Blog

AI coding agents: what they change when you commission software

Benjamin · · 7 min read

AI coding agents now read code, plan changes and run tests. What the research actually says about speed, trust and security, how the main tools work, and what stays the same however your software gets written.

AI coding agents are AI tools that don't just suggest the next line of code. They read a codebase, plan a change, edit several files, run commands and tests, and hand the result back for review. Tools like GitHub Copilot, Cursor, Claude Code and OpenAI's Codex have moved software development quickly from "autocomplete" to "give it a task".

If you're a business owner commissioning software, this matters in practical ways: what you should expect from a builder, what gets faster, what doesn't, and what to ask. This guide covers what the research actually says, how the main tools work, and what stays the same no matter how the code gets written.

What the research says about AI coding tools

The evidence is more mixed than the headlines:

  • Almost every developer now uses them. Google's 2025 DORA report, a survey of nearly 5,000 technology professionals, found 90% use AI at work and more than 80% believe it has increased their productivity. (Google Cloud) Stack Overflow's 2025 Developer Survey, with over 49,000 responses, found 84% use or plan to use AI tools in their development process. (Stack Overflow)
  • But trust is falling. In the same Stack Overflow survey, 46% of developers said they don't trust the accuracy of AI output, up from 31% the year before. (Stack Overflow)
  • Faster isn't guaranteed. In a 2025 randomised controlled trial by the research group METR, 16 experienced open-source developers working on 246 real tasks in their own large projects took 19% longer when allowed to use AI tools, even though they believed afterwards that AI had made them about 20% faster. The authors are careful to say the result may not apply to other developers or settings. (METR)
  • Speed without controls creates instability. DORA found AI adoption now has a positive relationship with delivery throughput, but still a negative one with delivery stability. Their summary: AI "amplifies what's already there". Strong teams get better, and struggling teams see their problems intensify. Without robust testing, version control and fast feedback, more change means more breakage. (Google Cloud)
  • Security doesn't come for free. Veracode's 2025 GenAI Code Security Report tested over 100 large language models and found 45% of the code samples failed security tests, introducing OWASP Top 10 vulnerabilities. Security performance stayed flat regardless of model size, even as the code got better at working. (Veracode)

The pattern across all of them: AI coding agents are powerful, and the process around them decides whether that power produces good software.

How AI coding agents work

Assistants inside the editor: GitHub Copilot and Cursor

How they work: they sit inside the developer's code editor, suggest code as they type, answer questions about the codebase, and increasingly can take on multi-step tasks in "agent" modes.

Where they shine: speeding up routine code, explaining unfamiliar code and drafting tests.

Where they stop: the developer is still steering every change, so the results depend on that developer's judgement.

Agents that take a task: Claude Code, OpenAI Codex and similar

How they work: you describe a task, like "add an export button to the invoices screen", and the agent explores the code, makes a plan, edits files, runs the tests and commands, and reports back. Some run in the terminal, some in the cloud, and many can open a change for review.

Where they shine: well-defined tasks in a well-organised codebase with good tests, where the agent can check its own work.

Where they stop: they can be confidently wrong. They need clear instructions, guardrails on what they can touch, and a person who reviews and tests what they produce.

App builders that write the whole thing: Lovable, Bolt, Replit and similar

How they work: you describe an app in plain language and the tool generates a working one, often called "vibe coding".

Where they shine: prototypes, demos and testing an idea with real users in days.

Where they stop: a prototype isn't a production system. Connecting to your real systems, handling edge cases, permissions, data protection, backups and long-term maintenance are still the hard parts, and the research above suggests they don't happen by default.

What AI changes when you commission software

Prototypes are cheaper and faster. It's now realistic to see a clickable, working version of an idea early, and to change direction after seeing it rather than after a long build.

Routine code takes less time. Forms, lists, admin screens and standard integrations are faster to produce, which can shorten projects or let more of the budget go to what's specific to you.

Small changes are quicker. Adding a field, a report or an export is often hours rather than days.

What AI doesn't change

Understanding your business. An agent can write code for a requirement. It can't sit with your operations team and find out that "approved" means something different in finance than it does in the warehouse. Most software that disappoints does so because the requirements were wrong, not because the code was slow to write.

Connecting your real systems. Your CRM, accounting package and the spreadsheet holding it all together each have their own quirks, data and edge cases. Agents can write the connection code. Someone still has to understand the systems, decide how records match, and test against real data.

Testing and review. DORA's finding is the key one: AI amplifies the process it's used in. Code written quickly but never tested properly breaks quickly too.

Security and data protection. Veracode's results show AI-written code needs checking like any other code. That means permission checks on every action, careful handling of personal data, and tools that scan for known vulnerabilities.

Ownership and maintenance. Software needs updates, fixes and improvements after launch, whoever or whatever wrote the first version. You should own the code, and it should be organised so someone else can maintain it.

Questions to ask a builder about AI

  1. Do you use AI coding tools, and for what? A good builder will tell you plainly.
  2. Who reviews AI-written code before it ships? There should always be a person.
  3. How is it tested? Ask about automated tests, and testing with your real examples.
  4. How do you check for security issues? Expect specifics: permission checks, dependency scanning, how personal data is handled.
  5. Does any of our data go to an AI provider, and which one? You should know, and be able to say no.
  6. Who owns the code, and could another developer maintain it? You should, and they should.
  7. What happens after launch? AI doesn't remove the need for fixes and support.

How we use AI coding agents at Lephlo

We're open about this: we build with AI coding agents, because they let us move faster on the routine parts and spend more time on what matters for your business. That means understanding your process, connecting the tools you already use, and getting the details right.

Every change still goes through a person. We define the task clearly, review what the agent produces, run the tests, and check the result against your real examples before anything ships. We use AI providers that don't train on your data, you own the code, and fixes are free during the fix period after launch.

What we sell isn't lines of code. It's software built around how your business works: internal tools, customer portals and integrations that connect the systems you already pay for into one working whole. AI helps us build that faster. It doesn't replace understanding it.

It starts with a free consultation. We scope the first version, give you a fixed price for it, and build it in short steps you can see and try.

Related reading: how to hire a software developer and what an MVP is in software. To size a first version, try the Build Scope Planner, or book a free consultation.

Frequently asked questions

What is an AI coding agent? An AI tool that can carry out a programming task on its own: reading the code, planning, making changes across files, running tests and reporting back for a person to review.

Will AI coding agents make custom software cheaper? They can make routine parts faster, and prototypes much quicker. The parts that make software valuable to your business, like understanding the process, connecting systems, testing and support, still take human time.

Is AI-written code safe? It can be, if it's reviewed and tested like any other code. Research such as Veracode's 2025 report shows it often isn't safe by default, so ask how a builder checks it.

Can I build my own business app with an AI app builder? For a prototype or a simple tool, often yes, and it's a great way to test an idea. For anything that handles money, personal data or connects to your core systems, have it reviewed, tested and maintained properly.

Do I need to know which AI tools my developer uses? You don't need the details, but you should know whether your data is sent to an AI provider, and how AI-written code is reviewed and tested.

Sources