FinishKitFinishKit/Blog
Back to FinishKit
industry

How Much Code Is AI-Generated in 2026? Every Major Figure, Explained

Developers say AI agents fully write about 47% of their code; Google says 75% of its new code. What each figure measures, plus quality and security data.

FinishKit TeamUpdated 10 min read

In 2026, developers say AI agents fully write about 47% of their code, and only about a quarter involves no AI at all (JetBrains' 2026 survey). In Sonar's late-2025 survey, 42% of committed code was AI-generated or significantly assisted. Google's CEO says 75% of Google's new code is AI-generated and approved by engineers.

Each number counts something different. This page puts the widely quoted figures side by side, explains what each one measures, and then covers what the quality and security research says about that code. Every figure links to its original source in the list at the end.

The figures side by side

FigureSourceWhat it measuresHow it was countedWhen
75%Google, CEO Sundar Pichai at Cloud Next 2026Share of all new code at Google that is "AI-generated and approved by engineers"A company statement about one company. The remarks don't say how it's counted.April 22, 2026
~47%JetBrains Developer Ecosystem Survey 2026Share of a developer's work code last month that AI agents wrote fullySelf-reported by 15,000+ professional developers, reweighted to better represent the global developer populationAsked May to July 2026; published August 26, 2026
42%Sonar State of Code Developer Survey 2026Share of a developer's committed code that was AI-generated or significantly assistedSelf-reported by 1,149 developers who had used AI at work in the past year (979 answered this question)Asked October 2025; published January 8, 2026
29%Daniotti, Wachs, Feng and Neffke, ScienceShare of Python functions committed to public GitHub by US developers that look AI-writtenMeasured: a trained classifier run over more than 30 million GitHub commitsData to the end of 2024; published 2026
46%GitHubAverage share of code "being built using GitHub Copilot," among Copilot usersGitHub's own figure for its own users. The post doesn't describe the method.February 14, 2023

Among professional developers, using AI at all is close to universal. In the same JetBrains survey, 90% of professional developers used AI coding agents at work at least weekly, and 68% used them daily.

Why the figures disagree

Four differences explain most of the gap.

Whose code is counted. Google's figure describes one company, which says it has been using AI to generate code internally for a while. Sonar only surveyed developers who had used AI at work in the past year, so people who don't use it can't pull the average down. GitHub's 46% only covered people already using Copilot. JetBrains surveyed professional developers broadly and reweighted the results by region, employment status, programming language and familiarity with JetBrains products. The Science study looked at everyone committing Python to public GitHub, AI users or not, which is one reason its figure is lower.

What counts as AI code. JetBrains splits code into three buckets: fully generated by agents (about 47% on average), written with some AI assistance (about 38%), and written with no AI at all (about 27%). Because people answered in ranges, JetBrains notes these averages can add up to more than 100%. Sonar's 42% puts AI-generated and significantly assisted code in one bucket. Google counts code that is AI-generated and then approved by an engineer. The Science study counts whole Python functions that its classifier judges to be AI-written.

Estimates versus measurement. Both surveys ask developers to estimate their own work, and JetBrains cautions that self-reports may not be fully accurate. The Science figure is the only measured one here, but it covers Python on public GitHub only, and its data stops at the end of 2024. The Google and GitHub announcements don't explain how their figures were calculated.

When it was measured. These figures span three and a half years, and the trend moved fast. Google alone has given three readings: more than a quarter of new code in October 2024, 50% in fall 2025, and 75% in April 2026. Developers in Sonar's survey put their own AI share at 6% in 2023 and 42% at the time of the survey, and expect 65% by 2027. GitHub's 46% still circulates widely, but it dates from February 2023 and describes Copilot users only.

Which number to quote

  • For the average professional developer in 2026: JetBrains' ~47% is the newest figure and comes from the largest survey in the table. Quote it as what developers report, not as a measurement.
  • For a single company: name the company. Google's 75% describes Google.
  • For a measured figure: the 29% from Science, with its limits stated: Python only, public GitHub, data through 2024.

What about code in production?

