In 2025, a research nonprofit did something almost nobody had bothered to do: it put a stopwatch on developers using AI.
METR recruited 16 experienced open-source developers, gave them 246 real tasks from their own mature repositories, and randomly assigned whether AI tools were allowed. Before starting, the developers predicted AI would make them 24% faster. Afterwards, they reported it had made them 20% faster.
The stopwatch said they were 19% slower (METR, July 2025).
That 39-point gap between feeling and fact is the most important number in AI-assisted programming, and it repeats in every study that measures instead of asking. Here's what four independent datasets found — and what to actually do about it if you're learning to code right now.
Key Takeaways
A randomized trial measured a 19% slowdown while participants perceived a 20% speedup (METR, 2025).
Across 623 million code changes, duplication rose 81% and refactoring fell 70% (GitClear, 2026).
AI-generated code passes security tests just 56% of the time, statistically unchanged in a year (Veracode, 2026).
Engineers learning a new library with AI scored 17 points lower on comprehension (Anthropic, 2026).
Do Developers Actually Get Faster With AI?
It depends entirely on whether you ask them or time them. The METR trial is the strongest evidence available because it used the design medicine uses for drug approvals — randomized, controlled, with objective outcomes. The participants weren't beginners fumbling with new tools: they averaged five years contributing to repositories with 22,000+ stars and over a million lines of code, and they used Cursor Pro with Claude models in their normal workflow.
Now compare that to what happens when you survey people. Google's DORA report found AI adoption among developers hit 90% in 2025, up from 76%, with more than 80% reporting increased productivity and 59% reporting improved code quality (DORA, 2025).
Study | Method | Finding |
|---|---|---|
METR (2025) | Randomized trial, 246 tasks, timed | 19% slower with AI |
METR (2025) | Same developers, self-reported | 20% faster, they believed |
DORA (2025) | Survey, ~5,000 practitioners | 80%+ report higher productivity |
GitClear (2026) | 623M code changes, measured | Duplication +81%, refactoring −70% |
Notice the pattern. Every self-report is positive. Every objective measurement is negative or mixed. That's not a contradiction to resolve — it's the finding.
One honest caveat, which METR itself raises: 16 developers is a small sample working in codebases they know intimately, where their own mental model beats any AI's context. This result may not transfer to unfamiliar code or greenfield projects. But it's the best-designed study we have, and its direction has now been corroborated three different ways.
Why Does It Feel Faster When It Isn't?
Because AI moves work from a phase you notice into a phase you don't. Typing code is visible effort — you feel every keystroke. Reading generated code, spotting the subtle bug, deciding whether the approach is right: that's invisible effort. It doesn't register as work, so it doesn't get counted.
Developers know this at some level. Stack Overflow's 2025 survey of roughly 49,000 developers found the single biggest frustration, cited by 66%, was "AI solutions that are almost right, but not quite" — followed by 45% saying debugging AI-generated code takes more time (Stack Overflow, December 2025).
"Almost right" is the expensive failure mode. Code that's obviously broken costs you a second. Code that's 95% right costs you an hour, because you have to find the 5% — and you didn't write any of it, so you have no memory of where the tricky parts are.
Trust is falling as usage rises. Stack Overflow found only 29% of developers trust AI accuracy, down 11 points year over year, with more actively distrusting it (46%) than trusting it (33%). DORA saw the same direction: those trusting AI "a great deal" or more dropped from 87.9% to 70%.
What Is AI Doing to the Codebase?
Changing its shape, measurably. GitClear and GitKraken analysed 623 million real-world code changes from 2023 to 2026, tracking eight quality signals as AI authorship climbed to about a quarter of all commits (LeadDev, July 2026).
Signal | Change |
|---|---|
Duplicated code blocks | +81% |
Within-commit copy/paste | +41% |
Error-masking constructs | +47% |
Two-week code churn | +15% |
Refactoring (moved lines) | −70% |
Legacy maintenance | −74% since 2023 |
Cross-file function calls (reuse) | −35% |
Source: GitClear, The Maintainability Gap, 2026
Read those together and a behaviour emerges. Code is being added, not reorganised. GitClear CEO Bill Harding describes the mechanism plainly: "Every time you want something, AI creates a new package for it." The consequence arrives later — "in the long term it starts to get painful when you realize you have five different implementations of the same thing that are similar yet different."
The most revealing line in his analysis is about what isn't happening: "If you don't share code, every time you implement it you're discarding all the prior progress the developers have made in the repository."
Our read: GitClear also found heavy AI users out-produce non-users by 4–10x — but most of that gap existed before AI. Measured against their own past selves, heavy AI users gained about 25%. That's the perception gap again, in a different disguise: a real but modest improvement, experienced as a transformation. And it lines up with DORA's split verdict, where AI now correlates with higher throughput but still shows a negative relationship with delivery stability. More shipped, more broken.
Is AI-Generated Code Secure?
About as often as a coin flip. Veracode tested more than 100 models across 80 curated coding tasks and found the average security pass rate sits at 56% — essentially flat against 55% in its first report (Veracode, July 2026).
