TL;DR overview
- Shadow AI is already writing production code: 35% of AI tool usage in development happens through personal, ungoverned accounts rather than work-sanctioned channels—with 52% of ChatGPT usage occurring via personal accounts.
- Developers treat AI tools like a utility belt rather than a monolithic platform, using multiple tools for different tasks, creating a fragmented governance challenge that IT-provisioned tool policies alone cannot solve.
- The bring your own AI (BYOAI) trend means organizations cannot rely on controlling tool access to govern AI-generated code quality; enforcement must happen at the code level, not the tool access level.
- Integrating SonarQube's AI Code Assurance into CI/CD pipelines creates a governance layer that applies consistent quality and security standards to all code regardless of which AI tool or personal account generated it.
In the first two chapters of our State of Code Developer Survey report, we explored the new reality of AI-assisted software development and the critical "trust gap" emerging between the speed of generation and the confidence in the output. We learned that while AI is accelerating coding, it is also creating a bottleneck in code verification.
But before code can be verified, it has to be written. This raises a fundamental question for engineering leaders: where is this code actually coming from?
In the third chapter of the report, we examine the tools developers are choosing to get the job done. The data reveals a fragmented landscape where standard corporate toolkits are competing with a massive wave of "bring your own AI" adoption.
The top 10 AI coding tools developers are using
When we look at the market for AI coding assistants, two names dominate the conversation. Our survey of over 1,100 developers confirms that GitHub Copilot and ChatGPT are the undisputed leaders, used by 75% and 74% of developers, respectively.
But while these two giants lead the pack, the data reveals a rich ecosystem of 10 distinct tools actively vying for developer attention. Claude has secured a strong third position with 48% usage, followed by Gemini (37%) and the AI-native IDE Cursor (31%). The top 10 is rounded out by Perplexity (21%), OpenAI Codex (21%), JetBrains AI Assistant (17%), Amazon Q Developer (12%), and newer entrants like Windsurf (8%).
The reality of tool fragmentation
People are often surprised to see ChatGPT near the top of this list. But it’s important to remember that, despite the dominance of a few key players in the AI coding space, development teams are not standardizing on a single solution. The reality is far more complex.
On average, software development teams are juggling four different AI tools and using them across a variety of different tasks.
This indicates that developers are treating generative AI tools less like a monolithic platform and more like a utility belt. They might use Copilot for autocomplete in the IDE, ChatGPT for explaining complex logic, and Claude for drafting documentation. This fragmentation suggests that no single tool has yet solved the entire software development lifecycle perfectly.
The hidden risk of "shadow AI"
The most pressing finding for engineering leaders is not just what tools are being used, but the provenance under which they are being accessed.
Our data shows that a significant portion of AI adoption is happening outside of official corporate channels. Across the top ten AI tools, 35% of developers are accessing them through personal accounts rather than work-sanctioned ones.
This trend is most visible with general-purpose tools:
- 52% of developers accessing ChatGPT use a personal account.
- 63% of Perplexity users use a personal account.
In contrast, tools that integrate deeper into the enterprise workflow show much higher rates of official adoption. GitHub Copilot and Amazon Q Developer both see only 17% personal account usage, suggesting successful top-down deployment strategies.
For leaders, this shadow adoption creates a massive blind spot for security and compliance. When developers use personal accounts, sensitive IP and customer data may be leaving the secure corporate environment, often without any oversight.
Adoption varies by size and experience
The landscape appears different depending on where you look. Large enterprises and small businesses are charting different courses.
- SMBs prioritize flexibility: Smaller companies are more likely to embrace a wider range of tools like ChatGPT, Claude, and JetBrains AI than their enterprise counterparts.
- Enterprises lock it down: Large organizations are more likely to standardize on governed tools like GitHub Copilot and Amazon Q Developer, reflecting a focus on compliance and security.
Experience levels also drive tool choice. Junior software developers are the primary adopters of newer, more experimental tools like Cursor, Perplexity, and OpenAI Codex. Senior developers, perhaps more cautious or set in their development workflows, tend to stick with established, sanctioned coding tools.
The takeaway
The data paints a clear picture: software developers aren't waiting for permission to innovate. They are actively building their own personal toolchains to get work done faster.
For engineering organizations, the challenge is no longer just about selecting a vendor. It is about managing a "bring your own AI" culture that is already here. The goal is to bring this shadow usage into the light—providing software developers with the verified, secure access they need so they don't have to go outside the guardrails to be productive.
Read the full report
This tool sprawl is just one part of the story. The full State of Code Developer Survey report covers the complete impact of AI on technical debt, agentic workflows, and the differing perspectives of junior and senior developers.