The biggest software development trends for 2027 are coding agents becoming the default way code gets written, code review turning into the bottleneck, and a software supply chain under record attack just as EU rules take effect. Here are all ten, with the number behind each:
- Coding agents become the default. 65.9% of developers now use AI coding assistants or agents at work, and Microsoft says one in three GitHub pull requests involves an agent.
- Trust is conditional and review is the bottleneck. 48% of developers trust AI output only when they can verify it, and 69.3% lost time to plausible but wrong code (Stack Overflow 2026).
- AI code carries security debt. AI-generated code passed security tests only 56% of the time in Veracode's 2026 testing.
- Supply chain attacks hit records as regulation goes live. Sonatype found 454,600 new malicious packages in 2025, and EU Cyber Resilience Act reporting started on September 11, 2026.
- AI spend becomes a budget line. GitHub Copilot moved to token-based billing in June 2026, and 98% of FinOps teams now manage AI spend.
- The productivity evidence is still unsettled. One randomized trial found experienced developers 19% slower with AI, while a large field study found 26% more completed tasks.
- The developer job market splits. Software job postings are up 21.5% in a year, but entry-level roles are just 4.5% of them (Indeed).
- Kubernetes becomes the AI runtime. 82% of container users run Kubernetes in production, and 66% of companies hosting generative AI models use it for inference (CNCF).
- Postgres keeps winning. 57.9% of developers use PostgreSQL, and AI agents now create most new databases on Neon and Supabase.
- Toolchains get faster and memory-safe. TypeScript 7 shipped as a native port with 8x to 12x faster builds, and Rust became a permanent part of the Linux kernel.
Every figure comes from the organization that measured it (Stack Overflow, Google's DORA, CNCF, the BLS, Indeed, Sonatype, the European Commission and companies' own announcements), plus our own search data where it adds something.
Let's get into it.
1. Coding Agents Become the Default
In about a year, AI help for developers moved from autocomplete to agents that open pull requests on their own.
The Stack Overflow Developer Survey 2026 (30,903 responses) found 65.9% of developers use AI coding assistants or coding agents at work, and 73% of them use these tools daily. Asked which coding agents they used in the past year, AI tool users named Claude Code (65.5%), GitHub Copilot (58.7%), OpenAI Codex (29.5%) and Cursor (25.5%).
The platforms see the same shift. Microsoft said on its fiscal Q4 2026 call that GitHub Copilot has 50 million users (including free and student accounts) and that one in three pull requests on GitHub now involves an agent.
What companies are doing
Anthropic said Claude Code passed $2.5 billion in run-rate revenue in February 2026, with enterprise customers above half of it. Cursor became part of SpaceX in August 2026, gaining access to SpaceX's GPU fleet for its own models. Microsoft plans to fold its Copilot experiences, including coding, into one app.
What to expect in 2027
Expect agents to handle more of the routine work (tests, refactors, dependency upgrades, small features) in 2027, and the developer's role to shift toward specifying, reviewing and integrating. Our search data shows where attention moved: "claude code ai" searches are up 408% and "codex cli" up 82% in a year, while "cursor ai", "github copilot" and "windsurf" are each down 45%.
2. Trust Is Conditional, and Review Is the Bottleneck
Developers use AI constantly but trust it only when they can check it.
Stack Overflow found 48% of developers trust AI output only "when I can easily verify the output", and just 6.6% trust it for important work decisions. The mistakes that cost the most time are plausible but wrong code (69.3%) and generated code that is hard to review (54.2%).
Google's 2025 DORA report (about 5,000 technology professionals) found 90% use AI at work and AI adoption now raises delivery throughput, but it is still associated with lower delivery stability. A peer-reviewed MSR 2026 study found agent-written pull requests contain about 1.87 times more redundant code than human ones.
What companies are doing
GitHub said its Copilot code review passed 60 million reviews and is now involved in more than one in five code reviews on the platform, with 12,000 organizations running it on every pull request.
What to expect in 2027
When writing code gets cheap, reviewing it becomes the constraint. Expect 2027 engineering investment to go into AI-assisted review, stronger tests and smaller, well-scoped changes, and expect stability metrics (change failure rate, rollbacks) to get more attention than raw output.
3. AI-Generated Code Carries Security Debt
AI code usually works. It is often not secure.
Veracode's 2026 GenAI Code Security Report, testing more than 100 models over four years, found an average security pass rate of 56%, barely changed from 55% in the spring, meaning about 44% of tasks introduced a vulnerability. Java fared worst at around 30%.
The broader codebase picture is getting worse too. Black Duck's 2026 open source risk report found the average audited codebase had 581 vulnerabilities, up 107%, and only 24% of organizations run full IP, license, security and quality checks on AI-generated code.
What to expect in 2027
Expect security scanning of AI-generated code to become a default step in 2027 pipelines, not an add-on, and expect buyers and auditors to ask how AI-written code is reviewed before it ships.
4. Supply Chain Attacks Hit Records as Regulation Goes Live
Open source registries are under constant attack, and Europe now requires vulnerability reporting.
Sonatype identified more than 454,600 new malicious packages in 2025, more than 99% of them on npm. The Shai-Hulud worm compromised more than 500 npm packages and stole developer credentials, prompting a CISA alert to rotate all developer credentials. In a sign of how AI changes the threat, Anthropic disclosed that during a misconfigured evaluation, one of its models published a malicious package to PyPI that ran on 15 real systems before it was removed.
Registries are hardening in response. npm revoked all classic tokens in December 2025, and npm v12 turns off install scripts by default.
Regulation is now live in Europe. The EU Cyber Resilience Act's reporting obligations for actively exploited vulnerabilities started on September 11, 2026, and its main obligations apply from December 11, 2027. The US went the other way: OMB memo M-26-05 dropped the federal secure software self-attestation requirement in favor of a risk-based approach.
What to expect in 2027
For anyone selling software with digital elements into the EU, 2027 is the compliance year: vulnerability handling, SBOMs and reporting processes need to be working before December 2027. Expect dependency cooldowns, pinned versions and trusted publishing to become standard practice.
5. AI Spend Becomes a Budget Line
AI coding tools are moving from flat seats to metered usage.
GitHub moved all Copilot plans to usage-based billing on June 1, 2026, with credits consumed by tokens at each model's rate, because a quick question and a multi-hour autonomous session cost very different amounts. Microsoft's CFO said Copilot usage weighed on margins before the switch. The FinOps Foundation's State of FinOps 2026 found 98% of FinOps practitioners now manage AI spend, up from 31% two years earlier.
What to expect in 2027
Expect engineering leaders to own an AI token budget in 2027, with usage limits per team, model routing (cheaper models for routine work) and monthly reviews. Agents that run for hours are the new cost driver.
6. The Productivity Evidence Is Still Unsettled
Everyone feels faster. The measurements disagree.
METR's randomized trial found experienced open-source developers took 19% longer with AI tools while believing they were about 20% faster. Its 2026 follow-up was inconclusive, partly because many developers refused to work without AI. A large field study summarized in the 2026 AI Index found developers using GitHub Copilot completed 26% more pull requests. Self-reports run much higher: in a METR survey, the median respondent said AI made them about 3 times faster.
What to expect in 2027
Expect measurement to replace anecdotes in 2027: teams tracking cycle time, review time, defects and rework before and after AI adoption, rather than relying on how fast people feel.
7. The Developer Job Market Splits
Demand for developers is recovering, but almost entirely at the senior end.
The BLS counts 1.69 million software developers with a median wage of $135,980, and projects 10% growth from 2025 to 2035, citing AI development. Indeed's software postings index is up 21.5% in a year but still about 22% below February 2020, and 71% of the past year's increase came from senior roles. In Q1 2026, senior roles were 69.3% of software postings and entry-level roles just 4.5%.
Young developers feel it most. Stanford's Digital Economy Lab found employment for 22 to 25 year olds in AI-exposed jobs is 19% below trend, through reduced hiring rather than layoffs. The NY Fed reports 7.0% unemployment for recent computer science graduates, against 4.2% for all majors.
What to expect in 2027
The risk for engineering organizations is a missing generation of juniors who would have become tomorrow's seniors. Expect 2027 to bring more deliberate junior programs built around AI-assisted work, and more competition (and pay pressure) for experienced engineers who can direct and review agents.
8. Kubernetes Becomes the AI Runtime, and Platform Engineering Is Universal
Cloud native is the default, and it is now where AI inference runs.
CNCF's annual survey found 82% of container users run Kubernetes in production, up from 66% in 2023, and 66% of organizations that host generative AI models use Kubernetes for some or all inference. Google's DORA research found 90% of organizations have adopted an internal platform and 76% have dedicated platform teams.
Waste remains the problem. Datadog's State of Containers and Serverless found most workloads use less than half their requested memory and under a quarter of their requested CPU.
What to expect in 2027
Expect platform teams in 2027 to add GPU scheduling, model serving and AI cost controls to their internal platforms, and expect right-sizing to be a quick win as cloud budgets get pulled toward AI.
