Out of the Cradle

In early 2024, a tech lead I worked with—a sharp engineer whose judgment I trusted—gave me his verdict on AI-assisted development. The technology, he said, was still in its infancy. We could rely on it, perhaps, to write unit tests. Everything else belonged to people.

I didn't argue. I wasn't sure he was right, but I was too busy stamping out sparks before they could grow into fires to stop and debate the point.

The sentence has stayed with me because it sounds like prudence. I hear it now from prospective clients, nearly word for word, usually after the coffee and before any talk of budgets: "AI-assisted development is still in its infancy." No one says it unkindly. They say it the way you might decline a treatment your doctor has only just read about: politely, sensibly, intending to revisit the question someday.

The trouble is that someday has already come and gone. The infant has climbed out of the cradle and is running laps around the old way of building software, and most of the room hasn't noticed.

Let me give the skeptics their due first, because their case is better than many enthusiasts admit.

In October, Stack Overflow released its 2026 survey of more than thirty thousand developers. More than four in five use AI tools. Yet only about half trust them when they can easily check the answers, and fewer than seven in a hundred would trust them with an important decision.¹ Google's DORA researchers, in a report this year on the return from AI adoption, warn that productivity usually dips before it rises. Someone, after all, has to verify all that machine-generated code.² And a widely cited controlled experiment, run by the nonprofit METR in the first half of 2025, found something startling. Experienced developers took nineteen per cent longer with AI tools, even as they believed they had worked faster.³

Clients who cite these findings aren't being stubborn. They're being well read.

In February 2026, METR tried to run its experiment again. It failed. The way it failed is the most telling result of all.

A growing share of developers refused to take part, unwilling to give up AI for half their work. Among those who did sign up, thirty to fifty per cent admitted holding back tasks they refused to attempt without AI. One participant likened it to walking across a city after growing used to being driven. METR concluded that its new estimate was probably a floor, that developers were likely more sped up than a year earlier, and it stamped its earlier study—the one skeptics still quote—as out of date.⁴

The control group was dissolving. Asked to set the tool down for the sake of science, many developers simply wouldn't.

There is a reason the ground moved so fast. METR also measures how big a job an AI system can finish on its own: tasks that take a skilled human minutes, then hours. For the six years it tracked, that length doubled roughly every seven months.⁵

Apply that pace to my tech lead's verdict. Early 2024 to today is four or five doublings. In human terms, that is a few years. In AI terms, it is several lifetimes.

To keep insisting that AI isn't ready for the fast-moving worlds of information technology and security is a little like bringing a knife to a gunfight. Not because the knife is a bad tool, but because it is the one we know, and learning the new one feels like abandoning the skill it took us decades to earn. I understand the feeling; I have twenty-five years of knives. But the landscape does not pause for our comfort, and the people we serve—clients, users, the public whose data passes through our systems—deserve defenders equipped for the world as it is.

For most of my career, building a serious software product meant assembling a team: one or two product managers, one or two quality-assurance engineers writing automated tests, two front-end engineers, two back-end engineers. Six to eight capable, well-meaning people.

Fred Brooks, in The Mythical Man-Month, explained why even good teams move slowly: the lines of communication among them grow by the formula n(n − 1)/2.⁶ Six people share fifteen channels. Eight share twenty-eight. Each one is a meeting, a misread ticket, a requirement that changed somewhere between two desks. It is no one's fault. It is arithmetic.

Today, much of that arithmetic collapses. Specification, architecture, code, tests, and documentation pass through a single mind, with AI doing much of the drafting and the human doing the judging. In my own practice, features that once took a full team about six months I have delivered in under a month, with more complete documentation and more automated tests than the team versions usually had.

The machine is not infallible; the surveys are right that its work must be checked. But checking is precisely what automated tests do. In this way of working, a thorough test suite isn't a luxury bolted on if the budget survives. It is the instrument of trust, written early and run constantly. The method forces the discipline.

The same logic reaches a job that once demanded its own hire. Federal guidance has long expected proposed changes to be reviewed for their security and privacy implications before approval, and reviewed again after implementation.⁷ That used to mean a compliance specialist reading every request and every release, a notorious bottleneck. Now an AI agent can screen each request and draft a written opinion on what it touches, which rules apply, and where the risks lie, then check what shipped against what was approved. A human still makes the call, but from a considered draft rather than a blank page.

I won't pretend this holds everywhere. In vast, mature codebases thick with unwritten rules, the gains are harder won, and METR's original finding remains a fair warning. Judgment—knowing what to build, and what to refuse to build—stays stubbornly human.

There is also a human cost I don't want to hurry past. Those teams are made of men and women with families and mortgages and hard-earned skill. Saying their work can be done differently is not saying it was done poorly. DORA's researchers themselves urge organizations to reinvest the capacity AI frees rather than cut staff, since experienced staff carry knowledge no tool replaces.² The skill doesn't vanish. It changes shape.

I could try to win these conversations with more studies and sharper arguments. But I was raised to believe that honesty is a form of love, and honesty here means admitting what I cannot prove from across a table: that what works in my practice will work in yours. A cautious client deserves more than my enthusiasm. So I've stopped asking anyone to take my word for it.

Instead, I offer a small, bounded pilot: one well-defined feature, delivered with its tests, its documentation, and its drafted compliance opinions, measured against the client's own past timelines. If it falls short, they have lost little. If it does what I believe it will, they will know something their competitors may not yet.

And if I could return to that conversation in early 2024, I would set the sparks aside long enough to make one request of my tech lead. Not an argument, just an invitation: look again in six months, and again six months after that.

The child left the cradle a while ago. It's worth turning around to watch it run.