Transforming Software Development with Low-Code and AI

Software teams have stopped debating whether to use AI in development. A 2025 survey of 49,000+ developers found that 84% use or plan to use AI tools in their work, and IDC reports that 85% of developers now say at least some of their code is AI-generated. The open question is whether the applications produced at this pace are secure, maintainable, and trustworthy.

That tension between speed and reliability was the subject of an episode of Chain of Thought, where host Conor Bronsdon, Head of Developer Awareness at Galileo, and co-host Atindriyo Sanyal, the CTO and Co-Founder of Galileo, spoke with Rodrigo Coutinho, Co-Founder and AI Product Manager at OutSystems, about how AI and low-code platforms are reshaping enterprise development.

"The ability to do these iterations in seconds completely changes the way you work," Coutinho observed during the conversation. This article looks at what that acceleration has delivered since, what the research says about its costs, and what engineering leaders need to put in place before the speed pays off.

TLDR:

• AI-assisted and low-code development have converged into one market, and vendors now generate autonomous agents rather than just applications.
  Productivity findings split by task type: a 4,867-developer experiment measured a 26% task-throughput gain, while a controlled trial of experienced open-source developers measured a 19% slowdown.

• AI-generated code is creating technical debt at record rates, with code-block duplication up 81% and refactored code down from 21% to 3.8% of changes.

• Roughly 27% of code-assistant snippets carry security weaknesses, and teams generating 81-100% of their code with AI ship vulnerabilities 3.4x more often than conservative adopters.

• Governance is the binding constraint: only 13% of organizations report adequate AI agent governance, and half of enterprises have shipped an agent that passed internal evals and failed in production.

The Low-Code and AI Development Market Has Converged

Low-code and AI-assisted development began as separate categories and are now merging into one. IDC's 1Q26 Market Glance describes AI-assisted developer tools and low-code/no-code platforms with embedded generative AI as distinct but converging segments. Gartner projects the low-code development technologies market will reach $58.2 billion by 2029 at a 14.1% CAGR, while a 2025 global low-code survey based on 2,000+ global developers calls low-code "a first-class development technology globally."

The vendors have moved with the market. OutSystems took Mentor, its GenAI-powered digital worker for the full software development lifecycle, to general availability in January 2025, and in June 2026 announced its Agentic Systems Platform with Agentic Enterprise Orchestration built on Amazon Bedrock. Mentor now supports building agentic applications: describe what you want an agent to do, and it produces a complete agent configuration including prompts, tools, and model settings.

This is a long way from autocomplete. Low-code platforms now generate not just applications but autonomous agents, which raises the stakes for everything that follows.

How AI and Low-Code Accelerate Development, and Where the Gains Are Real

The core promise Coutinho described on the podcast holds up. "Now you can ask someone what they want. You do it live, and you have, in seconds, a prototype of what the person told you they wanted," he explained. Planning sessions become working sessions; a business analyst describes a feature and sees it modeled before the meeting ends. "Iterating in seconds during a meeting completely changes your workflow," Coutinho emphasized.

The measured evidence, though, is more varied than most vendor claims suggest, and the variation follows a pattern:

• A multi-firm randomized experiment across Microsoft, Accenture, and a Fortune 100 company, covering 4,867 developers, found a 26.08% increase in completed tasks with an AI coding assistant.

• METR's randomized controlled trial of 16 experienced open-source developers on 246 real tasks found the opposite: allowing AI use caused 19% longer completion times, a statistically significant slowdown confirmed in a February 2026 follow-up.

• Lab research found tasks like documentation completed in half the time, but savings fell below 10% for high-complexity work.

The pattern: gains are largest on routine, well-scoped tasks and shrink or reverse on complex work by experienced engineers. Leaders citing a single headline productivity number are usually citing the wrong one for their team.

The 2025 DORA report from Google Cloud, drawing on nearly 5,000 technology professionals, adds the operational caveat that matters most: AI adoption now shows a positive relationship with delivery throughput, reversing the 2024 finding, but it still increases delivery instability. Teams that ship faster with AI also ship shakier releases unless they invest in the discipline around it, which is why continuous integration practices built for AI systems matter more as generation speeds up, not less.

