linters handle style.
8. Measure: track lead time, deployment frequency, change failure rate and time to restore, plus PR size and review time.

A day-to-day workflow with coding agents

Here is how a well-run task flows when a developer works with a coding agent:

1. Write the task like a ticket for a new joiner: goal, constraints, files involved, acceptance criteria and how to run the tests.
2. Ask for a plan first: have the agent outline the change before editing anything. Correct the plan; it is cheaper than correcting code.
3. Let it work in a branch: the agent edits, runs tests and iterates in a sandbox with no production access.
4. Read the diff, not the summary: agent summaries can be confident and wrong. Check what actually changed.
5. Run the gates: tests, type checks, SAST, dependency and secret scans must pass before review.
6. Review as you would a colleague's PR: design, naming, edge cases, error handling, security.
7. Capture lessons: if the agent repeatedly misses a convention, add it to the repository context file.

Two habits separate teams that gain from those that churn. First, they break work into small, verifiable pieces, so an agent's mistake costs minutes, not days. Second, they treat the agent's output as a draft from a fast but junior colleague: useful, often right, never trusted without checking.

For founders without an in-house team, the same rule applies to AI app builders: they generate a lot of code quickly, but someone accountable still needs to understand it. Our guide to low-code and AI app builders covers where that line falls.

A policy template for teams

For regulated domains such as healthcare and fintech, add explicit sign-off for security-sensitive modules and keep an audit trail of which changes were AI-assisted.

What this means when you hire a development partner

If you outsource development, ask your partner directly how they use AI. Good answers include the tools they use, the data controls in place, how they review AI code, what automated gates run, and how they measure quality. Be wary of quotes that assume large AI speedups without explaining how quality is protected, and equally wary of teams that ban AI outright, since they will struggle to stay competitive. Our guide to hiring dedicated developers in India includes vetting questions you can extend with these.

At Algon, our dedicated teams and managed engineering services use AI assistants and agents inside the guardrails above, and we report delivery metrics rather than claimed speedups. For product builds, see our MVP development approach and the MVP cost guide.

How to start

1. Pick an approved tool on an enterprise plan with data controls.
2. Write a one-page policy covering data, scope, review and testing.
3. Add SAST, SCA and secret scanning to CI if you do not have them.
4. Create a repository context file for agents.
5. Baseline your DORA metrics for one or two months.
6. Roll out to one team, keep PRs small, and review metrics monthly.
7. Expand when throughput improves without a rise in change failure rate.

Conclusion

AI coding assistants are now standard equipment, and coding agents are rapidly becoming part of the workflow. The research says the gains are real for some tasks and some teams, illusory for others, and that security does not come for free. Teams that benefit are the ones with small batches, strong tests, automated security gates and honest measurement. Adopt the tools, but adopt the discipline with them.