Navigating AI’s Impact on Developer Productivity with JFrog’s Yonatan Arbel

Hey guys, thanks for the drone. We're here with Janin r Bell, who's the developer advocate in the office of the CTO for jfr. And we're talking about the impact AI is having on developer productivity because, well, not everything in life comes for free, as we all well know.

Janin, welcome the show. Hi, Mike. Thank you for having me.

I think developers are being more productive, at the very least, more code is being generated. How much of that code actually makes it into a build and then into a production environment? Might be anybody's guest still, but, um, there is more code, so therefore there's more stress in the system.

What's your assessment of what's going on here? What's the impact of AI on developer productivity and the software engineering teams that support them? First of all, it's a great question.

And I mean, all of us, specifically developers start using AI on a daily basis, right? We, we, we, we actually, we became, uh, from the developers, we became kind of, uh, product managers with, with some knowledge of development. So we, we give all the, all the task and all what we need, we tell the ai, uh, agent to do, and it actually do.

And sometime we not necessarily go and check what it puts in. And I mean, we're not vigilant enough, uh, about this, uh, line of codes. And let me, you know, what, let, I, I can start even with, with a personal story.

Uh, go ahead. Yeah. So, so actually I started as a developer, uh, at Jfr.

And along the years, eventually I found myself at the CTO office, uh, developer advocate, speaking with other developers, telling them how they should use our product. But, but the story is that I still love to develop, and I got, I kind of fell in love in all this, you know, vibe coding, uh, that going around these days. Mm-hmm.

And, and, and I, I started travel a lot and I needed kind of, uh, application that I will be able to save my receipt. So, so, you know, eventually Jay Folk will reimburse this barrier that I, I ate at, uh, 10 10, uh, pm So, so I developed a vibe coding with, with one of the, um, famous platforms of vibe coding, uh, on the internet, an application, a web application that will simply let me, um, save my receipts. Uh, subject it by subject is by, uh, you know, by, by the event.

So I have everything organized. I know I can do that with, with, uh, Google Drive and all this, but I wanted to build something myself. It's, it's so easy today, so why not?

So I did, and it, I was super proud of it actually, because everything worked amazing, like login work, the UI was much better than I could get myself. Um, and everything, everything looked like, you know, production ready. So, so I shared it with, I mean, it was a personal application just for myself, not something that, uh, our customers using or, or any, anybody else, but I just wanted to develop it myself.

And then I was so proud of it. So I shared it with some of my friends, and I said, Hey, you know, you are still, uh, taking pictures of your receipts. Go ahead.

I, I developed something, uh, go ahead and use it. And I shared the link with, with him and what happened the day after that, I found some of his receipt mixed with my receipts. And then eventually what I understood is that, okay, it created a login mechanism.

But then when I, I said, okay, Ahan, you are a developer. You know how to read code, don't be lazy. Go inside and read what it, what it did.

And what I saw, um, got me, you know, o off, off of guard, because what I saw is that it did the, the, the, the query without like select, uh, asterisk from, uh, receipts and not, you know, it, it didn't add that, uh, like just bring the, the, the current user receipts just, and he said it, it brought everything inside. So of course, nothing happened. Um, I, my friend didn't got reimbursed for my burger.

Uh, we, I just told him to stop using it. I fix it, uh, manually eventually. Although of course I could tell the AI agent, Hey, you did some mistake.

Go and fix it. And probably it would understand what going on and fix it. But the point that I'm trying to say is that we still, we have to, uh, remain vigilant and, and, you know, um, aware of what's going into our code.

And it's not only about, this is just a simple story as a, a private story of myself, but it's, it's not just about this, uh, code, but also about what AI brings in, in terms of dependencies, in terms of, uh, like here is zero day, uh, vulnerabilities. So we have to keep ourself vigilance because, because of course we see that AI is evolving rapidly. And you know, according to Garner, uh, 33, uh, of the organizational application will eventually include an AI agent by 2028.

So, so we see like kind of a new moral law, I would say, things that, that used to take months. Now we, we achieve it within a days. Um, but, but again, I said, nothing is free as you, as you start.

