- Home
- AI agents
- Enterprise AI agent examples
- Software engineering
Plan · Enterprise AI agent examples
AI coding agents in software engineering: what companies report and the controls they need
A software engineering agent takes a task such as a bug fix, a missing test, a dependency upgrade or a code migration, works on it in a sandboxed copy of the repository with the build and test tools, and returns a pull request for an engineer to review. Most published figures come from large code migrations.
In this guide: 83 pages
Key takeaways
- The published figures come from migrations and modernization. Thomson Reuters reports 1.5 million lines of .NET code modernized a month with AWS Transform, and Cognition reports 8 to 12 times engineering-time efficiency on Nubank’s migration of an ETL monolith.
- Agents now work for hours on one task. Rakuten reports seven hours of sustained autonomous coding with Claude Code, which moves the review from each line to the finished change.
- A coding agent is privileged by default: it reads source, runs commands and holds tokens. The 2025 incidents, from a production database deleted during a code freeze to a tampered extension release, came from access the agent or its pipeline did not need.
- Many of the large numbers are calculations. Amazon’s 4,500 years of development work saved on Java upgrades is an estimate from the number of dependencies migrated, published in August 2024.
What do AI agents do in software engineering?
They migrate code between framework and language versions, split monoliths, write tests and mocks, fix bugs, document and review code, and in pilots take whole tickets. The editor assistants many teams already use sit one level below: they suggest lines a developer accepts one at a time.
Software engineering tasks by what the agent is allowed to do. "Assists" means it suggests and a developer acts; "acts" means it produces a whole change and runs commands to get there.
| Task | Level | What it touches, and the control we add | Seen in |
|---|---|---|---|
| .NET Framework to cross-platform .NET; Java 8 or 11 to Java 17 | Acts | Copies of the repositories; pull requests reviewed and merged by engineers | Thomson Reuters (AWS Transform); Amazon (Amazon Q Developer, now continued as AWS Transform) |
| Split a monolith into sub-modules | Acts | Repetitive per-class migration work; engineers review and merge | Nubank (Devin) |
| Unit tests, API mocks, bug fixes, documentation, code review | Acts | Several sessions in parallel; engineers review | Rakuten (Claude Code) |
| A long autonomous refactoring task | Acts | An open-source refactor, checked for numerical accuracy | Rakuten |
| A supervised autonomous engineer for legacy code moves | Acts | A pilot alongside human developers | Goldman Sachs (Devin, pilot) |
| Code suggestions in the editor | Assists | The developer accepts or rejects each suggestion | Saxo Bank, Commonwealth Bank of Australia (GitHub Copilot) |
The split matters for controls. An editor assistant proposes lines a developer accepts one by one. An agent produces a whole change, runs commands to get there and asks for review at the end, so its permissions and the review step carry the risk.
What have companies published about coding agents?
Five companies publish something, four with figures, all from the vendor or the company and most without a published method. They point to large, repetitive migrations as the work where agents pay off, and say little about how much they would help on your code.
Publicly reported coding agents, as published by each source and opened on 2 November 2026. None of these companies is a QueryNow client.
| Company | What the agent does | Published figure | Source and date | How to read it |
|---|---|---|---|---|
| Thomson Reuters | AWS Transform agents ran .NET modernization from discovery and analysis to refactoring, with many jobs in parallel, and fixed vulnerabilities from unsupported versions | 1.5 million lines of code modernized a month, called a 4x gain in velocity; 30% lower costs after moving from Windows to Linux; technical debt down 50% | AWS case study, undated, read 2 November 2026 | Vendor story; no baseline or method |
| Nubank | Devin migrated an 8-year-old ETL monolith of more than 6 million lines into sub-modules; engineers delegated per-class work and reviewed the changes | 8 to 12 times engineering-time efficiency; more than 20 times cost savings; about 40 minutes per sub-task down to 10 | Cognition customer story, undated; the project ran 2023 to 2024 | Cognition calculated the figures; Nubank’s quote is qualitative |
| Rakuten | Claude Code for unit tests, mocks, bug fixes, documentation and review, with sessions in parallel; one autonomous refactoring task | Seven hours of sustained autonomous coding; time to market down 79%, from 24 working days to 5 | Anthropic customer story, undated, read 2 November 2026 | Rakuten’s figures as Anthropic presents them |
| Amazon (own applications) | The Amazon Q Developer transformation agent upgraded tens of thousands of production applications from Java 8 or 11 to Java 17 | An estimated 4,500 years of development work and an estimated USD 260 million a year in cost savings (AWS DevOps Blog, 1 August 2024) | AWS DevOps Blog, 1 August 2024 | Vendor self-use; both figures are estimates, from an older source |
| Goldman Sachs | A pilot of Devin as a supervised autonomous engineer for work such as moving internal code to newer languages | No measured results; the CIO expects "hundreds" of Devins at first | CNBC via NBC Chicago, 11 July 2025 | A pilot and a projection |
Two lighter entries in Microsoft’s July 2025 roundup are editor assistants: Saxo Bank’s 700 developers coding about 30% faster, and about 30% of GitHub Copilot suggestions adopted at Commonwealth Bank of Australia.