None of these sources measures how much of the code running in production was written by AI. The closest is Sonar's question about where teams use AI at all: 88% of respondents said their team or company uses AI for prototypes, 83% for internal, non-critical production software, 73% for customer-facing applications and 58% for business-critical or mission-critical services.

What the quality and security research says

Code that runs isn't the same as code that's safe to ship. Four kinds of evidence point the same way.

Security: Veracode's 2026 GenAI Code Security Report (July 2026). Veracode gives models coding tasks that can be completed safely or unsafely, in Java, JavaScript, C# and Python, with no security instructions in the prompt, then checks the output with its static analysis tool. This round tested 11 new models on 80 tasks. Models now write syntactically correct code nearly 100% of the time, but across all the models Veracode has tested, the average security pass rate is 56%, barely changed from 55% in its first report. The best model, GPT-5.5, passed 68%. Results depend heavily on the kind of flaw: models passed 83% of SQL injection tasks and 87% of cryptography tasks, but only 15% of cross-site scripting tasks and 12% of log injection tasks. Java was the weakest language, at 30%.

Defects in real pull requests: CodeRabbit (December 2025). CodeRabbit compared 470 open-source GitHub pull requests: 320 co-authored by AI and 150 written by humans only. The AI co-authored PRs averaged 10.83 issues each, against 6.45 for the human-only PRs, about 1.7 times as many. Logic and correctness issues were 75% more common, error-handling gaps nearly twice as common, and readability issues more than three times as common. CodeRabbit notes it couldn't confirm that every "human-only" PR was written without AI.

Maintainability over time: GitClear (June 2026). GitClear tracked 623 million code changes from 2023 to 2026. Duplicated code blocks rose from 40.3 per million changed lines in 2023 to 73.0 so far in 2026, up 81%. Moved code, a sign of refactoring, fell from 13% of changed lines to 3.8% over the same period. GitClear tracks these trends across all the code in its dataset while AI use grew; it doesn't label individual lines as AI-written.

What developers think. In Sonar's survey, 96% of developers said they don't fully trust that AI-generated code is functionally correct, yet only 48% said they always check AI-assisted code before committing it. Stack Overflow's 2025 Developer Survey found the same unease: 46% of respondents distrusted the accuracy of AI tools against 33% who trusted it, and the most common frustration, named by 66%, was "AI solutions that are almost right, but not quite." Stack Overflow's 2026 results hadn't been published when we checked on October 2, 2026.

One caveat applies to this whole section, and to us. Sonar, Veracode, CodeRabbit and GitClear all sell code quality, security or analytics tools, and FinishKit sells code review. Read the methods, not just the headlines.

What this means if you're shipping an AI-built app

If an AI tool wrote most of your app, you're now the reviewer for a lot of code you didn't type. The research says that code is usually syntactically correct. Where it falls short is the part a demo never touches.

  1. Check every place user input is shown or logged. Cross-site scripting and log injection were the weakest areas in Veracode's tests, at 15% and 12%. Make sure user input is escaped before it's rendered and cleaned before it's written to logs. Our guide to common security holes in AI-generated code walks through the usual suspects.
  2. Walk the unhappy paths. CodeRabbit found error-handling gaps nearly twice as often in AI co-authored PRs. Try a failed API call, an expired session, an empty account and a form submitted twice, and see what your app does.
  3. Read before you commit. Only 48% of developers in Sonar's survey always check AI code before committing. A diff you've actually read is the cheapest safety net you have, and tests for the flows that matter keep the next change from breaking them.
  4. Watch for copies. When the same logic lives in three files, a fix in one leaves the other two behind. GitClear's duplication data says this is getting more common, not less.

If you'd like a second pair of eyes before launch, FinishKit's free readiness check takes a public GitHub URL and gives you a score from a short set of checks, no sign-up needed. The full review covers eight dimensions, from security and error handling to deployment, and turns what it finds into a Finish Plan ordered by what to fix first. It runs once you install the FinishKit GitHub App on the repositories you pick.

The share of code that AI writes will keep climbing. Making sure that code is ready to ship is still your job.

Sources

Every figure above was checked against these sources on October 2, 2026.