Technical Debt: The Bill for Unreviewed Speed

The original promise of low-code was that continuous iteration would reduce technical debt. Coutinho argued that "the ability to modernize applications incrementally rather than through massive rewrites changes the economics of software maintenance," and the modernization data backs the incremental approach: in the Mentor GA announcement, KPMG reported that AI-driven parsing of user stories and technical PDFs saved 40 to 50% of the time normally spent on manual entity and screen creation.

But AI-generated code is simultaneously creating debt at record rates. GitClear's 2026 analysis of 623 million code changes found code block duplication up 81% since 2023, the highest level on record, while refactored code fell from 21% of changes in 2022 to 3.8%. Two-week code churn rose 15%, and legacy refactoring dropped 74%. Developers are pasting more and cleaning up less.

MIT Sloan Management Review put it bluntly: "Implementing AI-generated code is often akin to borrowing at a much higher interest rate." The same research pegs aggregate U.S. technical debt at $2.4 trillion or more, with most organizations spending under 20% of their budget on remediation. The difference between AI as debt reducer and AI as debt generator comes down to whether review and evaluation keep pace with generation, which is the argument for bringing CI/CD rigor to the agent development lifecycle rather than bolting quality checks on afterward.

Democratization and the Developer's Shift From Author to Orchestrator

OutSystems saw the democratization wave early. "We started investing in AI back in 2018 specifically to help developers be more productive and create better enterprise applications," Coutinho said, an investment that predates the GenAI boom by four years. The wave has since arrived: industry projections show citizen developers will grow from 10% in 2025 to 70% by 2029, and GitHub's Octoverse reported over 36 million new developers joining the platform in a single year, with nearly 80% of them using Copilot within their first week.

Coutinho pushed back on one popular framing, though. He has argued that developing for GenAI "is not as simple as using natural language; it requires learning specific 'dialects' and engineering concepts." Democratization lowers the entry barrier; it does not eliminate the expertise requirement. It relocates it.

Where it relocates to is judgment. Software engineering trends describe developer roles shifting from implementation to orchestration, prioritizing problem-solving, system design, and AI oversight. Other research describes engineers becoming "orchestrators of parallel and asynchronous AI agents." That shift makes fluency in agent architecture patterns and governance a core skill rather than a specialist one.

"Even as we automate more aspects of development, human expertise remains essential for evaluating context and appropriateness," Coutinho emphasized on the podcast. The research since has only strengthened that position.

Security and Governance Risks in AI-Generated Applications

The vulnerability data for AI-generated code is consistent across independent studies:

• An ACM TOSEM study of 733 snippets from commercial code assistants found roughly 27.3% contained security weaknesses spanning 43 CWE categories.

• USENIX Security 2025 research on 2.23 million generated packages found a 19.7% package hallucination rate, non-existent dependencies that attackers can register as malicious packages, a supply chain attack class known as 'slopsquatting'.

• Enterprises are shipping anyway. Checkmarx's Future of AppSec research found nearly half of production code is now AI-generated, and organizations using 81 to 100% AI-generated code ship vulnerabilities 3.4 times more frequently than those using 20% or less.

Standards bodies have converged on the same prescription. NIST SP 800-218A states that "all source code should be evaluated for vulnerabilities and other issues before use," regardless of whether a human or an AI wrote it. OWASP's Application Security Verification Standard goes further: AI-generated code must be reviewed by an engineer who did not request the generation, and "the AI itself does not count as a human reviewer."

Governance lags badly behind adoption. Gartner reports that only 13% of organizations have appropriate AI agent governance, even as it projects the average Fortune 500 enterprise will run over 150,000 agents by 2028, up from fewer than 15 in 2025. Industry analysts warn that "application sprawl is growing faster than governance, integration, and lifecycle oversight." A separate Gartner forecast predicts over 40% of agentic AI projects will be canceled by end-2027 due to escalating costs, unclear business value, or inadequate risk controls.

The phased-adoption approach Coutinho and OutSystems have long recommended, expanding capabilities gradually while establishing governance structures, now has a concrete blueprint in an AI governance framework for production agents: inventory what exists, define quality thresholds, and enforce them before deployment rather than after an incident.

