AI Agents in Software Engineering: Sonar and McKinsey Break Down Three Keys to Scaling

Over 80% of enterprises claim to have deployed AI or agents in their workflows, but fewer than one-third have truly achieved scale and seen business returns. This is a data point that surfaced repeatedly in joint research by Sonar and McKinsey. In a panel discussion at AI Engineer, Sonar CEO Tarek Shalaby and Ali — former head of Uber's developer platform and former CEO of Guitar — broke down the structural reasons behind this "AI implementation gap."

The Vast Majority of Enterprises Are Stuck at "Level Two"

McKinsey categorizes enterprise AI maturity into different stages. Most companies today are at what's called "Level Two" — humans guide and validate agents, while agents execute tasks across the SDLC (software development lifecycle). Very few have actually reached "Level Three" (end-to-end automated workflows with only human oversight).

Although most deployments stall at the POC stage, enterprises that have deployed AI end-to-end across the organization are already seeing significant gains: increased PR throughput, shorter PR cycle times, improved self-reported developer productivity, and acceleration of tasks across every stage of the SDLC.

SDLC (Software Development Lifecycle) refers to the complete loop of software from requirements, design, development, testing, and deployment to operations. The traditional SDLC centers on humans as key nodes, with each stage handed off serially between different roles; once agents are introduced, these formerly serial stages can run in parallel, be triggered in batches, and even have agents autonomously decide the next action. This is precisely the significance of the maturity tiers — it's not about replacing the tool at a single stage with AI, but about redefining how stages connect to one another. Therefore, when assessing enterprise AI maturity, the key metric is not "how many AI tools are used" but "how many SDLC stages are already driven end-to-end by agents, with humans retaining only oversight."

Three Pillars: Process, Tools, People

The research distills three factors that help organizations scale.

The first is redesigning processes. Rather than copying the traditional SDLC, it means reimagining the entire workflow end-to-end and seriously considering how agents will change each stage. This is a fundamentally different path from "patching AI onto old processes."

The second is the toolchain. This includes good agents, a good harness, a good context layer, and so on. But what Tarek repeatedly emphasized is this: good tools are a necessary condition, not a sufficient one.

The third — and most easily overlooked — is people. Tarek pointed out that traditional role boundaries (what is a software engineer, what is a product manager, what is a designer) are blurring. Organizations that recognize this shift and reshape their entire operating model around it are the ones truly tapping into the 10x productivity AI brings. Those who were initially skeptical — "agents just do tasks, nothing else needs to change" — gradually came around in practice: the way an organization organizes itself must itself be rethought and reshaped.

Harness (agent runtime framework) refers to the engineered shell wrapped around the underlying large model, responsible for tool invocation, state management, error retries, permission control, context injection, and output validation. The same model with different harnesses can perform several times differently in practice. The context layer, meanwhile, is responsible for feeding the right information (codebase, specifications, history, organizational knowledge) to agents at the right moment, directly determining the quality of their decisions. This is also the technical foundation for Tarek's emphasis that "tools are a necessary but not sufficient condition": polishing the harness and context layer is just the entry ticket — if the process and the way people are organized don't change, the tool dividends will be devoured by the old structure.

A software engineering generalist refers to an engineer who can cross traditional front-end/back-end, testing, operations, and product design boundaries, leveraging agents to deliver end-to-end. The rise of this role is not about stacking skills, but rather because once agents absorb much of the mechanical, repetitive execution work, human value concentrates on problem definition, solution trade-offs, and result validation. Accordingly, critical thinking has shifted from a soft skill to hard currency: engineers need to judge whether an agent's output is trustworthy, whether edge cases are covered, and whether a solution actually solves the business problem. If organizations still evaluate such people by old job levels and old divisions of labor, generalists cannot be identified and incentivized, and reshaping the operating model becomes impossible.

One-line Summary

Over 80% of enterprises deploy AI, but fewer than one-third achieve scale returns — the key to breaking through lies in simultaneously reshaping process, tools, and people.

Paragraph Summary

Joint research by Sonar and McKinsey shows that over 80% of enterprises claim to have deployed AI or agents, but fewer than one-third have truly achieved scale and seen business returns. Most companies are stuck at "Level Two" of McKinsey's maturity model — humans guide and validate agents executing tasks across the SDLC — and very few reach "Level Three" end-to-end automation. The research identifies three pillars of scaling: redesigning end-to-end processes rather than patching AI onto old ones, building a complete toolchain including agents and harnesses, and the most easily overlooked reshaping of people and the operating model. As traditional role boundaries blur, software engineering generalists and critical thinking become central, and trust in agent automation evolves in a ladder-like progression from review to auto-approve.