AI for Engineering & Software
Software is the profession AI has changed most. Agents now read a codebase, edit many files, run the tests and open the pull request. The engineer's job tilts toward specifying, reviewing and owning the system around the model.
How AI is changing this work
- Coding agents take a task from issue to pull request, in your terminal, your editor or the cloud.
- Review becomes the bottleneck: more code arrives than before, and someone must still understand it.
- Building with models is ordinary engineering now: tools, tests, cost, latency and failure modes.
Your layers: the 5 that matter most
1. Layer 8 · Agents
Why it matters
This is where your daily work changed. An agent is a model in a loop with tools; how well it does depends on the harness, the permissions and the task you hand it.
What to do here
- Issue to pull request. Hand a well-scoped task to an agent, let it run tests, and review the diff like any colleague's. Coding agents
- Sandbox by default. Run agents with file and network limits, and approve the risky commands yourself. Agent permissions & sandboxing
- Parallel agents. Split independent tasks across agents; keep one owner for the merge. Multi-agent systems
- Know the harness. The loop, tools and context handling around the model explain most differences between agents. Agent harnesses
Examples as of 2026-11-11
2. Layer 7 · Orchestration & Tooling
Why it matters
Whether you use agents or build AI features, quality is decided here: what context the model sees, which tools it can call and which tests catch regressions.
What to do here
- Tools over a standard protocol. Expose internal systems to agents once, through a tool server, instead of per-app glue. Tool use & protocols (MCP)
- Instruction files. Keep build commands, conventions and pitfalls in a repo file the agent reads every time. Context engineering
- Evals in CI. Treat prompts like code: a test set that runs on every change and blocks regressions. Guardrails & evals
- Untrusted input stays data. Anything an agent reads, such as issues, web pages or tool output, can carry instructions. Prompt injection
Examples as of 2026-11-11
3. Layer 6 · Inference & Optimization
Why it matters
Every model call has a price, a wait and a rate limit. Routing, caching and where the model runs are engineering decisions with large effects.
What to do here
- One interface, many models. Put a router or gateway in front so you can switch models without rewriting. Model APIs & routers
- Prompt caching. Keep the stable prefix stable and cache it; agents re-send it on every step. Batching & KV caching
- Local for private or offline work. Run an open model on your own machine when code may not leave it. Local inference runtimes
Examples as of 2026-11-11
4. Layer 5 · Foundation Models
Why it matters
You do not need to train models, but knowing how they work explains their behaviour: context limits, token costs, why they invent APIs and when extra thinking helps.
What to do here
- Thinking on demand. Turn on extended reasoning for design and debugging; turn it off for simple edits. Reasoning models
- Tokens are the unit. Limits, speed and price are all counted in tokens, not characters or lines. Tokens & tokenization
- Open or closed. Open weights give control and privacy; closed models usually lead on the hardest tasks. Open vs closed weights
Examples as of 2026-11-11
5. Layer 9 · Applications & Interfaces
Why it matters
The assistant in your editor and your chat window is still where most quick questions go. It is the lightest way to use AI and the easiest to over-trust.
What to do here
- Inline completion and chat. Use it for boilerplate, tests and unfamiliar APIs, and read what it writes. Copilots
- Explain before you change. Ask for a walkthrough of unfamiliar code before asking for edits. Chat assistants
Examples as of 2026-11-11
High-leverage use cases
- Scoped tasks to agents. Bug fixes, tests, migrations and upgrades with a clear definition of done.
- Codebase questions. Ask how a system works and get an answer with file references.
- Test and doc coverage. Generate missing tests and documentation, then review them.
- Internal tools as agent tools. Expose deploy, logs and tickets to agents through one tool server with permissions.
- Review assistance. A first-pass review for bugs and risky changes before a human reviewer.
Start here: the next 30 to 60 days
- Week 1 to 2. Write an agent instruction file for one repo: how to build, test and what never to touch.
- Week 3 to 4. Give an agent ten small real tickets. Record which succeeded, which failed and why.
- Day 30 to 60. Set team rules: sandbox settings, which commands need approval, and that the author owns agent-written code.
- Day 30 to 60. Connect one internal system as a tool, with read-only access first.
Risks and pitfalls
- Feeling faster than you are. In one controlled study, experienced developers on their own projects were slower with AI tools while believing they were faster. Measure on your own work. (Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity (METR))
- Insecure generated code. A study of assistant-written code found a large share of security-relevant completions were vulnerable. Review and scan as you would any code. (Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions)
- Agents with broad access. An agent with your credentials can delete, push and deploy. Sandbox it and keep approvals on destructive actions. (OWASP Top 10 for Agentic Applications)
- Instructions hidden in content. A comment in an issue or a web page can redirect an agent that reads it. (OWASP Top 10 for LLM Applications)
- Code nobody understands. Merged code still needs an owner who can explain it. Keep pull requests small enough to review.
Sources
A product named on this page is an example, not a recommendation.
- Claude Code (code.claude.com) (2026-11-11)
- OpenAI Codex (developers.openai.com) (2026-11-11)
- Cursor (cursor.com) (2026-11-11)
- GitHub Copilot cloud agent (github.com) (2026-11-11)
- Model Context Protocol (MCP) (modelcontextprotocol.io) (2026-11-11)
- LangSmith (LangChain) (langchain.com) (2026-11-11)
- Braintrust (braintrust.dev) (2026-11-11)
- OpenRouter (openrouter.ai) (2026-11-11)
- Amazon Bedrock (aws.amazon.com) (2026-11-11)
- Ollama (docs.ollama.com) (2026-11-11)
- vLLM (github.com) (2026-11-11)
- Claude extended thinking (platform.claude.com) (2026-11-11)
- DeepSeek-R1 (open weights) (huggingface.co) (2026-11-11)
- Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity (METR) (2025-07-12)
- Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions (2021-08-20)
- OWASP Top 10 for Agentic Applications (2025-12-09)
- OWASP Top 10 for LLM Applications (2026)
Other roles
HR & People · Finance · Sales · Marketing · Product & Design · Cybersecurity · Legal & Compliance · Operations · Customer Support