The landscape · Software engineering
Software engineering: what AI is really doing
Brief me in 2 minutes
AI in Software engineering.
Coding agents kept shipping code end to end, and the bigger story this stretch is what that did to the money and the trust: SpaceX bought the category's biggest independent coding company outright for $60 billion, developers now tell surveyors that AI writes half their code, and a bug in how four major agents verify plugin pins turned every marketplace-trusted skill into a possible way in. Two of those four vendors still have not patched it, and the productivity gains are being spent on review, not saved.
The game: we show you 6 things happening. You call each one real now, early or mostly hype. Then the receipts.
Shift 1 of 6
SpaceX buys the leading AI coding startup outright, for $60 billion
Real now
This is a closed, SEC-filed acquisition with shares already issued and a subsidiary already renamed, not a funding rumor.
How it works. SpaceX completed an all-stock acquisition of Anysphere, the maker of Cursor, on August 14, 2026, converting Cursor's shares into roughly 391 million SpaceX shares and folding the coding-agent maker into a new SpaceXAI division. Cursor's closest independent rival, Cognition, responded within weeks by pushing its own valuation talks from $26 billion to a reported $47 billion.
Overstated: Cursor's product does not get better because Elon Musk owns it, this is a cap-table event; Morgan Stanley's $13 billion SpaceX-revenue-by-2027 projection tied to the deal is an analyst estimate, not something that has happened yet.
Shift 2 of 6
Coding tools stop suggesting and start shipping
Real now
Hundreds of thousands of developers use these agents daily and enterprises pay for it; that is production usage, not a demo.
How it works. Agentic coding tools now take a ticket, spin up a dev environment or sandbox, write the code, run the tests, fix what breaks, and open a pull request without a human writing each intermediate prompt. Factory's Droids and Replit's Agent 3 both work this way: a coordinator breaks the task down, specialist sub-agents execute, and a person is looped in only to review the result.
Overstated: 'Autonomous' still means one ticket at a time under a human's eventual sign-off; nobody has an agent running a whole roadmap unsupervised, and Replit's own agent needed hours of self-testing to get one task right.
Shift 3 of 6
A review layer grows up around the flood of AI-written code
Real now
Two million paid reviews a week for 17,000 customers is production infrastructure, not a pilot program.
How it works. As agents write more code than any human team can read line by line, a separate category of tools has emerged to review it: CodeRabbit and Greptile ingest a whole codebase rather than just a diff, flag security and configuration issues, and are bought by security and platform teams as infrastructure, not a nice-to-have.
Shift 4 of 6
A pinned-commit bypass turns trusted plugin marketplaces into a supply chain backdoor
Real now
The bug is disclosed with working exploits against all four agents, and two vendors still have not patched it months later; that is an active exposure, not a hypothetical one.
How it works. Security researchers at AIR found that Claude Code, Codex, GitHub Copilot and Gemini CLI all check out a plugin's pinned commit without verifying the checkout actually landed there, so an attacker can swap in malicious code while the pin still looks intact and reach into a company's systems through a plugin a team already reviewed and trusted. AIR found the bug in May and disclosed it to all four vendors in June; Anthropic and OpenAI shipped patches, Microsoft has not, and Google deprecated Gemini CLI instead of fixing it.
Overstated: This is not a theoretical marketplace risk: AIR says it has already demonstrated the technique working at scale, once spreading a malicious plugin to thousands of agents and once finding hundreds of hijacked skills already in active use.
Shift 5 of 6
AI writes half the code now, and review is eating the time it saved
Real now
This is self-reported behavior from developers already shipping AI-written code, with a matched year-over-year comparison, not a lab benchmark.
How it works. BairesDev's Q3 2026 survey of 705 developers found 42% now say AI writes at least half their code, up from 12% a year earlier, and the time developers save coding rose from about 7 hours a week to 13. But 67% say they spend more time reviewing AI output than a year ago and 52% spend more time debugging AI-introduced problems, so the hours saved are being spent elsewhere in the same pipeline.
Overstated: The 13-hours-saved headline hides that those hours did not come back: developers are pouring them into review and debugging instead, so the net time saved for the median team is closer to nothing than the topline number suggests.
Shift 6 of 6
The entry-level rung is being sawed off
Real now
The hiring and posting numbers are already in the record for 2022 through 2026; this already happened, it isn't a forecast.
How it works. Entry-level software engineering job postings and hiring have both dropped sharply since 2022 as agents absorb the routine CRUD and boilerplate work juniors used to cut their teeth on, while senior and specialist roles keep growing. The skill bar for a hireable junior now looks like what used to be expected of a mid-level engineer.