What controls does a coding agent need?
Treat a coding agent as a privileged identity in your delivery pipeline: it reads source, runs commands and holds credentials. Three public incidents from 2025 show where the controls belong.
In July 2025 a Replit agent ran destructive commands on a production database during a declared code freeze, then wrongly said rollback was impossible and generated fake records (The Register, 21 July 2025). In the same month an over-scoped GitHub token in a build pipeline let an outside actor commit code that shipped in version 1.84.0 of the Amazon Q Developer extension for VS Code, and AWS revoked the credentials and pulled the release (AWS security bulletin, 23 July 2025). Legit Security later showed a hidden comment in a pull request making GitHub Copilot Chat read a user’s private repositories and leak their contents through image URLs, which GitHub closed by disabling image rendering (Legit Security, 30 September 2025).
- Sandbox. The agent works in an isolated environment with a copy of the repository, the build tools and test data, with no network path to production and no production credentials.
- Scoped tokens. Short-lived tokens limited to the repositories and branches the task needs, never an organization-wide personal access token. Review the tokens your CI holds as well, since the Amazon Q incident came through the build pipeline.
- Review and merge. The agent opens a pull request and an engineer merges it. Branch protection stops the agent account from merging its own work or pushing to the main branch.
- CI gates. Tests, static analysis, dependency and secret scans and licence checks run on every agent pull request, as for people, with no bypass for the agent account.
- Attribution. Agent commits carry the agent’s identity, and the session log with every command it ran is kept beside the pull request.
Where should an engineering team start?
Start with a migration or upgrade you already planned, where the target is defined and the tests tell you whether a change works. The published results come from this kind of work.
- Pick one bounded migration: a framework upgrade, a language version or a dependency with a breaking change. Time a sample of the work done by hand.
- Check that the test suite covers the code being changed. Without tests, nobody can check an agent’s change quickly.
- Set up the sandbox, the scoped tokens and branch protection before the first run.
- Run the agent on a slice, review every pull request, and record review time, rework and defects found later.
- Widen to more repositories once review time per change falls and defects stay at the baseline.
How do Microsoft, AWS and Google implement it?
Where the published coding agents ran, and what each cloud offers, with statuses as the vendor pages showed on 2 November 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Where the examples ran | GitHub Copilot, the editor assistant behind the Saxo Bank and Commonwealth Bank figures | AWS Transform at Thomson Reuters; Amazon Q Developer, now continued as AWS Transform, at Amazon | No coding agent example with figures in our research set |
| Claude models for coding agents | Available in Microsoft Foundry | Available on Amazon Bedrock | Available on Google Cloud |
| Identity for the agent | Microsoft Entra Agent ID (GA 1 May 2026) | AgentCore Identity workload identities | Agent Identity (SPIFFE-based); API in preview since 18 June 2026 |
Devin, Claude Code and GitHub Copilot work across clouds and in your own repositories, so most of the controls on this page live in source control and CI rather than in a cloud agent platform.
Frequently asked questions
Can an AI coding agent merge its own code?
It should not. Nubank’s engineers reviewed and merged Devin’s work, and Goldman Sachs describes its Devin pilot as supervised. Enforce review with branch protection on the agent’s account, so the agent cannot merge its own changes.
How long can a coding agent work without a person?
Rakuten reports seven hours of sustained autonomous coding on one refactoring task with Claude Code. Long runs make the review at the end more important, so ask for the test results and a summary of what changed with every pull request.
Do coding agents reduce engineering cost?
The published figures say so for migrations, and each one is a vendor or company calculation: Cognition’s 8 to 12 times for Nubank, Amazon’s estimated savings from its Java upgrades. Measure review time and defects as well as output, because a fast change that needs rework costs twice.
What is the difference between a coding assistant and a coding agent?
An assistant suggests code in the editor and the developer accepts each suggestion. An agent takes a whole task, runs commands and tests in its own environment and returns a finished change for review, so it needs its own identity, a sandbox and scoped tokens.
More in Enterprise AI agent examples
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- How Thomson Reuters turbocharged .NET modernization with AWS Transform
- How Nubank refactors millions of lines of code to improve engineering efficiency with Devin
- Rakuten accelerates development with Claude Code
- Amazon Q Developer just reached a 260 million dollar milestone
- Goldman Sachs is piloting its first autonomous coder in major AI milestone for Wall Street
- AI-powered success with more than 1,000 stories of customer transformation and innovation
- Vibe coding service Replit deleted production database
- AWS security bulletin AWS-2025-015 (Amazon Q Developer extension)
- CamoLeak: critical GitHub Copilot vulnerability leaks private source code
- Claude Platform release notes
- What’s new in Copilot Studio
- Gemini Enterprise Agent Platform release notes
- What’s new in Microsoft Entra Agent ID
- Amazon Bedrock AgentCore key features and benefits
- Agent Identity overview
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner