Stack Overflow Survey Exposes the AI Code Review Gap

Stack Overflow’s 2025 Developer Survey, covered by ADTmag on January 20, 2026, found developer trust in AI generated code fell from 40 percent to 29 percent even as adoption reached 84 percent. That gap between how much developers use AI generated code and how much they trust it is not a confidence problem a better rollout plan fixes. It is a missing control, and the fix is a provenance tagged human review gate that catches an AI authored pull request before it reaches a production system, not after. Forty six percent of developers now say they actively distrust the code their own tools produce, and they are merging it anyway.

That last fact deserves more attention than a headline usually gives it. A developer who distrusts a tool but keeps using it has not solved a trust problem. The developer has outsourced the problem to whoever reviews the pull request next, and the research on what that reviewer actually does with it is not encouraging. A January 2026 study of more than 18,000 merged pull requests across 2,100 open source repositories found that 80 percent of AI co authored contributions from outside collaborators merged with no explicit review at all, and that 86.9 percent of the repositories studied had no written policy on AI coding agent use at all. The review step most engineering teams assume is happening is, in most of the repositories studied, simply not occurring.

why did developer trust in ai code fall to 29 percent

Trust fell because the failure mode is specific, not vague. Sixty six percent of developers in the Stack Overflow survey described AI output that is almost right, but not quite, the exact category of defect that defeats a quick read and requires a reviewer to trace the logic line by line. Veracode’s testing of more than 100 large language models across 80 coding tasks found that 45 percent of generated code samples contained a security flaw, and the failure rates were not evenly distributed: 86 percent for cross site scripting, 88 percent for log injection, against only 14 percent for cryptographic misuse and 20 percent for SQL injection. The models have gotten good at the defects that appear often in public training data and have not moved on the defects that do not, and that pattern has held steady across model generations even as the code reads more fluently with each new release.

A Stanford and NYU study published at the 2023 ACM conference on computer and communications security found something more unsettling than the raw defect rate. Developers given access to an AI coding assistant wrote measurably less secure code than a control group working without one, and they were more likely to believe their code was secure precisely when it was not. That is the mechanism behind the trust numbers. A tool that produces confident, plausible, wrong code introduces a second defect behind the first one. It degrades the reviewer’s own ability to tell the difference, because the code no longer looks like something written in a hurry. It looks finished.

what review gate actually catches ai generated defects

Submarine reactor operations run on a rule that has nothing to do with speed and everything to do with consequence: no single operator touches a safety critical control alone, and the second person in the room is not there to make the work go faster. I watched that rule enforced on a boat where the cost of a missed step was measured in reactor safety, not sprint velocity, and the underlying logic transfers directly to a pull request that touches an authentication boundary or a safety relevant code path. The fix for AI generated code is the same shape: a pull request carrying AI authorship metadata should route automatically to a mandatory second reviewer, and that routing should not depend on a developer remembering to flag it or a teammate remembering to ask.

GitHub’s own guidance for reviewing Copilot generated code describes an eight step process that starts with automated static analysis and dependency scanning before a human ever opens the file, specifically naming the risk of a generated import statement pointing to a package that does not exist, a plausible sounding name an attacker can register and fill with malicious code the moment a developer accepts the suggestion. That ordering matters. Static analysis tools such as CodeQL catch the pattern level defects, the unsanitized input, the missing sanitization step, at a consistency no distracted human matches. A human reviewer catches the defect a pattern matcher cannot: a function that technically runs but solves the wrong problem, or a test quietly deleted because the generated implementation could not pass it. Neither control substitutes for the other, and a team that builds only one of them is building half a gate.

GitClear’s analysis of 211 million lines of code found duplicate code blocks in 6.66 percent of 2024 commits, nearly ten times the 2023 rate, while the share of code reused through deliberate refactoring fell from 15.8 percent to 9.5 percent over the same period. That is not a productivity story. It is a maintenance bill coming due on code nobody fully reviewed the first time, and Google’s own DORA research found the mechanism behind it directly: higher AI adoption correlates with both higher delivery throughput and higher delivery instability at the same time, because the tool amplifies whatever discipline, or its absence, already exists in the surrounding process.

For a deep tech engineering team, the stakes attached to that missing discipline are not hypothetical. A defect that would cost a consumer app a bug report costs a regulated hardware company a recall, a notified body audit, or a liability claim, and the European Union’s Artificial Intelligence Act already requires documented human oversight for any high risk system, with its primary enforcement date arriving August 2, 2026. A provenance tagged review gate costs a few minutes of a