AI agents write more code; review still sets how much software ships

Engineering leaders have spent two years measuring how fast AI tools write code. A large firm-level study by Fiona Chen and James Stratton, current version dated 4 August 2026, asks a different question: when firms adopt AI coding assistants and agents, does more code become more software? Using roughly 300 million work events across 718 firms, they find agents raise coding volume substantially, while resolved Jira issues and epics do not rise in step. Review absorbs the gain.

Context: assistants versus agents in firm data

The paper, Artificial Intelligence in the Firm: Bottlenecks in Software Production, uses staggered difference-in-differences on firm adoption timing. Data run from January 2021 through March 2026 and cover coding activity, issue tracking and related signals from an engineering analytics platform.

AI agents (semi-autonomous multi-step tools) are associated with about +30% lines of code, +20% commits and +23% pull requests. AI assistants (inline and chat suggestions) show smaller effects: about +12% LOC, +9% commits and +5% PRs, with only commits clearly significant in the abstract-level summary the authors emphasise.

On output measured as resolved Jira issues and epics, effects are small and statistically insignificant. For agents, the authors report that estimates rule out an increase larger than about 12% of the baseline mean—well below the coding productivity gain. They also check that average predicted issue size does not rise in a way that would hide true output growth.

Employment effects are precise zeros on overall headcount for agents (ruling out a decline greater than about 2.9% in their reporting), and a noisier zero for engineering employment. The paper does not support a simple "bloodbath" narrative from this adoption window.

Analysis: the review bottleneck

The authors' mechanism evidence focuses on code review after agent adoption:

• Average time to review a pull request +49%
• Share of pull requests with changes requested nearly doubles
• Comments per pull request +35%
• Share of workers doing review +14%

By March 2026, about 80% of firms in the sample used some AI review tool, yet AI wrote only 23.3% of review comments and touched 10.8% of pull requests. Humans remain central. Qualitative interviews in the paper describe senior reviewers as bandwidth-constrained and, after outages linked to AI-generated commits, extra approval rules that thicken the queue further.

Their model treats software production as complementary coding and review stages. AI can raise coding productivity and change draft quality; both raise demand for review. Without review capacity, good software that ships rises less than coding activity.

That organisational finding sits beside security guidance that already treats agent autonomy as something to oversee, not only to accelerate. The UK NCSC's interim note on managing the cyber risk of agentic AI (20 August 2026) stresses proportionate autonomy, sandboxing, observability and the ability to halt agents—controls that also consume human attention when agent output volume rises.

Measure the queue, not only the generator

The practical measurement change is to put review queue depth and time-to-first-review next to agent adoption metrics. If lines of code and pull requests rise while resolved issues stay flat, the organisation is accumulating inventory, not shipping. Chen and Stratton's DiD design on staggered adoption timing makes that reading more credible than a simple before-and-after chart at one firm.

AI review tools were already widespread by March 2026 in the study sample, yet they wrote only a minority of comments and touched a minority of pull requests. Buying another review bot will not automatically clear a human bottleneck. Use review tools to triage and summarise; keep ownership of merge decisions with people who understand the product risk.

Employment findings in the paper are precise zeros that rule out large headcount cuts in the window studied. That is not a forecast for every sector; it is evidence against a simple story that agent coding immediately shrinks engineering teams. Leaders should separate "more code to review" from "we need fewer reviewers."

What it means for engineering and security leaders

Measure review capacity and change-request rates, not only generation speed. Dashboards that celebrate LOC or PR count without merge time and rework will mis-rank tools.

Staff the bottleneck deliberately. The study shows firms expanding the share of people who review, without shrinking the share who write code. Plan for that mix.

Do not treat AI review as a full substitute yet. High firm adoption of AI review tools coexists with low AI share of comments. Keep humans accountable for merge decisions on critical paths.

Separate assistants from agents in ROI models. Magnitudes differ. An assistant pilot and an agent rollout are not the same investment case.

Link volume to oversight. More autonomous generation without matching review and monitoring is both a delivery risk and a control risk.

Practical takeaways for this week

• Add review time, change-request rate and comments per PR to the same scorecard as agent adoption.
• Cap parallel agent-opened PRs per reviewer until review SLAs recover.
• Tag AI-authored PRs so review policy can differ without blocking all automation.
• Revisit whether AI review tools are actually commenting on your PRs, or only licensed.
• Align agent autonomy levels with NCSC-style oversight for higher-risk repositories.
• When reporting "productivity", pair coding volume with issues/epics resolved for the same window.

Seeing volume without mistaking it for output

SpanDock is a self-hosted observability hub for AI coding tools: sessions, tool calls, model calls, tokens and cost appear on a local dashboard (getting started). Through the model proxy and budgets, records show which model answered and what it cost. That visibility shows how session volume and cost change, which you can set beside your own delivery metrics such as resolved issues. Core session and cost telemetry is available across plans; budgets and SpanDock Mind are Standard and up. See also the harness sets the bill and OpenTelemetry for AI coding tools.