A Microsoft Distinguished Engineer decided, in a post on X on 09/03/2026, that nobody needs to type code anymore. Three weeks earlier, a report that tested more than 100 AI models had found a security vulnerability in nearly half of all code generation tasks. Both things are true at the same time, and that's what actually changes the job for anyone coding with AI every day.
What did Microsoft say about typing code?
David Fowler, a Microsoft Distinguished Engineer for 18 years (co-creator of SignalR, founder of NuGet and Kudu, now leading .NET Aspire), posted on 09/03/2026: "Typing code is absolutely over." He didn't say the developer job is over. He said the act of writing line by line, yes.
The statement isn't just a loose opinion. Microsoft is already moving its own tooling in that direction: Aspire versions 13.1 and 13.2 added agent and MCP protocol support, letting AI start services, read logs, and restart applications on its own. According to Satya Nadella, between 20% and 30% of the code written internally at Microsoft today already comes from an AI model, not a human keyboard.
What does security data show about that code?
Veracode's 2026 GenAI Code Security Report tested more than 100 models and found a security vulnerability in 44% of code generation tasks. The average security pass rate landed at 56%, virtually flat against the 55% of the prior report. The best model in the test, GPT-5.5, passed 68% of tasks. No model cleared 7 out of 10.
The problem isn't spread evenly. Models write code that compiles almost every time (syntax pass rate near 100%), but compiling isn't the same as being secure:
| Category tested | Security pass rate |
|---|---|
| Cryptography | 87% |
| SQL injection | 83% |
| Overall average (100+ models, all categories) | 56% |
| Cross-site scripting (XSS) | 15% |
| Log injection | 12% |
Source: Veracode, 2026 GenAI Code Security Report.
Can both things be true at the same time?
They can, and they aren't contradictory: AI really is writing more code every month, and that code fails security nearly half the time in whole categories, like XSS and log injection. The part Fowler describes as "you don't need to type anymore" and the part Veracode measures as "don't trust it without checking" are the same shift, seen from two angles.
That changes what counts as productivity. It's no longer the time to the first working code. It's how many rounds of review and fixing fit inside your budget before you trust what got generated. If every round of "find the flaw, ask for the fix, test again" eats into a quota that's running out, the real temptation is to accept the first result and move on.
Veracode's numbers show exactly where that second round is worth spending. The weakest categories become a minimum checklist before accepting AI-generated code:
- Did user input become an untreated query? The most common SQL injection flaw, when the model builds the query by string concatenation instead of a parameter.
- Does user data go straight to HTML or the DOM? Cross-site scripting was the worst-scoring category in the report, at 15% pass rate.
- Does the log record raw data, unmasked? Log injection had the worst rate of all, at 12%.
Asking the agent itself to answer those three questions about what it just wrote, before you accept it, costs less than finding the flaw in production.
Running the fix loop until the agent actually solves it, not just until the message runs out, is why Verboo Code doesn't charge by token. When reviewing and asking again costs nothing extra, the second, third, and fifth round of fixes cost the same as the first.
