Your Commit Count Is Up. Your Ship Rate Is Down.

A founder pulled up his engineering dashboard on a call last quarter, grinning. Commits up. Pull requests up. Everyone on Copilot, Cursor, or Claude. Then someone asked how many of those PRs actually shipped to production that month. He went quiet, clicked around, and said, "Huh."

That "huh" is where a lot of teams are right now. AI is writing more code than ever, and less of it is getting out the door. Let me catch you up on what changed and what to do about it.

The dashboard is telling you a nice lie

The numbers that look best on a board slide are the ones AI inflates for free. CircleCI's 2026 report, built from more than 28 million CI/CD workflows, found daily workflow runs jumped 59% year over year, the biggest single-year jump they've recorded. Real change.

But for the median team, feature branch throughput rose 15% while main branch throughput actually fell. More code going in, less making it out. The top 5% of teams nearly doubled output. The bottom quartile got nothing. AI didn't lift everyone. It widened the gap between teams with solid delivery systems and teams without.

Split your throughput number in two. Feature branch activity tells you how fast your team can experiment. Main branch activity tells you how fast your team can deliver. The gap between those two lines is the most honest signal you have, and most tools bury it inside one "velocity" chart.

The bottleneck moved to review

Writing code was never the constraint. So buying another tool to write code faster does not help. The constraint moved downstream, to review, testing, and whatever gate separates "written" from "shipped."

One startup client sent every AI-generated PR through the same two reviewers who'd done code review the old way for years. Those two didn't get faster because the code arrived faster. Each PR took longer, because more of it needed checking for the confident-sounding mistakes these tools produce. One lead engineer put it bluntly in the Pragmatic Engineer survey of over 900 engineers: "I have no motivation in spending that time to review a giant PR where it's clear even the original author didn't bother to do that."

That is debt getting rolled forward, not a productivity gain. Put main branch success rate on your dashboard. The healthy target is around 90%. The industry average sits near 71%. That gap is where your AI story actually lives.

The happy path ships, the edge cases don't

AI gives you exactly what you asked for, which is the problem. A developer at LogRocket prompted for a "simple" React search component and got clean, polished code that looked ready to ship. Then he used it like a real user. He found a race condition, no empty state, no error handling, missing debounce, and no screen reader label on the search input.

None of those crashed anything. All of them would hit real users in production. The prompt asked for "simple," so the AI wrote happy-path code and skipped everything else. As he put it, the AI gave him what he asked for; he just didn't ask for enough production behavior.

The fix is a five-minute manual check before anything merges: type fast and delete mid-search, search for something that doesn't exist, tab through with a keyboard. That short pass caught four bugs. "Review happened" and "review meant anything" are different claims, and a five-minute approval on a 500-line AI diff is a data point worth looking at, not celebrating.

The code you didn't write can still run on your machine

The risk gets worse when AI reaches for dependencies. A modern JavaScript app can pull in hundreds or thousands of packages through transitive dependencies, and many run code at install time with access to your tokens, cloud credentials, and build secrets. In September 2025, a phishing attack on one npm maintainer hit widely used packages like debug and chalk. In May 2026, an attacker published 84 malicious versions across 42 TanStack packages through the legitimate release pipeline, which made them hard to spot. OpenAI later confirmed two employee devices were affected.

And the tools themselves act, not just suggest. Nick Babich points out that Claude Code is not a passive chatbot; it can inspect files, run commands, modify code, and connect to outside tools. That power sits right next to your most sensitive data. The question stops being "is this code good" and becomes "can I let this thing act on my behalf."

Commit your lockfile. Use npm ci, not npm install. Turn off install scripts where you can. Treat a dependency bump like a code change, not a rubber-stamp merge.

The deep cut

AI amplifies the engineering culture you already had. Teams with strong tests, clear architecture, and real review got faster and stayed clean. Teams that were loose on process got faster and messier, from the same tool, at the same time. The fix is not using AI less. It is fixing the thing AI just made visible.

The founder from that first call fixed it, and it was unglamorous: two more reviewers, a hard rule that nothing merges to main without passing the test suite, and a monthly look at main branch success rate instead of PR count. Nothing there makes a slide deck. It worked anyway. If your metrics say things are great and your gut says otherwise, go check main branch success rate before your next retro.

Three questions for your team

• Do you know your main branch success rate off the top of your head right now, and is it closer to 90% or 71%?
• When an AI-generated PR gets a five-minute approval on a 500-line diff, who is accountable for the edge cases, security, and accessibility that the prompt never asked for?
• Are dependency updates going through review and clean installs, or is a merged Dependabot PR going straight to production without a human looking at what it pulls in?