9. Postgres Keeps Winning, and AI Agents Create the Databases
PostgreSQL has become the default database, and AI tools are now its biggest new users.
Stack Overflow found 57.9% of developers use PostgreSQL, well ahead of SQLite (42.1%) and MySQL (35.1%). On the DB-Engines ranking, PostgreSQL had the biggest score gain in the top 10 over the past year (+45.6 points), while Oracle and MySQL fell.
What companies are doing
Databricks bought Neon, saying more than 80% of databases on Neon were created automatically by AI agents. Supabase raised $500 million at a $10 billion valuation and said more than 60% of its new databases are launched by an AI tool. PostgreSQL 19 is due on November 19, 2026.
What to expect in 2027
Expect Postgres to remain the safe default in 2027, and expect database provisioning to be increasingly automated by agents, which raises new questions about cost control and cleanup. Our search data reflects it: "supabase" searches are up 82% in a year.
10. Toolchains Get Faster and Memory-Safe
The languages and tools underneath are changing too.
Microsoft shipped TypeScript 7.0 on July 8, 2026, a native port written in Go with 8x to 12x faster full builds on large codebases. Rust became permanent: the Linux kernel ended its Rust "experiment" for Linux 7.0, and Google said memory-safety bugs fell below 20% of Android vulnerabilities for the first time, with Rust code showing about 1,000 times lower memory-safety vulnerability density than C and C++. Python 3.14 made the free-threaded (no-GIL) build officially supported.
What to expect in 2027
Expect faster type-checking and builds to shorten feedback loops for humans and agents alike, and expect memory-safe languages to show up in security requirements, especially for new systems code. GitHub's Octoverse 2026 report, due around GitHub Universe at the end of October, will update the language rankings, and we will add it here.
What We're Seeing in Search
Our database tracks US search demand across tens of thousands of trends. For developer tools, as of August 2026: "claude code ai" is up 408%, "codex cli" up 82% and "supabase" up 82% in a year, while "cursor ai", "github copilot" and "windsurf" are each down 45% and "vibe coding" is down 33%. "typescript 7" went from 210 to 2,400 monthly searches after the release. Search interest is following the agent tools developers actually adopt, while the novelty terms fade.
For the wider picture, see our AI industry trends.
The Common Thread
Put the ten shifts side by side and one pattern runs through them: writing code got cheap, and everything around it got more important.
Agents produce code faster than teams can review it. That code carries security debt into a supply chain that is already under attack. Usage-based pricing turns AI into a cost to manage. And the junior roles that used to absorb routine work are disappearing, which raises the question of who becomes the next generation of senior engineers.
If you plan for three things in 2027, plan for these: invest in review, testing and security scanning as much as in code generation; set up an AI usage budget and model routing before the token bills arrive; and get your vulnerability reporting and SBOM process ready for the EU Cyber Resilience Act's December 2027 deadline.
Frequently Asked Questions
What are the biggest software development trends for 2027?
The biggest shifts are coding agents becoming the default, review becoming the bottleneck, security debt in AI-generated code, record supply chain attacks alongside the EU Cyber Resilience Act, usage-based AI pricing, unsettled productivity evidence, a split job market, Kubernetes as the AI runtime, PostgreSQL's dominance, and faster, memory-safe toolchains.
What percentage of developers use AI coding tools?
The Stack Overflow Developer Survey 2026 found 65.9% of developers use AI coding assistants or agents at work, and 73% of those use them daily. About 83% use at least one AI tool.
Is AI replacing software developers?
Not overall, but it is changing who gets hired. The BLS projects 10% growth in software developer jobs from 2025 to 2035, and Indeed's software postings are up 21.5% in a year. But entry-level roles are just 4.5% of postings, and employment of 22 to 25 year olds in AI-exposed jobs is 19% below trend.
When does the EU Cyber Resilience Act apply?
Its reporting obligations for actively exploited vulnerabilities and severe incidents started on September 11, 2026. Its main obligations apply from December 11, 2027.
What is the most popular database in 2026?
PostgreSQL. 57.9% of developers in the Stack Overflow Developer Survey 2026 use it, and it had the largest popularity gain among the top 10 databases on DB-Engines over the past year.
Want to spot the next developer trend before it hits the mainstream? Read our guide on how to identify market trends or browse what's gaining traction in our trending topics list.
Never miss a trend again
- One trend broken down with the numbers
- Who's making money, and what to build
- A website on the rise
- A breakout app
Join 5,000+ founders
