What AI is already changing in how we build software

Over the past two years, the way we build software has changed faster than at any other point in the industry’s history. AI coding agents are no longer a novelty: they write production code, at large companies, at scale. Nobody knows exactly what our craft will look like in five years, but one thing is already certain: every piece of software designed today needs to be built for that moving target from day one.

AI agents have become our new recruits

A well-directed coding agent behaves like a very fast junior colleague: we hand it our domain knowledge, we frame its work, we review what it produces. The difference from a human isn’t (yet) judgment. It’s availability and execution speed.

The numbers are starting to back up what many teams already feel empirically. An internal study run by Microsoft in early 2026, covering tens of thousands of engineers who adopted Claude Code and GitHub Copilot CLI, measured a 24% increase in pull requests merged per engineer per day compared to teams not using the tools. Gartner, separately, reports that 90% of surveyed engineering leaders see a productivity improvement, for a net average gain of 19.3%.

These gains are neither automatic nor guaranteed: other studies show swings from a 20% slowdown to a 2x speedup, depending on the language, the quality of the existing codebase, and how well the team directs its agents. Productivity doesn’t come from the tool alone. It comes from the discipline built around it.

The security paradox

Published vulnerabilities are exploding. 48,174 CVEs were published in 2025, a 20.6% increase over 2024, which itself was already up 38% on 2023. According to Mandiant’s M-Trends 2026 report, the average time between a vulnerability’s disclosure and its exploitation is now negative: exploitation begins, on average, seven days before a patch is even released.

In this context, AI cuts both ways. It widens the attack surface (more code generated, faster, sometimes with less human review), but it also opens new lines of defense. So-called “agentic” security platforms can now triage and qualify an alert in roughly two minutes, versus several hours for a human analyst, with a claimed noise reduction near 99%. In practice: an agent can monitor a company’s infrastructure overnight, respond to an intrusion attempt according to defined rules, then summarize in the morning what it observed and the actions to take to prevent it from happening again. That’s one of the most concrete shifts agentic AI brings to small companies that can’t afford round-the-clock security on-call.

But that same context makes it urgent to add artificial intelligence to software already in production, and that’s where things get harder: a large share of the software still running inside companies simply wasn’t designed to host an LLM SDK, an agent, or even a basic completion API. Wiring it in properly usually means a real overhaul, not just a plugin.

Don’t adopt a standard just because it’s trendy

The standards that define how an AI agent accesses tools or context are evolving at an unprecedented pace, and not everything that ships new deserves to be adopted right away.

The clearest example is the Model Context Protocol (MCP), pushed by Anthropic as the standard way for AI agents to access tools. In March 2026, at the Ask 2026 conference, Denis Yarats, Perplexity’s CTO, announced that his company was dropping MCP internally for critical workloads, in favor of plain REST APIs and CLIs:

“Just loading MCP’s tool schemas could consume up to 72% of the available context window, before the agent had processed a single user request.” — Denis Yarats, CTO of Perplexity, Ask 2026 conference

Perplexity hasn’t abandoned MCP everywhere: it still supports it for use cases like real-time search from tools such as Claude Desktop, but sidelined it wherever reliability and cost matter most.

The same pattern shows up with the formats used to give an agent business context (CLAUDE.md, AGENTS.md, packaged skills like SKILL.md): every vendor first pushed its own format, forcing teams to duplicate or adapt the same documentation for each agent in use. The market has since partly settled. AGENTS.md is now read by roughly thirty different agents, and the SKILL.md format Anthropic opened up in late 2025 is already supported by more than thirty competing tools, including Google’s Gemini CLI and AWS’s Kiro. But what became a shared standard today took less than a year to settle, and nothing guarantees the next format won’t start from scratch again. Betting too early on a closed format remains a real risk.

Designing for a future we don’t fully know yet

Nobody can predict exactly what software development will look like in five years. What we can decide today, though, is how we design: modular architectures, interfaces that don’t depend on a single vendor or protocol, documentation and business context that stay readable and reusable even if the format carrying them changes once or twice more.

That conviction shapes how we build at Pabiosoft, for our own products as much as for our clients’: start from the real problem, not from the newest standard.