GitHub Copilot, Cursor, and Claude Code now take a task description, read your repository, change files, run the tests, and open a pull request. Chat assistants explain unfamiliar code, write the regex you would otherwise look up, and draft the migration script you have been avoiding.
What changed is where the time goes. Typing was never the bottleneck, but the work around it (reading legacy code, writing tests, documenting, filling in boilerplate, switching frameworks) was, and that compresses hard. Review, design, and understanding what the system is supposed to do become most of the job.
The risks are specific and manageable: generated code that reproduces licensed snippets, secrets that leak into prompts and logs, packages that do not exist, security defaults that are quietly wrong, and agents that follow instructions hidden in the content they read.
Quick wins this week
- Paste a stack trace plus the 30 lines around the failing call and ask for the three most likely causes, ranked, with the one-line check that would confirm each.
- Have Copilot or Cursor generate unit tests for one gnarly function, then read them: they reveal what the model thinks the function does, and surface your own edge cases.
- Point a chat assistant at a 400-line legacy module and ask for a plain-English walkthrough, its side effects, and anything that looks like a bug. Verify the bug claims first.
- Have the assistant write your PR description from the diff: what changed, why, how to test, and what reviewers should look at first.
What AI can do for software developers, task by task
Feature work with an agentic coding tool
Write the task like a ticket: acceptance criteria, files involved, constraints (no new dependencies, keep the public API), and the test command. Have the agent plan before editing, review the diff file by file, run the suite yourself, and keep tasks small enough to read every line.
Debugging from logs and stack traces
Paste the trace, the surrounding code, and what you have already ruled out, and ask for ranked hypotheses with a cheap check for each. The model will patch the symptom first if you let it; insist on the root cause and a regression test before any fix.
Test generation
Ask for tests that describe intended behavior, including edge cases, error paths, and one property-based test where the input space is large. Reject tests that only assert whatever the implementation currently returns or mock away the logic under test; they pass today and catch nothing tomorrow.
Understanding and refactoring legacy code
Give the module and its callers and ask for a walkthrough, a dependency list, side effects, and a refactor plan in small steps. Write characterization tests before the first change, and let the agent do one step per pull request.
Security-minded code review
Run an AI review as a first pass on every PR and ask specifically about injection, authorization checks, error handling, secrets, and unsafe defaults. Treat its comments as suggestions, not a sign-off; it misses business-logic bugs and flags plenty of non-issues.
Documentation, upgrades, and learning a new stack
Generate docstrings, READMEs, and architecture decision records from the code and your notes, then check they describe actual behavior. For upgrades, ask for a checklist and codemods and run them in a branch with CI. For a new stack, ask for a comparison to one you know and check version-specific APIs; models lag releases.
Prompts for software developers
Replace the bracketed placeholders, paste into any chat assistant, and iterate on the result.
Task brief for an agentic coding tool
You are working in this repository as a careful senior engineer. Task: [DESCRIBE THE CHANGE]. Acceptance criteria: [LIST CRITERIA]. Constraints: add no dependencies, keep public interfaces in [MODULES TO PROTECT] unchanged, follow [STYLE OR CONTRIBUTING FILE]. Before editing, list the files you plan to touch and why, then wait for my approval. After editing, run [TEST COMMAND] and show the output. Ask instead of guessing. Finish with a PR description including a testing section.
Tip: The approval step catches a wrong plan before it becomes a wrong diff.
Rank the likely causes of a stack trace
You are a senior engineer debugging production code. Stack trace: [PASTE THE STACK TRACE]. Relevant code: [PASTE THE 30 LINES AROUND THE FAILURE]. Environment: [LANGUAGE, VERSION, RUNTIME]. Already ruled out: [WHAT YOU HAVE CHECKED]. Give the three most likely root causes ranked by probability, each with the cheapest check that would confirm or rule it out. Do not propose a fix until I confirm the cause. Then suggest a regression test.
Tip: Listing what you ruled out stops it from re-suggesting the obvious.
Write tests that would catch regressions
You are writing tests for the function below in [TEST FRAMEWORK]. First describe its intended behavior in three sentences. Then write tests for normal inputs, boundaries, invalid inputs, error paths, and concurrency if relevant. Do not assert on implementation details or mock the logic under test. Flag any behavior you are unsure is intended with a comment reading TODO CONFIRM. Function and its callers: [PASTE THE CODE]
Tip: Read the three-sentence description first; if it is wrong, the tests will be too.
Security review of a diff
You are a security-focused code reviewer. Review the diff below for injection (SQL, command, template), missing authorization checks, secrets or credentials, unsafe deserialization, weak crypto or disabled TLS verification, overly permissive CORS or file permissions, and error handling that leaks internals. For each finding give the line, severity, why it matters, and a fix. Say clearly when you found nothing in a category. Stack: [LANGUAGE AND FRAMEWORK]. Diff: [PASTE THE DIFF]
Tip: Run it before human review so reviewers can spend their attention on logic.
