AI coding creates a new software bottleneck

AI-assisted coding is accelerating software development fast enough that enterprises are having to rethink how they keep pace with the code they produce — and it’s a challenge that’s now worth a fortune. Two companies aiming to solve that problem have attracted hundreds of millions of dollars from investors this week. AI code review company CodeRabbit reached a $1.5 billion valuation after its latest funding round, while software testing platform Blacksmith raised $45 million at a valuation approaching $550 million. The companies are tackling different parts of the software development lifecycle, but their simultaneous emergence points to the same shift: AI is helping organizations produce code faster than many can confidently evaluate it.

AI-generated code creates a context problem. One consequence of AI-assisted software development is that engineers don’t have the same context for AI-generated code that they would have for code they wrote themselves. Tommy Tran, a software engineer at Meta specializing in AI and machine learning infrastructure, said engineers normally understand the decisions behind their own code because they worked through the problem themselves. With AI-generated code, that reasoning is missing — even when the resulting implementation appears sound.

That makes validation more complex than simply checking whether the code passes a conventional suite of tests. With AI-generated code, the reviewer also needs to establish why the code was written as it was, whether the implementation actually reflects the original requirements of the task and whether it behaves correctly in situations the AI may not have anticipated. This shift mirrors the transition from manual to automated testing in previous decades, where the introduction of tools created a new class of artifacts that required specialized expertise to interpret, rather than just execution.

That distinction becomes particularly important when AI is also used to generate the tests intended to validate it. An automated test may demonstrate that an implementation behaves consistently with a particular expectation — without demonstrating that the expectation was correct in the first place. To combat this, Tran argues that enterprises should anchor tests to requirements and system contracts rather than to the implementation produced by an AI system. Otherwise, organizations risk creating a closed feedback loop in which AI-generated code is being evaluated against AI-generated assumptions. Effectively, “you risk testing whether the AI agrees with itself,” said Tran.

The implication is that enterprises can’t judge code by whether it passes its tests; they also need to determine whether those tests meet the business and system requirements.

It also changes how organizations should think about test coverage. Balaji Srinivasan, senior director of engineering at LinkedIn, said conventional coverage metrics — the percentage of code exercised by the tests — can obscure whether tests are actually validating meaningful behavior. As AI makes it easier to generate both code and tests, the quality of that coverage matters more than simply increasing the percentage of code exercised.

“Useful coverage of code becomes a more important metric than the traditional coverage numbers that we see,” Srinivasan said.

Continuous Validation

The next challenge is timing. In a conventional development process, testing can happen after developers have completed their work. But AI can generate code in parallel and iterate on it rapidly. If testing is treated as a discrete stage at the end of development, several code changes may have accumulated before the organization has established whether those changes work.

According to Simon, this is already affecting how organizations should think about quality assurance. “Changes are already happening in the QA, testing and validation space,” Simon said. “What would make even more sense is if the testing phase was integrated along the development lifecycle, so that it’s included as part of the development process to benefit from ‘code visibility’ as it’s generated — not later.”

The fundamentals of testing would remain: software still needs to meet requirements, behave correctly, remain secure and perform adequately. But the controls around those objectives can increasingly run alongside development. Simon pointed to AI model provenance, automated review, dependency checking, security scanning and test adequacy as controls that can and should be incorporated into the development process, with human approval reserved for changes where the potential consequences warrant it.

The result would be a development lifecycle in which validation happens continuously, rather than acting as a gate at the end.

The infrastructure is becoming an investment. Whether enterprises can make that shift at scale depends partly on the maturity of their existing testing infrastructure. Organizations with strong automated testing can increase code volume without requiring a proportional increase in manual review, while those without may struggle. “If your test coverage is poor and you’re dependent on manual testing to uncover bugs and issues and qualify builds, then you can’t realize the full benefits of AI-assisted coding since a human is required to validate the code,” Srinivasan said.

That helps put this week’s funding activity into context. CodeRabbit automates code review, while Blacksmith provides infrastructure for continuous integration and testing. Both are addressing pieces of the infrastructure enterprises need as software development becomes increasingly automated. Rather than being a case of outsourcing, Simon described the shift as the “industrialization and automation of validation.”

There is also an economic case for buying rather than building those capabilities. Tran said internal validation systems require ongoing work as AI models, security risks and development environments change. Specialized vendors can spread that investment across customers, making the end product more cost-effective. But enterprises that purchase these types of products aren’t handing responsibility for software quality to those vendors, Tran added. The tools can review code, run tests and identify potential problems, but organizations still determine their requirements, risk tolerance and whether a change is ready to ship.