Evaluation Infrastructure Decides Whether AI-Powered Speed Compounds or Collapses

AI and low-code platforms have solved the generation problem. Teams prototype in seconds, ship in days, and produce code at volumes that would have been unimaginable three years ago. But the research is unambiguous about what happens without matching discipline: code duplication climbs 81%, refactoring drops to historic lows, roughly 27% of generated snippets carry security weaknesses, and half of enterprises have already deployed an agent that passed internal evals and failed in production. Speed without evaluation creates compounding debt; speed with evaluation creates compounding advantage. The difference is whether review, testing, and observability keep pace with generation, and that requires infrastructure purpose-built for non-deterministic systems. Galileo provides the evaluation and observability layer that AI development speed outruns:

• Luna-2 evaluation models: Purpose-built SLMs that evaluate 100% of traffic at $0.12 per million tokens and sub-200ms latency, making full-coverage evaluation practical instead of sampling.

• Signals: Automatic failure detection that surfaces security leaks, policy drift, and cascading failures across production traces without manual search.

• Agentic metrics: Purpose-built measures like Action Completion, Tool Selection Quality, and Tool Error that test whether agents accomplish user goals, not just produce plausible output.

• CI/CD evaluation gates: Experiments run as unit tests in your pipeline so behavioral regressions fail the build instead of reaching production.

• Eval-to-guardrail lifecycle: Offline evals become production-enforced standards automatically, closing the gap between testing and live governance without glue code.

• CLHF and Annotations: Human reviewer decisions feed back into evaluation metrics, continuously improving accuracy with as few as one to two feedback examples.

Book a demo to see how Galileo puts evaluation, visibility, and quality gates around your AI development lifecycle before speed outpaces reliability.

Frequently Asked Questions

Does AI Actually Make Developers Faster?

It depends almost entirely on task complexity and developer experience, and the two best-designed studies disagree for exactly that reason. A randomized experiment across Microsoft, Accenture, and a Fortune 100 firm covering 4,867 developers measured a 26.08% increase in completed tasks. METR's controlled trial of 16 experienced open-source maintainers working on 246 real tasks in familiar codebases measured 19% longer completion times. Routine, well-scoped work speeds up; complex work in a codebase the developer already knows deeply often slows down.

What Is the Difference Between Low-Code and AI-Assisted Development?

Low-code platforms provide visual modeling, prebuilt components, and managed deployment so that applications can be assembled rather than hand-coded. AI-assisted development generates source code or configuration from natural language inside a conventional toolchain. IDC now tracks these as converging rather than separate segments, because low-code vendors have embedded generative AI into their platforms while AI coding tools have added the scaffolding and governance features that used to distinguish low-code.

Is AI-Generated Code Secure Enough for Production?

Not without review. An ACM TOSEM study of 733 commercial code-assistant snippets found roughly 27.3% contained security weaknesses across 43 CWE categories, and dependency hallucination adds a distinct supply-chain risk at a measured 19.7% rate. The correlation at organizational scale is direct: teams where 81 to 100% of code is AI-generated ship vulnerabilities 3.4 times more often than teams at 20% or less. AI-generated code is production-ready only when it passes the same verification gates as human-written code.

Who Should Review AI-Generated Code?

An engineer who did not request the generation. OWASP's application security verification guidance is explicit that the AI does not count as a human reviewer, and NIST SP 800-218A requires all source code to be evaluated for vulnerabilities before use regardless of author. The practical implementation is a review policy that treats AI authorship as a metadata flag rather than a fast-track, plus automated duplication and churn thresholds in CI so the maintainability signals GitClear tracks fail the build rather than accumulate silently.

How Does Galileo Support AI and Low-Code Development Teams?

Galileo adds the evaluation and observability layer that generation speed outruns. Experiments run as unit tests inside CI/CD so a behavioral regression fails the build, Signals analyzes 100% of production traces for security leaks and policy drift, and agent-specific metrics such as Action Completion and Tool Selection Quality measure whether agents achieve user goals rather than just emit plausible output. Luna-2's cost profile is what makes evaluating every request practical instead of sampling a slice and hoping the tail is clean.