Explain a legacy module and flag risks
You are helping me understand code I did not write. Explain the module below to a new team member: what it does, inputs and outputs, side effects (I/O, global state, network), and dependencies. Then list anything that looks like a bug, race condition, or dead code, with your confidence for each. Finally, propose a refactor plan in steps small enough for one pull request each. Language: [LANGUAGE]. Code: [PASTE THE MODULE]
Tip: Low-confidence bug claims are usually wrong; check them last.
Want a prompt for something else? Use the Prompt Builder or browse career and job search prompts.
Skills to build
Writing task specs the tool cannot misread
Why: Agents do exactly what you say, and vague tickets become confident changes to the wrong thing.
How: Include acceptance criteria, files in scope, constraints, and the test command in every task. Keep a repo instructions file (CLAUDE.md, .cursor/rules, or copilot-instructions.md) with your conventions.
Reviewing generated code fast
Why: You now review far more code than you write, and skimming is how insecure defaults and hallucinated packages get merged.
How: Use a fixed checklist: meets the criteria, error paths, security, new dependencies (do they exist, what license), tests that test behavior, style.
Context management
Why: Models work from what is in the context window; missing files produce plausible code that ignores your actual interfaces.
How: Learn how your tool selects context (open files, @-mentions, indexing) and include the interfaces, types, and one example of the pattern you want.
Secrets hygiene for AI workflows
Why: Assistants read whole files, and an API key in a prompt is an API key in a vendor log.
How: Exclude .env and secret paths with .cursorignore or Copilot content exclusions, run a pre-commit secret scanner such as gitleaks, and rotate any key that was ever pasted.
Understanding tool use and prompt injection
Why: Agents that read issues, web pages, and package READMEs will follow instructions hidden there, including ones that exfiltrate data or run commands.
How: Treat everything the agent reads as untrusted, give MCP tools and shells least privilege, review commands before they execute, and sandbox anything with network access.
Tools worth knowing
GitHub Copilot
AI pair programmer inside VS Code, JetBrains, and GitHub itself, with a free tier
Cursor
A VS Code fork rebuilt around AI: autocomplete, chat, and agents that edit your project
Claude Code
Anthropic's agentic coding tool that works in your terminal and IDE, on your real codebase
ChatGPT
The general-purpose AI assistant most of your coworkers already use.
Claude
A careful writing and analysis assistant that shines on long documents.
Replit
Build, run, and host apps from your browser, with an agent that writes the code for you
Cautions for software developers
Models trained on public code can reproduce licensed snippets, and a copied GPL or AGPL block can put obligations on your product. Turn on the duplicate-detection filter where your tool offers one (GitHub Copilot has a public-code filter, and its business plans include an indemnity for filtered output), check the license of every package the assistant adds, and review generated code before it goes into anything you plan to relicense.
Coding tools read the files around your cursor, and chat prompts get pasted with connection strings, tokens, and customer records inside them; anything pasted may be retained by the vendor. Exclude secret paths, never paste production data, use no-training plans, and rotate any credential that ever touched a prompt.
Generated code carries subtle logic errors, off-by-ones, race conditions, and insecure defaults such as disabled certificate checks or wildcard CORS, and it will import packages that do not exist, a gap attackers now fill with malicious lookalikes. Its tests often assert current rather than intended behavior. Read every line as if a junior wrote it; you own it once it merges.
Proprietary code pasted into a personal chat account may be retained or used for training; use an enterprise or no-training plan and follow your company's policy. Agentic tools that read issues, PR comments, and web pages can be steered by instructions planted there; give them least privilege and review every command and diff before it runs.
Your 30-day plan
- Week 1: Pick one assistant your organization allows, set privacy mode or a no-training plan, add ignore files for secrets, and write a repo instructions file.
- Week 1: Use it only for tests, explanations, and PR descriptions while you build the review habit.
- Week 2: Give the agent one small, well-specified task per day and time the review against writing it yourself.
- Week 3: Add pre-commit secret scanning and a dependency check (does the package exist, what license) to CI, and run the security-review prompt on every PR.
- Week 4: Write the team's rules: what is allowed, how AI-heavy changes are labeled, who reviews them, and what stays hand-written. Hold a retro.
Frequently asked questions
Will AI replace software developers?
Is code from GitHub Copilot or ChatGPT safe to use commercially?
Cursor, GitHub Copilot, or Claude Code: which should I use?
How do I stop AI tools from seeing my secrets?
Terms used on this page
Related roles
- AI for Data AnalystsAI writes the SQL, the pandas, the DAX, and the sentences around the chart. It cannot know your data, so your job shifts to the right question, the checked join, and keeping regulated data out of the wrong tool.
- AI for Product ManagersAI turns forty interview transcripts into themes, a rough idea into a PRD draft, and a napkin sketch into a clickable prototype, and it will also confidently invent a customer need that does not exist. Here is how product managers get the first without the second.
- AI for Project ManagersAI cannot run your project, but it can draft the status report, turn a messy meeting into an action list, and pressure-test your risk register in minutes. Here is how project managers use it without losing the plot.
- AI for EngineersAI is a fast junior for mechanical, civil, electrical, and industrial engineers: it drafts calcs, reports, scripts, and checklists, and must be checked on every number. Nothing it produces is a deliverable until an engineer has verified it.