How to Use AI for Coding: A Practical Walkthrough

The AI Coding Reality: Adoption Is Universal, Results Aren't

AI coding assistance has quietly become the default way software gets written. According to the 2025 Stack Overflow Developer Survey, 84% of developers are using or planning to use AI tools, and 51% of professional developers now reach for them daily. For new entrants to the field, AI-assisted coding isn't an advanced technique — it's the starting posture.

But adoption and results are two very different things. The gains depend almost entirely on how you use AI, not whether you use it.

The most uncomfortable evidence comes from a randomized trial by METR, a non-profit research organization. In their study of experienced open-source maintainers, developers working on mature codebases took 19% longer when using AI tools — yet they forecast a 24% speedup beforehand and, afterward, still believed AI had made them 20% faster. Perception and reality pointed in opposite directions.

Security tells a similar story of hidden downside. Veracode's research found that 45% of AI-generated code contains a security vulnerability, and it gets worse the longer you iterate: one study of 400 code samples found vulnerabilities per sample rising from 2.1 in early iterations to 6.7 after eight to ten rounds — even when developers explicitly prompted for secure code. As Endor Labs researcher Chris Hughes put it, "You can't prompt your way out of these problems."

The pattern across the research is consistent:

• Daily AI users merge roughly 60% more pull requests than non-users, so real productivity gains exist.
• Those gains shrink or reverse on large, mature codebases with high standards and unwritten conventions.
• Learners who delegate fully to AI scored 50% on comprehension tests versus 67% for hand-coders in an Anthropic trial.
• Security flaws accumulate silently with each AI iteration, regardless of prompting.

None of this argues against using AI for coding. It argues against using it blindly. The developers who benefit treat AI as a tool with known failure modes — they verify security with real safeguards rather than hopeful prompts, they stay engaged with the code instead of pasting and moving on, and they measure actual time savings rather than trusting their gut.

That's the workflow this article walks through: choosing tools by the task at hand, interacting with AI in ways that build rather than erode your skills, and building verification steps that catch what the model misses. Tools like SkillzBench are being built around exactly this problem — helping developers find and vet the agent skills and MCP-based safeguards that make AI coding workflows trustworthy. The upside is real. So are the pitfalls, and every one of them is documented.

Pick Tools by Workflow, Not by Hype

With 84% of developers now using or planning to use AI tools — and 51% of professionals reaching for them daily, per the Stack Overflow 2025 Developer Survey — the question is no longer whether to adopt AI coding, but which tool fits the job at hand. As one industry analysis puts it, the best tool "depends less on which model writes the best function and more on what kind of workflow you want to automate."

The first distinction to understand is assistant versus agent. An assistant works inside your editor — autocomplete, explanations, refactoring suggestions. An agent takes a larger task, inspects the repository, edits multiple files, runs commands, and iterates with far less step-by-step prompting. Claude Code, Cursor, and Copilot now all operate as agentic systems capable of multi-file editing and autonomous planning, according to a SitePoint comparison.

That means tool selection should follow your task type, not benchmarks or marketing:

• Everyday editing — GitHub Copilot, which rewards existing GitHub investment and is used by 90% of the Fortune 100.
• Terminal-first agentic work — Claude Code, OpenAI Codex, or Aider for developers comfortable in the shell.
• AI-native IDEs — Cursor or Windsurf, which reward visual-diff workflows; Cursor counts 67% of the Fortune 500 among its users.
• Browser-based app generation — Replit Agent for building something runnable fast.

Knowing when to delegate matters as much as the tool choice. A randomized trial from Anthropic found developers who simply delegated to AI scored 50% on comprehension quizzes versus 67% for hand-coders — and the largest gap was on debugging questions, the exact skill needed to catch AI errors. Step-by-step prompting, where you review each change and ask follow-up questions, keeps you in the loop; full delegation suits well-scoped, low-risk tasks.

There is no single best tool for everyone, and survey figures on tool usage diverge by 28–39 percentage points depending on methodology, so treat any "winner" claim skeptically. Pick by workflow, then verify the choice on your own codebase — METR's randomized study found experienced developers believed they were 20% faster while actually being 19% slower on mature repositories.

If you're equipping an agent like Claude Code or Cursor, remember that what the agent can do depends on the skills and tools you give it. SkillzBench is building a free, independent directory of agent skills — each version-pinned, security-scanned, and benchmarked in a sandbox — plus a free MCP connector, so you can discover and test skills for your agentic workflow before trusting them in production.

Use AI to Understand Code, Not Just Generate It

The fastest way to write code with AI might also be the fastest way to stop understanding it. That tension sits at the heart of a randomized trial from Anthropic, where developers learning a new library with AI assistance scored 50% on a comprehension quiz — while a hand-coding group scored 67%. The effect was statistically significant, and the pattern behind it is what matters.

When researchers analyzed how participants actually interacted with AI, two clusters emerged. Delegation-style patterns — asking AI to write the code, leaning on it progressively, letting it debug — averaged quiz scores below 40%. Explanation- and inquiry-driven patterns scored 65% or higher. Same tools, same task, radically different outcomes. The difference wasn't the AI; it was the interaction.

Debugging was the biggest casualty. The largest score gap between groups appeared on debugging questions — precisely the skill developers need to catch errors in AI-generated code. If you can't debug what the model produces, you can't safely delegate anything. Anthropic's researchers put it plainly: cognitive effort, and even getting painfully stuck, is likely important for fostering mastery.

So how do you use AI as a tutor rather than a crutch? The research points to three concrete habits:

• Ask for explanations, not just output. Before accepting generated code, ask why it works — this mirrors the hybrid code-explanation pattern that scored 65%+.
• Pose conceptual questions while you work ("why does this pattern avoid the race condition?"), matching the conceptual-inquiry pattern that kept comprehension high.
• Generate, then comprehend: have AI produce a draft, then walk through it line by line yourself before pasting anything into your project.