That number deserves emphasis because it's the one thing that didn't improve while models got dramatically more capable. Models became nearly syntactically perfect and stayed roughly a coin flip on security.
The failures cluster. Java showed a 72% failure rate. Cross-site scripting was worst of all: only 12–13% of AI-generated code written for XSS-prone tasks came back secure, an 86% failure rate for that single vulnerability class.
Why doesn't capability fix this? Because models optimise for code that works, and insecure code usually works fine — right up until someone attacks it. Nothing in "make this function handle user input" tells the model you also meant "and don't let that input execute."
What Does This Do to You If You're Still Learning?
This is the part that should matter most to anyone early in their career, and it's the best-designed study of the lot. Anthropic ran a randomized trial with 52 mostly junior engineers learning Trio, an unfamiliar Python async library. One group used AI assistance; the other hand-coded (Anthropic, January 2026).
Both groups finished in roughly the same time. Then came a comprehension quiz.
Hand-coding group: 67%. AI-assisted group: 50%.
A 17-point gap — the researchers describe it as nearly two letter grades (Cohen's d = 0.738, p = 0.01).
The largest gap was in debugging — which the authors note is exactly the skill needed "for detecting when AI-generated code is incorrect and understanding why it fails."
Sit with that loop for a second. AI code fails security tests about 44% of the time and is "almost right" often enough to be the industry's top complaint. The skill you most need to catch that is debugging. And debugging is the skill that erodes fastest when you delegate.
Real-world data points the same way. The tech company Infobip tracked technical skill growth across 225 interns: pre-AI cohorts gained +2.50 points, AI-era cohorts +1.56, with the sharpest contrast between Winter 2023 (+2.89) and Summer 2025 (+0.69) as heavy AI use went from 0% to 54% (LeadDev, June 2026).
But — and this is the whole ballgame — the effect wasn't uniform. Anthropic found high scorers used AI strategically: asking follow-up questions, requesting explanations, posing conceptual queries. Low scorers delegated code generation and debugging without verifying anything. Infobip's Winter 2026 cohort showed the extremes in two people: one intern using passive delegation grew 0 points; another using engaged AI dialogue grew +3.
Same tool. Opposite outcomes. The variable is how you use it.
How Should You Actually Use It?
Turn AI from an answer machine into an explanation machine. Every rule below comes straight out of the research above:
Predict before you generate. Say out loud how you'd solve it, then ask. If your guess and the output differ, you've found something worth learning — that's the difference between the engaged and passive interns.
Ask "why," not just "what." Anthropic's high scorers requested explanations and asked conceptual follow-ups. Make that your default.
Debug by hand deliberately. It's the skill with the steepest measured decline and the highest downstream value. Protect it on purpose, especially while learning.
Never accept code you can't explain line by line. If you can't explain it, you can't review it — and with a 56% security pass rate, review is not optional.
Search for an existing implementation before generating a new one. This directly counteracts the +81% duplication and −35% reuse trend.
Time yourself occasionally. METR's whole point is that your sense of speed is unreliable. Measure a few tasks with and without.
[INTERNAL-LINK: building real engineering skill in an AI-assisted workflow → practical guide for early-career developers]
Frequently Asked Questions
Does this mean I shouldn't use AI to code?
No. It means measure instead of assuming. DORA found AI adoption at 90% and now positively linked to delivery throughput, so the tools clearly do something. The evidence argues against unverified delegation, not against the tools.
Why were experienced developers slower in the METR study?
Mostly because they knew their codebases better than the AI did. Reviewing and correcting generated code cost more than writing it themselves. METR notes this may not hold in unfamiliar code, where the balance likely shifts the other way.
Is AI-generated code getting more secure over time?
Not measurably. Veracode's average pass rate moved from 55% to 56% across four testing snapshots and 100+ models, while general capability improved sharply. Security is not improving as a side effect of smarter models.
Will AI stop me from becoming a good engineer?
Only if you use it passively. Anthropic's trial showed AI users scoring 17 points lower on comprehension, but high scorers who asked for explanations did fine. Infobip saw one intern gain 0 points and another gain 3 with the same tools.
The Uncomfortable Version
AI coding tools are real, useful, and worse than they feel.
Four independent research groups, using four different methods, found the same shape: measured gains smaller than perceived gains, quality signals degrading, security flat, and comprehension declining for people still learning. None of that says stop. All of it says the feeling of speed is not evidence of speed.
The developers who'll be worth hiring in three years aren't the ones who generated the most code. They're the ones who can still read it, debug it, and explain why it's wrong — because that skill is now scarce, and the data shows exactly how it gets lost.
Sources
Source | Title | URL |
|---|---|---|
METR | Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity | |
Anthropic | How AI assistance impacts the formation of coding skills | |
GitClear | The Maintainability Gap: 2026 AI Code Quality Research | |
LeadDev (Bill Doerrfeld) | Code maintainability plummets in the AI coding era | |
LeadDev (Antonija Bilić Arar) | AI coding creates two kinds of debt. You're only measuring one | |
Veracode | 2026 GenAI Code Security Report | |
Google DORA | State of AI-assisted Software Development 2025 | |
Stack Overflow | 2025 Developer Survey results |
