Artificial Intelligence in Software Development Lifecycle: Analyzing Real Effectiveness

Recent months of intensive research into modern Artificial Intelligence (AI) tools have demonstrated that their integration into the Software Development Lifecycle (SDLC) can both significantly accelerate processes and create a false sense of productivity. The primary focus was not merely on code generation, but on rethinking the entire development cycle, from task formulation to testing, review, and security verification.

Planning: A Clear Win in Efficiency

One of the most evident advantages of AI manifests at the planning stage. Utilizing AI agents to formulate goals, constraints, edge cases, and security requirements significantly reduces the time needed to prepare specifications, acceptance criteria, task decomposition, architectural drafts, and risk lists. A manual review of such a plan takes 30 to 60 minutes, whereas previously it required one to two evenings. AI agents consistently excel at identifying contradictions and overlooked scenarios.

Code Generation: Fast, But Not Free

Various tools were employed for code generation, including Cursor with Claude, GPT-4o, and GigaCode, as well as local models like Qwen2.5-Coder and DeepSeek-Coder via Ollama, alongside LangGraph and OpenHands for more autonomous tasks. For typical tasks such as CRUD operations, API integrations, migrations, tests, and refactoring, acceleration ranged from 2.5 to 4 times. However, for new business logic and architectural solutions, the speed increase was more modest, between 1.3 and 1.8 times, and sometimes AI even slowed down the process.

The main illusion of productivity lies in the perception that an AI agent generates 70–80% of ready-to-use code. In reality, a significant portion of the time after generation is spent on review, corrections, integration, and quality assurance. Instead of typing characters, the developer focuses on verification and correction. Common issues found in generated code included:

  • References to non-existent methods and APIs.
  • Code that poorly integrates into the project’s existing architecture.
  • Missed checks and potential vulnerabilities.
  • Overly confident but erroneous explanations.

Review and Testing: The Role of AI and Human Input

In individual development, where full code review is absent, AI reviewers with predefined project rules, static analysis, automated tests, and property-based testing were used. AI performs reasonably well in writing unit tests, but complex scenarios and end-to-end (e2e) testing still require significant human involvement. Critically important areas such as security, architecture, and complex business logic are always manually reviewed.

Security: The Primary Bottleneck

Security concerns emerged as one of the main obstacles. Even in pet projects, AI agents regularly proposed insecure solutions, including SQL injections, XSS vulnerabilities, hard-coded secrets, and improper data handling. Specific risks were also identified, such as prompt injection through input data, data leaks via agent logs, and supply-chain risks related to the tools and dependencies used.

To mitigate these risks, steps were taken: a security checklist was added to agent skills, a separate security review was introduced, and security requirements began to be defined during the specification phase. Local models are used for sensitive code. These measures reduced the number of obvious errors but did not eliminate the need for manual review. The speed of code generation easily outpaces the speed of its control.

What Works and What Remains an Illusion

Real benefits of AI are observed in the following areas:

  • Specification preparation and planning.
  • Generation of boilerplate code and unit tests.
  • Exploration of implementation options.
  • Analysis and documentation of existing code.

Illusions created by AI include:

  • Multi-fold increase in development speed without accounting for review time.
  • The perception of nearly error-free operation by AI agents.
  • The belief that there is no need to consider security in projects.