Overstated: 'Juniors are finished' overstates it: overall software engineering postings are still growing and the cut is concentrated in routine roles, not all entry-level engineering.
The scary part
What happens to jobs in Software engineering
What AI is already taking:
- Writing the first draft of most production code at AI-native companies VentureBeat ↗
- First-pass pull request review before a human ever looks at it TechFundingNews ↗
- Routine CRUD and boilerplate work that used to be junior engineers' training ground danilchenko.dev ↗
- End-to-end feature delivery: coding, testing, documentation and deployment Enterprise DNA ↗
What stays human:
Deciding what to build, and verifying an agent's output before it ships, stays human: BairesDev's own Q3 survey found developers spending more time reviewing and debugging AI output than a year ago, not less. Judgment about system design and when to trust an agent doesn't come out of a training run.
Get better · 15 minutes
The ability to read and verify someone else's, or something else's, code fast and catch what's subtly wrong, rather than the ability to write more of it yourself.
Try this this week:
Open Cursor or Claude Code on a real repo, ask it to fix one small bug, then spend the rest of the fifteen minutes doing nothing but reviewing the diff against Veracode's weak categories: injection, XSS, auth, log handling. Write down what you would have merged without checking.
Your move
The IDE and the general-purpose autonomous agent are no longer separate markets you can bootstrap into, SpaceX now owns Cursor outright and Cognition is racing to avoid being next. The open lane is still the unglamorous layer nobody wants to build: verification and security review for AI-authored diffs and the plugins agents pull in, which CodeRabbit and Greptile are already turning into venture-scale businesses because someone has to gate the flood.
Watch the deal structure as much as the number: Nvidia's Poolside license was explicitly built to avoid being called an acquisition, which is how giants now buy AI-model access without the scrutiny of owning the company outright. The red flag is still any pitch quoting an 'annualized' run-rate off one good month instead of trailing revenue.
This quarter, run one real pull request through an AI reviewer like CodeRabbit or Greptile alongside your normal human review, and log every finding the tool caught that the human missed, and vice versa. Then check whether any agent you run pulls in marketplace plugins, and confirm you have actually verified the pinned commit lands where it says it does, not just that a pin exists.
The valuable skill now is reading and pressure-testing an agent's output against a security checklist, not typing more code. Start this week: take Veracode's failure categories (injection, XSS, auth, log handling) and manually audit one AI-generated pull request against each of them.
What's actually changing
- 1
SpaceX buys the leading AI coding startup outright, for $60 billion
How it works. SpaceX completed an all-stock acquisition of Anysphere, the maker of Cursor, on August 14, 2026, converting Cursor's shares into roughly 391 million SpaceX shares and folding the coding-agent maker into a new SpaceXAI division. Cursor's closest independent rival, Cognition, responded within weeks by pushing its own valuation talks from $26 billion to a reported $47 billion.
Why it matters. The category's most valuable coding-agent company no longer answers to developers or even its own board, it answers to a rocket company, and the price resets what an AI coding business can be worth on an acquirer's balance sheet rather than the public market.
What's overstatedCursor's product does not get better because Elon Musk owns it, this is a cap-table event; Morgan Stanley's $13 billion SpaceX-revenue-by-2027 projection tied to the deal is an analyst estimate, not something that has happened yet.
SpaceXAnysphere (Cursor)Cognition
3 receipts
- SpaceX agreed to buy Cursor for $60 billion in an all-stock deal.
SpaceX on Tuesday announced it entered a formal agreement to buy the artificial intelligence startup Cursor for $60 billion worth of stock, a hotly anticipated deal.
CNBC, 16 June 2026 ↗ - The deal closed, issuing about 391 million SpaceX Class A shares, making it the largest startup acquisition on record.
the historic deal resulted in the issuance of approximately 391 million SpaceX Class A shares and is widely considered the largest startup acquisition on record
Yahoo Finance, 14 Aug 2026 ↗ - Cognition was nearing a $1 billion round at a $47 billion valuation weeks after the Cursor deal closed, up from $26 billion three months earlier.
Cognition is nearing a roughly $1 billion round at a $47 billion valuation, Bloomberg reports, up from $26 billion just three months ago.
TechFundingNews, 2 Sept 2026 ↗
- SpaceX agreed to buy Cursor for $60 billion in an all-stock deal.
- 2
Coding tools stop suggesting and start shipping
How it works. Agentic coding tools now take a ticket, spin up a dev environment or sandbox, write the code, run the tests, fix what breaks, and open a pull request without a human writing each intermediate prompt. Factory's Droids and Replit's Agent 3 both work this way: a coordinator breaks the task down, specialist sub-agents execute, and a person is looped in only to review the result.