The generate-then-comprehend approach deserves emphasis because it inverts the usual prompt-and-paste workflow. You still get the speed benefit of AI generation, but you close the loop by forcing yourself to read what was written. Over time, that reading compounds into genuine skill rather than dependency.

This matters beyond personal growth. A separate study of 400 code samples found vulnerabilities per sample climbed from 2.1 to 6.7 as developers iterated with AI — even when explicitly prompted for security. Developers who understand their code are the last line of defense against that drift; developers who merely paste it are not.

If you want to go further, agent skills — reusable instruction packages for tools like Claude Code, Cursor, and Codex — can enforce habits like test-first generation and structured review. SkillzBench is building a free directory that verifies, security-scans, and benchmarks these skills so you can see which ones genuinely help. In the meantime, the simplest safeguard costs nothing: before you accept the next suggestion, ask the model to explain it — and make sure you understand the answer.

Build Security and Verification Into Every AI Coding Loop

Every AI-generated line of code is a claim your security posture now has to verify. The uncomfortable finding from Endor Labs' analysis of 400 code samples across 40 iteration rounds: vulnerabilities per sample rose from 2.1 in early iterations to 6.7 by iterations 8–10 — even when the model was explicitly prompted to write secure code. As Endor Labs' Chris Hughes put it, "you can't prompt your way out of these problems."

The broader picture is just as sobering. Veracode research found 45% of AI-generated code contains a security vulnerability, while developer trust in AI accuracy fell to 29% — down 11 points from 40%. The failure patterns are predictable: cryptographic library misuse, over-engineering, and outdated or insecure security patterns.

The problem compounds precisely because agentic workflows iterate. Each "fix this" prompt quietly accumulates risk, so your safeguards must run inside the loop, not after it. That means treating security verification as a pipeline stage the agent cannot skip.

Concrete safeguards that work in practice:

• Spec-driven development with tests — define the expected behavior up front and let tests (written by you, or a second LLM) judge the output, not the model's confidence.
• RCI prompting — recursive criticism and improvement, where the agent critiques and revises its own output before you ever see it.
• MCP-enforced scanning — connect an MCP server that forces SAST, SCA, and secrets validation on every change, so insecure code fails the loop automatically.
• Human code review — a final gate no agent bypasses, especially for auth, crypto, and data-handling code.

The MCP-enforced route deserves particular attention. Because agents increasingly pull instructions and tools from external packages — agent skills — the validation layer itself becomes critical: published research found roughly 26% of skills carry at least one vulnerability. That's exactly the gap SkillzBench is being built to close: pinning every skill to a verified commit, security-scanning and benchmarking it in a sandbox, then serving it to your agents through a free MCP connector so your coding loop only ever loads vetted capabilities.

Security prompting still has a place — it nudges the model toward better defaults. But the evidence is clear that it cannot substitute for mechanical verification. Build the checks into the loop, make the agent pass them every iteration, and keep a human at the merge button.

A Step-by-Step AI Coding Workflow You Can Run Today

Theory only gets you so far — the fastest way to learn AI-assisted coding is to run one real task end to end. Here's a complete workflow you can run today on your own codebase, modeled on the refactoring benchmark SitePoint used to compare leading coding agents (https://www.sitepoint.com/claude-code-vs-cursor-vs-copilot-the-2026-developer-comparison/).

Step 1: Define the task narrowly. Pick something concrete, like SitePoint's example: refactor a ~120-line React component by extracting data fetching into a custom hook, splitting the UI into subcomponents, and replacing inline styles with CSS modules. Vague prompts produce vague plans.

Step 2: Give the agent a structured prompt. Specify the files, the desired outcome, and any conventions. Modern agents like Claude Code, Cursor, and Copilot operate as agentic systems capable of multi-file editing and autonomous planning, so a well-scoped prompt lets them inspect the repo and draft a plan.

Step 3: Review the plan before approving. Don't let the agent run blind. Read its proposed approach and push back where it conflicts with project conventions — METR's research found AI is comparatively less effective on mature codebases where implicit conventions take humans years to learn (https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/).

Step 4: Review every diff. Ask follow-up questions and request explanations of the generated code. In Anthropic's study, developers who used comprehension-based patterns scored 65%+ on follow-up quizzes, while pure delegators scored under 40% (https://www.anthropic.com/research/AI-assistance-coding-skills).

Step 5: Run tests, linting, and a security scan. This step is non-negotiable. Research on 400 code samples found vulnerabilities per sample rose from 2.1 to 6.7 across iteration rounds — even when explicitly prompted for security (https://www.endorlabs.com/learn/ai-code-gets-less-secure-with-every-prompt). Prompting alone can't substitute for real guardrails:

• Spec-driven development with tests written before or alongside the code
• SAST, SCA, and secrets scanning enforced through tooling, not prompts
• Human code review on every AI-authored diff, especially after multiple iterations

Finally, build the measurement habit. In METR's randomized trial, experienced developers believed AI made them 20% faster while they were actually 19% slower — a gap of roughly 40 points between perception and reality (https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/). Time AI-assisted versus unassisted tasks on your own codebase and trust the clock, not your gut.

If you want to go further, agent skills — instruction packages that give coding agents vetted workflows — can automate parts of this pipeline, from security validation to review checklists. SkillzBench is building a free, independent directory that security-scans and benchmarks skills in a sandbox, plus a free MCP connector that equips any agent with the ones you choose. Join the SkillzBench waitlist to get early access to verified agent skills and the MCP tool — free, with benchmarks that show exactly which skills actually help.