Software teams are shipping AI-written code faster than humans can read it. According to JetBrains' State of CI/CD in 2026 report, 48.8% of surveyed organisations now use AI for at least one task in their delivery pipeline, even though only 8% actually run AI steps inside a build or test. That gap is where the new bottleneck lives.
Coding agents have moved well past autocomplete. They now inspect repositories, rewrite files, execute commands and continue after errors. The result is a flood of AI-generated pull requests that human reviewers struggle to keep up with—while the teams most eager to adopt AI are often the least equipped to validate it.
Where AI actually sits in the pipeline
The JetBrains report is clear: AI still lives mostly around the pipeline, not inside it. Common uses include reviewing code, writing or fixing tests, diagnosing broken builds, maintaining pipeline configs, running quality or security checks that can block a build, helping with releases, and responding to incidents after deployment. Developers reach them through MCP servers and agent skills, hooking into assistants they use elsewhere.
That positioning matters. AI generates inputs and reacts to outputs, but rarely owns the build itself. Meanwhile, the hosting side is moving in the opposite direction: more teams are pulling CI/CD back on-prem or into self-managed clouds—72.8%, the highest share in five years—for control over hardware, networks, data and costs.
Why reviewers are drowning
The harder punch comes from the review side. AI coding agents can run for long stretches without a human. Research from METR found the "task horizon" for frontier agents has roughly doubled every seven months since 2025. Tasks that took humans days or weeks are drifting into agents' reach. That sounds like progress—until someone has to read the diff.
The problems are concrete. Ownership: engineers increasingly own code they did not write. Explainability: when a test passes or a build is green, nobody can fully articulate why. Error severity: bugs that look small in autocomplete become much larger when an agent has refactored six files across a repo.
Our analysis
The 26% productivity lift from the 2026 Management Science study is real, but it does not account for validation time. Most teams have not adjusted review processes, reviewer headcount, or quality gates to match the new volume of submissions. The bottleneck is not generation; it is trust.
Security tooling sits in an awkward middle. Teams use AI for security checks that can block a build, which sounds like progress. In practice, those checks tend to flag obvious issues while missing subtle ones AI agents introduce—like logic changes that subtly alter business rules.
For teams on-prem, the picture is messier. Most on-prem infrastructure was never sized for model inference. Expect a wave of AI gateways sitting beside, not inside, pipelines.
| Who Wins | Who Loses |
|---|---|
| Less experienced developers (high productivity gains from AI) | Senior reviewers drowning in generated PRs |
| Teams with mature review processes | Teams that haven't updated workflows since adopting AI |
| On-prem operators with infrastructure control | Teams relying on hosted AI with data privacy concerns |
| Security teams with strict change controls | Organisations with low AI priority and minimal oversight |
What to watch next
Watch for two things over the next quarter. First, whether any major CI/CD vendor ships native AI review triage—obvious next step, will reshape reviewer workflows fast. Second, watch for the first public postmortem blaming a production incident on an unreviewed AI commit. When it lands, expect the hardening cycle we saw with cloud misconfigs: stricter reviews, mandatory sign-offs, renewed arguments for self-hosted builds.
Key takeaways
- AI is now used by nearly half of CI/CD teams, but the review side has not caught up.
- The bottleneck has shifted from generating code to validating code you did not write.
- On-prem CI/CD is back in fashion, often because teams want tighter control over AI-augmented workflows.
Frequently asked questions
Which CI/CD tools lead adoption right now?
GitHub Actions, GitLab CI and Jenkins, according to JetBrains' report.
Are AI agents writing production code unsupervised?
Not usually. They operate across longer tasks but still require human review, which is where the current bottleneck sits.
Does using AI in the pipeline improve security?
It can flag obvious issues, but it is not a substitute for human review of high-risk changes.
Why are more teams returning to on-prem CI/CD?
According to the JetBrains data, teams cite control over hardware, data, security and cost as the main reasons.