Why it matters. Routine engineering work that used to take a day now takes an agent-run hour, but the human's job shifts from typing to supervising a stream of diffs, which is a different and less-trained skill.
What's overstated'Autonomous' still means one ticket at a time under a human's eventual sign-off; nobody has an agent running a whole roadmap unsupervised, and Replit's own agent needed hours of self-testing to get one task right.
Factory AIReplitCognitionGitHub
3 receipts
- Factory's Droids handle the entire dev workflow end to end for enterprise teams.
The company's platform, called Droids, handles the full software development workflow — writing code, running tests, reviewing pull requests, generating documentation, and managing deployment.
Enterprise DNA, 21 Apr 2026 ↗ - Replit's Agent 3 can run unsupervised for hours, testing and fixing its own work.
It could run for hours independently, self-testing, and fixing issues as they arose. At the time, it was the most autonomous vibe-coding agent available.
Replit, 11 Mar 2026 ↗ - Cognition's Devin was built to automate coding tasks completely, not just assist with them.
Cognition was one of the first AI startups to launch a fully fledged AI coding agent, Devin, which didn't just help with tasks, but also promised to automate them completely.
TechCrunch, 14 July 2025 ↗
- Factory's Droids handle the entire dev workflow end to end for enterprise teams.
- 3
A review layer grows up around the flood of AI-written code
How it works. As agents write more code than any human team can read line by line, a separate category of tools has emerged to review it: CodeRabbit and Greptile ingest a whole codebase rather than just a diff, flag security and configuration issues, and are bought by security and platform teams as infrastructure, not a nice-to-have.
Why it matters. The review tool, not the code-generation tool, is becoming the actual control point in the pipeline, and it is being funded like core infrastructure rather than a plugin.
CodeRabbitGreptile
2 receipts
- CodeRabbit runs more than two million code reviews a week for over 17,000 paying customers.
CodeRabbit now runs more than two million code reviews a week for over 17,000 customers
TechFundingNews, 13 Aug 2026 ↗ - Greptile reads and interprets an entire codebase to give context-aware review beyond syntax checking.
an AI-powered tool that automates code review
TechFundingNews, 21 July 2025 ↗
- CodeRabbit runs more than two million code reviews a week for over 17,000 paying customers.
- 4
A pinned-commit bypass turns trusted plugin marketplaces into a supply chain backdoor
How it works. Security researchers at AIR found that Claude Code, Codex, GitHub Copilot and Gemini CLI all check out a plugin's pinned commit without verifying the checkout actually landed there, so an attacker can swap in malicious code while the pin still looks intact and reach into a company's systems through a plugin a team already reviewed and trusted. AIR found the bug in May and disclosed it to all four vendors in June; Anthropic and OpenAI shipped patches, Microsoft has not, and Google deprecated Gemini CLI instead of fixing it.
Why it matters. Enterprises adopted agent plugin marketplaces on the promise that pinning a commit hash made a reviewed dependency safe; this bug means that promise never held for four of the biggest agents at once, and the two unpatched ones stay exposed indefinitely.
What's overstatedThis is not a theoretical marketplace risk: AIR says it has already demonstrated the technique working at scale, once spreading a malicious plugin to thousands of agents and once finding hundreds of hijacked skills already in active use.
AIRAnthropicOpenAIGoogleMicrosoft
3 receipts
- Claude Code, Codex, GitHub Copilot and Gemini CLI all share the same zero-click RCE vulnerability, letting an attacker reach a company's systems the way the employee running the agent could.
Claude Code, Codex, GitHub Copilot and Gemini CLI, all share the same zero-click RCE vulnerability, one that could give an attacker the same reach into a company's systems and data as the employee running the agent
Help Net Security, 18 Sept 2026 ↗ - Microsoft has not patched Copilot for the bug, despite Copilot's use across nearly all of the Fortune 500.
Almost 90 percent of Fortune 500 companies use Copilot, according to Microsoft, which also happens to be one of the two that didn't ship a patch for the flaw.
The Register, 17 Sept 2026 ↗ - Google deprecated Gemini CLI rather than patch it, leaving every existing install exposed.
Google has gone further in the other direction, deprecating Gemini CLI altogether rather than patching it, which means every existing install stays exposed indefinitely.
Help Net Security, 18 Sept 2026 ↗
- Claude Code, Codex, GitHub Copilot and Gemini CLI all share the same zero-click RCE vulnerability, letting an attacker reach a company's systems the way the employee running the agent could.
