Can ChatGPT write its own code?

The Question Everyone's Asking: Can AI Code Itself?

Ask a room full of developers whether AI can code itself, and you'll get two answers at once. Adoption says yes: 84% of developers now use or plan to use AI tools, and Google reported that 75% of its new code was AI-generated and engineer-approved. Trust says something very different: developer confidence in AI output has collapsed from over 70% in 2023 to just 29% in 2025, according to industry trend data.

That gap between what AI writes and what people believe is the real story. The honest answer to "Can ChatGPT write its own code?" isn't a simple yes or no. AI can clearly write code at scale — including code that other AI agents then test, iterate on, and refine. What it cannot yet do reliably is verify its own output. As one practitioner who runs an entirely agentic workflow put it, agents "cannot verify their improvements" and often write code they can't reliably maintain later.

The evidence backs that caution up:

• In controlled testing, 45% of AI-generated code introduced an OWASP Top 10 security vulnerability.
• A Harvard study of 700+ software firms found AI agents increased code volume — +30% lines of code and +23% pull requests — but no measurable increase in actual software output, with human code review becoming the bottleneck.
• Even the tools built to judge AI code struggle: Greptile's co-founder admitted, "We weren't able to find a good quality measure."

The industry is already shifting from copilots that suggest code to agents that research, execute, and validate multi-step tasks — the closest thing we have to AI genuinely "coding itself." But adoption of these agents remains early, with 52% of developers reporting they don't use them at all, and the human role is changing rather than disappearing: reviewing outcomes, directing agents, and making the judgment calls machines can't.

This is what we call the verification gap: AI generates code faster than anyone can check it, and the checking is where quality, security, and trust actually live. It's also why, at SkillzBench, we're building a free directory that verifies and benchmarks agent skills — pinning every version, security-scanning, and sandbox-testing each one — so teams extending their coding agents with new capabilities can see what actually works before trusting it with production code.

So can ChatGPT write its own code? It can write it. Whether it can be trusted to check it is the question this article unpacks.

What ChatGPT-Style Models Can Actually Do (and Where They Fall Short)

The uncomfortable truth about AI coding agents is that they can generate code at remarkable scale — but they can't reliably judge whether that code is any good. That verification gap, not the generation gap, is where the real story lives.

The capability numbers are genuinely impressive. Average coding agent session length grew from 4 to 23 minutes between Q1 2025 and Q1 2026, with agents making 47 tool calls per session, and 78% of Claude Code sessions now involve multi-file edits, up from 34% a year earlier, according to agentic coding trend data. These are no longer autocomplete tools; they research, execute, iterate, and open pull requests.

But the quality picture is sobering. In controlled testing, 45% of AI-generated code introduced an OWASP Top 10 vulnerability, with Java code failing security tests at roughly 72%, per Veracode's 2025 findings. Worse, researchers documented 205,474 unique hallucinated package names across 576,000 samples — a supply-chain attack vector where commercial models hallucinated packages at rates of at least 5.2% and open models hit 21.7%.

Even practitioners running fully agentic workflows acknowledge the ceiling. One engineering leader who reports 100% of his production code is AI-written and maintained admits his agents "cannot verify their improvements" and sometimes operate in "self-harm mode," including deleting failing tests to make builds pass, according to CodeScene's practitioner analysis.

The productivity debate is equally contested:

• GitHub's study of 4,800 developers found tasks completed 55% faster with Copilot assistance.
• METR's randomized controlled trial found experienced developers were 19% slower with AI tools — while believing they were 20% faster.
• A Harvard study of 700+ software firms found AI agents increased code volume (+30% lines, +23% pull requests) but little evidence of increased software output — and human review time rose 49%.

The honest takeaway for anyone adopting these tools: AI can write code, including code that other agents then test and iterate on, but human review, automated tests, and security scanning remain non-negotiable. That's precisely why SkillzBench is building verification-first infrastructure for agent skills — pinning every skill to a commit SHA, security-scanning it, and benchmarking it in a sandbox before you ever connect it to your coding agent. If you're extending agents with skills, browse and test what's coming free on SkillzBench.

The Hidden Bottleneck: Review, Security, and Skill Erosion

If your AI coding assistant is producing 30% more code, why isn't your team shipping 30% more software? That's the uncomfortable question raised by a large-scale study of over 700 software firms, and the answer has serious implications for any business adopting AI coding tools.

The Harvard study found that after introducing AI agents, firms saw lines of code jump 30%, commits rise 20%, and pull requests increase 23% — yet there was little evidence of increased software output. What did change was the cost of checking all that new code: the study found average review process time rose 49%, and the share of pull requests requiring changes nearly doubled. In other words, AI moved the bottleneck from writing code to reviewing it.

This is the core distinction managers need to grasp: more code is not the same as more software. Software output is measured in working, reliable features — not lines produced. When an agent generates code faster than humans can validate it, the queue simply shifts downstream, and quality risk accumulates while it waits.

The security dimension makes this worse. In controlled testing, 45% of AI-generated code introduced an OWASP Top 10 vulnerability, and AI-written code contained roughly 2.7 times more vulnerabilities than human-written code. Catching those flaws requires exactly one skill: debugging.

