Q2 2026 was the quarter the AI coding assistants stopped being a productivity toy and became a procurement line. The Cursor, the Copilot, the Claude Code, the Cline, the Windsurf, the Cody, the dozen or so competitors. The senior engineering leader is now making the build versus buy decision on the AI coding tooling the same way the senior engineering leader makes the decision on the observability tooling. The decision is no longer about whether to use the AI. The decision is about which AI, at what cost, integrated with what workflow. Here is what the numbers look like, and what the implications are.
What the numbers actually look like
Three categories, in roughly that order of revenue. The first serves as standalone AI coding tool. Cursor, Windsurf, the dedicated desktop and IDE. The revenue has grown roughly 5x year over year. The number of paying seats is in the hundreds of thousands. The pricing has stabilised at roughly 20 to 40 dollars per user per month for the pro tier, with the enterprise tier at 60 to 100. The second acts as IDE integrated AI coding tool. GitHub Copilot, the JetBrains AI Assistant, the Visual Studio Code extensions. The revenue has grown roughly 3x year over year, from a much larger base. The number of paying seats is in the millions. The pricing is bundled with the IDE subscription or with the GitHub seat. The third functions as agentic coding tool. Claude Code, Cline, the dedicated CLI agents. The revenue has grown roughly 10x year over year, from a smaller base. The number of paying seats is in the tens of thousands, but the average revenue per seat is much higher. The agentic tools are selling at 100 to 200 dollars per user per month.
What the implications are
Three categories, in roughly that order of magnitude. The first serves as productivity. The studies are converging on a 20 to 40 percent productivity gain for the senior engineer, a 30 to 60 percent gain for the junior engineer, and a modest gain (10 to 20 percent) for the middle engineer. The middle engineer is being squeezed out of the productivity story. The second acts as quality. The studies are showing a small but real improvement in the defect rate, with the AI assisted code being slightly less buggy than the hand written code. The improvement is real but modest. The third functions as security. The AI generated code has a different security profile. The AI generated code has fewer of the classic vulnerability patterns (the SQL injection, the XSS), because the AI has been trained on the secure coding examples. The AI generated code has more of the new vulnerability patterns (the supply chain risk from the suggested dependency, the logic flaw from the auto completed test, the secret leak from the auto completed example). The security profile of the AI generated code is improving, but the security profile of the new supply chain risks is not yet measured.
What the engineering leader should do
Three moves, in priority order. The first is to consolidate the tooling. The team that has the developer choosing between five AI coding tools has the developer spending more time on the tool choice than on the coding. The team picks one or two, with the integration, with the workflow, with the budget. The second is to measure the impact. The team that measures the AI coding impact (the PR throughput, the time to first commit, the defect rate) has the evidence to justify the spend. The team that does not measure is paying for the AI tooling on faith, and the faith runs out at the next budget cycle. The third is to invest in the security review of the AI generated code. The AI generated code needs the same security review as the hand written code, plus the new supply chain review, plus the new logic review. The security review is what keeps the AI productivity gain from becoming the AI breach.
The bottom line
Consolidate the tooling. Measure the impact. Invest in the security review. The AI coding tool is now a procurement line, not a productivity toy. The engineering leader who treats it as the procurement line gets the productivity gain. The engineering leader who treats it as the productivity toy gets the breach.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