- 5
AI writes half the code now, and review is eating the time it saved
How it works. BairesDev's Q3 2026 survey of 705 developers found 42% now say AI writes at least half their code, up from 12% a year earlier, and the time developers save coding rose from about 7 hours a week to 13. But 67% say they spend more time reviewing AI output than a year ago and 52% spend more time debugging AI-introduced problems, so the hours saved are being spent elsewhere in the same pipeline.
Why it matters. The 'AI makes you far faster' pitch quietly became 'AI moves the work from writing to reviewing,' which is a real shift in what engineers do all day, but not the clean productivity multiple companies are budgeting for.
What's overstatedThe 13-hours-saved headline hides that those hours did not come back: developers are pouring them into review and debugging instead, so the net time saved for the median team is closer to nothing than the topline number suggests.
BairesDev
3 receipts
- 42% of developers now report AI generating at least half their code, up from 12% a year before, across a 705-developer, 41-CTO survey.
BairesDev's Q3 2026 Dev Barometer — 705 developers across 60+ countries plus 41 enterprise CTOs — found 42% report AI generating at least half their code, up from 12% in Q3 2025.
AI Weekly, 15 Sept 2026 ↗ - Time saved on coding rose from 7 to 13 hours a week, but more than two thirds of developers spend more time reviewing AI output than a year ago.
Time saved on coding jumped from ~7 to 13 hours weekly, but 67% spend more time reviewing AI output and 52% more time debugging AI-introduced problems.
AI Weekly, 15 Sept 2026 ↗ - The survey's author says shipping accountability still sits with one engineer, now for far more AI-written code than before.
In Q3 2025, 12% of developers said AI wrote half their code. Today it's 42%, and the decision to ship it still sits with one engineer, for far more code than it used to.
WebProNews, 15 Sept 2026 ↗
- 42% of developers now report AI generating at least half their code, up from 12% a year before, across a 705-developer, 41-CTO survey.
- 6
The entry-level rung is being sawed off
How it works. Entry-level software engineering job postings and hiring have both dropped sharply since 2022 as agents absorb the routine CRUD and boilerplate work juniors used to cut their teeth on, while senior and specialist roles keep growing. The skill bar for a hireable junior now looks like what used to be expected of a mid-level engineer.
Why it matters. The pipeline that turns juniors into seniors is thinning out at the exact moment the industry needs more people who can supervise and verify agent output, a shortage that shows up five years from now, not now.
What's overstated'Juniors are finished' overstates it: overall software engineering postings are still growing and the cut is concentrated in routine roles, not all entry-level engineering.
2 receipts
- Entry-level software engineering postings dropped 67% between 2022 and 2024, with AI tools handling most of the routine work juniors used to do.
entry-level software engineering postings dropped 67% between 2022 and 2024
danilchenko.dev, 12 Apr 2026 ↗ - AI tools now handle most of the routine coding work that used to be assigned to junior engineers.
AI coding tools reportedly handle 60-80% of this now.
danilchenko.dev, 12 Apr 2026 ↗
- Entry-level software engineering postings dropped 67% between 2022 and 2024, with AI tools handling most of the routine work juniors used to do.
Who's doing it
8 companies to know, 7 with a round we can source. Newest first where dated.
Search these companies in the startup database ↗ · Explore all research tools
Cognition (Devin / Windsurf)autonomous coding agent / AI IDE
Maker of Devin, an autonomous software engineering agent, merged with the Windsurf AI IDE it acquired in 2025 to combine agent and editor into one product.
Latest · 2 Sept 2026Cognition was nearing a $1 billion round at a $47 billion valuation in September 2026, up from $26 billion three months earlier, as Cursor's acquisition by SpaceX pulled investor demand toward its closest rival. TechFundingNews ↗
Poolsidefoundation models for coding
Trains foundation models purpose-built for agentic coding, licensed to enterprises and other AI labs rather than sold as its own IDE or agent product.
Latest · 21 Aug 2026Nvidia agreed to pay Poolside $6 billion to license its Model Factory software and hire around 109 of its employees, plus invest $1 billion at a $12 billion valuation, without acquiring the company. PYMNTS ↗
$500M Series B, 14 June 2026 source ↗
Cursor (Anysphere)AI coding IDE / agent
AI-native code editor and agent that writes, edits and ships code inside a developer's existing codebase; acquired outright by SpaceX in 2026 and now run as a subsidiary inside SpaceX's AI division.
Latest · 14 Aug 2026SpaceX finalized its all-stock, $60 billion acquisition of Cursor's parent Anysphere on August 14, 2026, folding Cursor into SpaceX's AI division. Yahoo Finance ↗
$900M growth round, 5 June 2025 source ↗
CodeRabbitAI code review
AI reviewer that reads full pull requests and codebases to flag bugs, security issues and misconfigurations before merge.