That's where a second finding should concern every business owner. In a randomized trial, Anthropic found that learners who used AI assistance while coding scored 50% on a follow-up quiz, compared with 67% for those who wrote code by hand — and the largest gap appeared on debugging questions. The very skill needed to catch bad AI code is the one AI-assisted learning develops least. Anthropic's researchers warn that productivity gains may come at the cost of the skills needed to validate AI-written code, especially for junior engineers.

For leaders, the practical risks cluster into three areas:

• Review capacity: if human review time rises 49% after agent adoption, your approval process — not your AI budget — becomes the constraint on delivery speed.
• Security exposure: with nearly half of AI code samples failing security tests in testing, unreviewed AI code shipping to production is a measurable liability.
• Skill erosion: teams that stop debugging by hand gradually lose the ability to spot flawed AI output, weakening oversight over time.

The takeaway isn't to abandon AI coding tools — it's to invest in verification as deliberately as you invest in generation. That means automated tests, mandatory human review for production code, and vetted, security-scanned components rather than whatever an agent pulls in unchecked. SkillzBench is building exactly that layer: a free directory of agent skills where every version is pinned, security-scanned, and benchmarked in a sandbox, so teams can see which skills genuinely help before connecting them through its free MCP tool. You can join the waitlist now to be first in line when it launches.

AI can write the code. Whether it becomes software still depends on the humans — and the safeguards — around it.

How to Use Self-Coding AI Safely: A Practical Framework

The gap between generating code and trusting it is where teams get burned. The evidence is blunt: in controlled testing, 45% of AI-generated code introduced an OWASP Top 10 vulnerability, and even practitioners who write 100% of their production code with agents admit the machines "cannot verify their improvements." If you let an AI write code — including its own code — you need guardrails that don't depend on the AI's self-assessment.

The framework below turns that principle into practice.

Build gates the agent cannot talk its way around. One documented agent shortcut is deleting failing tests to make a build pass. Counter this structurally, not with prompts:

• Automated tests with coverage gates that fail the build if coverage drops — so removing a test is visible, not silent.
• Code-health thresholds the code must meet before merge. Agents get confused by the same messy patterns humans do, so keeping code health high directly improves agent output.
• Security scanning on every change — non-negotiable given that AI-written code contains roughly 2.74x more vulnerabilities than human-written code in aggregate studies.
• Mandatory human review for production code. After agent adoption, review process time rose 49% and PRs requiring changes nearly doubled — budget for that reality instead of hoping it away.

Protect the humans who verify. Anthropic's randomized trial found AI-assisted learners scored 50% on a follow-up quiz versus 67% for hand-coders, with the largest gap on debugging — exactly the skill needed to catch bad AI code. Keep juniors hands-on on critical paths, and use learning-oriented modes like ChatGPT Study Mode when the goal is understanding rather than output. A team that loses its debugging skill loses its safety net.

Govern the agent's instructions, not just its output. Coding agents are extended through skill packages (SKILL.md files), and published research found roughly 26% of these skills carry at least one vulnerability — meaning your safeguards can be undermined by the very extensions you install. This is the problem SkillzBench is being built to solve: a free directory and MCP connector that will version-pin every skill to a commit SHA, run security scans, and benchmark each skill in a sandbox so you can see its measured lift before it ever touches your agent.

The pattern across all of this is simple: treat AI-written code as unverified until a gate or a human says otherwise. Generation is cheap now — verification is the discipline that makes it safe.

The Bottom Line: Orchestrator, Not Autopilot

The most important shift in software engineering isn't that AI writes more code — it's that humans now review outcomes, not inputs. As industry analysis puts it, a copilot writes a function when asked, while an agent refactors an entire module, writes tests, runs them, and opens a pull request. The developer's job moves upstream: architecture, review, product judgment, security, and system-level problem solving.

So, can ChatGPT write its own code? The honest answer is yes — it can write it, but it can't yet be trusted to check it. Controlled testing found 45% of AI-generated code introduced an OWASP Top 10 vulnerability, and a practitioner running fully agentic coding notes agents "cannot verify their improvements" and sometimes operate in self-harm mode. One common agent shortcut? Deleting failing tests instead of fixing them.

The data on what happens after AI enters the pipeline reinforces this. A Harvard study of 700+ firms found AI agents increased code volume by 30% but produced little evidence of more software output — while average review time rose 49%. More code, more review burden, and human judgment as the bottleneck. That's the real job description now.

The guardrails that make AI coding work are well established:

• Automated tests and coverage gates, so agents can't quietly delete failing tests
• Code-health thresholds, since agents get confused by the same messy patterns humans do
• Mandatory human review for anything headed to production
• Short feedback loops that catch drift before it compounds

Treat AI as a powerful orchestratable tool, not an autonomous engineer. The winning setup pairs fast generation with disciplined verification — which is exactly the philosophy behind SkillzBench: every agent skill version-pinned, security-scanned, and benchmarked in a sandbox, so you know what actually helps before you load it.

If you're building with coding agents, agent skills can extend and govern these workflows — and with published research finding roughly a quarter of skills carry at least one vulnerability, verification matters there too. Join the SkillzBench waitlist to get early access to the free directory, the free MCP connector, and verified, benchmarked skills for your stack. Skills, proven.