Claude Code took #1 in eight months. Your baseline is stale.

The Pragmatic Engineer's survey of 906 senior engineers (median 11–15 years experience) landed this week with numbers that should force a rewrite of most Q2 plans. 95% use AI weekly. 56% do 70%+ of their work with it. 55% regularly hand tasks to autonomous agents, and Staff+ engineers lead that adoption at 63.5%. Claude Code — which did not exist in May 2025 — is now the #1 AI coding tool, having displaced a four-year GitHub Copilot incumbency in eight months. Cursor cleared $2B ARR at a $29.3B valuation with 60% enterprise revenue. Anthropic's Opus and Sonnet 4.5 are mentioned more than every other model combined for coding work.

Yes, but — the counter-read is that senior-engineer surveys select for early adopters and inflate the numbers versus what a random enterprise looks like. Fair. The Copilot-at-56%-in-10K+-companies data point in the same survey confirms enterprise procurement is still throttling adoption. That's exactly the problem: if your competitor's org clears Claude Code in three weeks and yours takes nine months, the productivity gap compounds every sprint you don't close it.

Two things follow from the survey that most planning docs haven't caught up to. First, your sprint capacity model is calibrated on an engineering workforce that no longer exists. If 56% of your team is doing 70%+ of the work with AI, historical velocity data is a rear-view mirror. Second, terminal-first agentic workflows are the dominant new pattern — split-screen with Claude Code driving and the IDE for review — which is invisible to browser-based DLP and CASB. Your security team's tool inventory is almost certainly wrong.

The value is migrating up the stack, fast

While the tool layer churned, the model layer commoditized. Sonnet 4.6 lands at 79.6% on agentic coding versus Opus 4.6 at 80.8% — a 1.2-point gap at 40% less cost ($3/$15 vs $5/$25 per million tokens), with a 1M-token context window at mid-tier pricing. Alibaba's Qwen 3.5 9B claims to beat OpenAI's gpt-oss-120B under Apache 2.0. Take the Qwen benchmarks with tongs — ARC-AGI-2 scores for Chinese open-weight models still sit in the 4–12% range, well below frontier labs. Use them for narrow, benchmarked tasks. Don't trust them for general reasoning.

The deeper structural move: OpenAI is building a GitHub competitor and actively discussing commercialization, while launching stateful agent services on AWS via a Bedrock-native orchestration layer. That second move is elegant — Microsoft's exclusivity covers stateless model access, not stateful agent runtimes, so the workaround is legal by construction. OpenAI projects non-API revenue will exceed API revenue by 2028, meaning the exclusivity covers the shrinking half of the business. Amazon's $50B conditional investment is milestone-gated. Even the biggest allocators are hedging on timelines.

What this means for whoever has to ship something next quarter: the defensible layer is no longer model access. It's the stateful agent runtime, the workflow integration, and the proprietary context that lives between the model and your customer. If you're building a thin wrapper on any single model API, you're building on sand.

The auth stack broke in the same week

Starkiller launched as a commercial phishing-as-a-service platform running Adversary-in-the-Middle reverse proxies. The victim sees the real login page, enters real credentials, completes real MFA, and the proxy pockets the authenticated session cookie. TOTP, SMS, and push MFA are not defeated — they are made irrelevant, because the attacker gets the post-authentication session. Your MFA logs show a clean, successful login. Microsoft simultaneously confirmed OAuth redirect abuse campaigns against government targets, using intentionally invalid scopes to force error redirects that deliver malware without stealing tokens. And CVE-2026-0628 (CVSS 8.8) showed a Chrome extension with basic permissions could hijack Gemini Live to reach camera, mic, and local files.

The only architectural answer to Starkiller is FIDO2/WebAuthn/passkeys, where the credential is cryptographically bound to origin and a proxy on a different domain simply cannot complete the handshake. Start with admin panels, CI/CD, and privileged accounts this week. Not this quarter.

Meanwhile, an AI bot called hackerbot-claw scanned 47,000+ repositories, identified vulnerabilities, and autonomously exploited them — compromising open-source projects from DataDog, Microsoft, and Aqua Security, including Trivy, one of the most widely deployed container security scanners. Aqua renamed and privatized the repo. If Trivy is in your CI, your container scanning tool was itself compromised by an AI attacker. That is the sentence to read twice.

Stack these against the survey data and you get the actual Q2 problem: AI-generated code introduces security flaws in 45% of Veracode's tests, developers using AI assistants write less secure code while being more confident it's safe, and the tools they're using — terminal agents like Claude Code with direct filesystem and shell access — are invisible to the browser-based DLP most orgs still trust.

What to do this week

One action, tight deadline: get an actual inventory of the AI tools your engineers are running, including terminal agents, by Friday. Survey what people use, not what procurement approved. Map data flows for each. Then set two follow-on gates before end of sprint: SAST/DAST on 100% of PRs with rules tuned for common AI-generated failure modes (hardcoded secrets, missing validation, insecure deserialization), and FIDO2 enrollment for every privileged account. If your procurement cycle is still measured in quarters, that's the meta-fix — because in a market where the #1 tool didn't exist ten months ago, a nine-month approval cycle is a strategy of unilateral disarmament.