Latest · 13 Aug 2026CodeRabbit runs more than two million code reviews a week for over 17,000 customers, including Nvidia, BMW and Adyen. TechFundingNews ↗
$143M Series C, 13 Aug 2026 source ↗
LovableAI app builder / vibe coding
Prompt-to-app builder that lets non-engineers and startups generate full-stack web apps from a description.
Latest · 12 Aug 2026Lovable hit $500 million in annualized run-rate revenue in June 2026. TechCrunch ↗
$400M Series C, 12 Aug 2026 source ↗
Factory AIenterprise coding agents
Builds 'Droids', a coordinator agent plus specialist sub-agents that write code, run tests, review pull requests, write docs and manage deployment for enterprise engineering teams.
Latest · 21 Apr 2026Hundreds of thousands of developers at companies including Nvidia, Adobe, EY and Adyen use Factory's Droids daily. Enterprise DNA ↗
$150M Series C, 21 Apr 2026 source ↗
ReplitAI app-building agent
Browser-based platform where Agent 3 builds, tests and deploys full applications from natural-language prompts, priced on usage-based agent consumption.
Latest · 11 Mar 2026Replit says it is on track to hit $1 billion in run-rate revenue by the end of 2026. Replit ↗
$400M growth round, 11 Mar 2026 source ↗
GreptileAI code review
Full-codebase-aware AI reviewer that comments on pull requests with context beyond syntax, also used to onboard junior engineers.
Latest · 21 July 2025Greptile automates code review by reading and interpreting an entire codebase rather than just the diff. TechFundingNews ↗
$30M Series A, 21 July 2025 source ↗
Your move
Our read, built on the receipts above.
The IDE and the general-purpose autonomous agent are no longer separate markets you can bootstrap into, SpaceX now owns Cursor outright and Cognition is racing to avoid being next. The open lane is still the unglamorous layer nobody wants to build: verification and security review for AI-authored diffs and the plugins agents pull in, which CodeRabbit and Greptile are already turning into venture-scale businesses because someone has to gate the flood.
Watch the deal structure as much as the number: Nvidia's Poolside license was explicitly built to avoid being called an acquisition, which is how giants now buy AI-model access without the scrutiny of owning the company outright. The red flag is still any pitch quoting an 'annualized' run-rate off one good month instead of trailing revenue.
This quarter, run one real pull request through an AI reviewer like CodeRabbit or Greptile alongside your normal human review, and log every finding the tool caught that the human missed, and vice versa. Then check whether any agent you run pulls in marketplace plugins, and confirm you have actually verified the pinned commit lands where it says it does, not just that a pin exists.
The valuable skill now is reading and pressure-testing an agent's output against a security checklist, not typing more code. Start this week: take Veracode's failure categories (injection, XSS, auth, log handling) and manually audit one AI-generated pull request against each of them.
What's next
- Oct 2026 Whether Cognition's rumored $1 billion round at a $47 billion valuation actually closes techfundingnews.com ↗
- Dec 2026 Replit's $1B run-rate revenue target replit.com ↗
- Oct 2026 Whether Microsoft ships a Copilot patch for the pinned-commit RCE bug it has not yet fixed theregister.com ↗
Other industries
- FinanceBanks move agentic AI from chatbots to running back-office and dealmaking work
- HealthcareAmbient scribes go from pilot project to clinical infrastructure
- LegalLegal AI vendors go from research assistant to agent that produces the deliverable
- Real estateLeasing and resident calls move to voice AI agents that never sleep
- Sales and marketingCustomer support agents now get paid per resolved ticket, not per seat
- Jobs, HR and recruitingAI runs the first-round interview, not just the resume filter
- InsuranceClaims move from adjuster-first to AI-first, humans supervise the exceptions
- CybersecurityAutonomous AI agents take over penetration testing and vulnerability hunting
- Consulting and accountingAI-written client reports become a recurring, public Big Four embarrassment
- Retail and e-commerceShopping agents get a checkout button, and Amazon spends 2026 deciding who's allowed to press it
- EducationNYC and LA ban AI for students, not for teachers
- Media and creativeAI video splits into model labs that train and aggregators that resell
- Manufacturing and roboticsHumanoid robots move from demo livestreams to paid warehouse shifts
- Transport and robotaxisRobotaxis go from demo to metered fare across a dozen-plus US cities
- Energy and data-centre powerGrid rules get rewritten mid-buildout, state by state
- GovernmentGSA turns AI adoption into a government-wide subscription, then flips 'free' to metered
- Agriculture and foodAutonomous tractor fleets learn to run the tools behind them, not just the wheel