And, and with this, you know, great power, there's, you, you there, you need some great, uh, bigger responsibility because it can eventually expose you to some vulnerabilities that you need to be aware of. So as this evolves, how much is the developer job gonna move from being in one where we spend most of the time kinda writing code and, and, and, and shaping it to maybe reading code and editing in it once the AI creates it? And, and will that have a different, you know, um, impact on the psyche of the developers?

Right? So, so as, as I said at at the beginning, we, the developers, we, we, from developing and writing line of codes, we become kind of, uh, pilots with co-pilot, like, like, uh, we have co-pilot, it's the co-pilot, you are the pilot and you should stay the pilot. And yeah, developers, they find themselves, uh, just typing in the chat why they, what they need and waiting AI to do it.

Um, sometimes they look what it does, sometimes not. And, and this is the whole story. We, we, we, we, if, if we used to spend our time inside the id, now we spend most of it in that chat of the ID telling, uh, AI what we need, uh, because, you know, they always say a good developer is a lazy developer.

Uh, but, but still, uh, we have to remain, uh, cautious, vigilant and, and be aware of what's going in. And it's not only about the line of the code, it's also about the dependencies that it use. Because, because AI usually, it doesn't have any context of your organizational policies, of best pr, of your best practices.

I mean, if I think about it with a time, it will probably have, but as for now, it doesn't have the context. And you need to, uh, instill the right tools, the right, um, practices and workflows, so you will be safe and you will not expose your organization and worsen that your customers to risks. And that's why it's very important this day.

And, and, you know, you started, I mean, precisely nothing is free. And again, you need to pay attention if we play with this word. So this is your pay.

You need to pay attention, a lot of attention for what's coming in, What impact does this have on the DevOps teams that are, you know, sitting on the back end of this code flow. And, uh, if the developers aren't looking at it, then what do they have to do? Or do they have to set up some sort of more vigilant review process?

Because, well, to your point, developers are lazy. I said, you need to, you need to implement the guardrails and the, the, the processes that will make sure that nothing walks in and expose you to some risks. Uh, because again, uh, we, we, we gain lots of velocity, but velocity doesn't necessarily say trustworthy.

So yeah, you need AI helps, but you need to confirm, you need to have, as for now, someone or some tool or process that will, uh, govern it because you have to govern it, otherwise, it will run into a chaos that you will not be able to control. And if, if you can't govern it, so you cannot secure it. So it's all about the governance of the process and, um, being aware of what's and how your AI tools are being used.

And not only that, but uh, also, um, as said, as I said before, uh, you know, organizations start to develop their own models in their organization. They need to understand what kind of, uh, models are they are bringing into the organization, because we know that there are already some malicious models out there that can, um, you know, eventually do some, uh, very bad stuff and steal information from organiza from organizations. So yeah, you need to have this, um, firewall, I will say, between your organization and the outside world to be in control what's coming in, to be aware of what's already in.

So, you know, in a day of, uh, log four j uh, vulnerability, you will know to act fast and you will know, uh, what to do. And I say, look, four J, because eventually the way I see models are like packages and AI agents are like any other tool that can expose you to risks. Um, in this case, we see that the, the adoption is, is widely spread and everyone is using, um, you know, everyone is using AI agent, even my mom, like, is she speaking g PT all day?

Like, mom, what are you doing? No, she is chatting with Chad g pte. So, so it's, it's so easy, uh, to adopt and, and I can fully understand why people adopting it so widely.

So Also will the, the type of developers that we're seeing change, because there'll be a lot more people who are not schooled in how to write code, but they'll be able to create an application using these vibe coding tools, and they may not have the appreciation for the finer points, and they might not even be able to read the code. So how do we kinda incorporate them into our happy little DevOps workflows? Yeah, Mike, you know, it's a great point because, because I think the way I see it, um, AI and these tools are blessed, but also a curse because okay, for me, uh, uh, and, and, you know, uh, developers with, with ears of experience, yeah, we, we know the basics.

We've been there, we, we, we venture our hands in the mud to, to get everything working. And now it's so easy to get it. And I'm, I'm like thinking about the junior, um, stu, the junior, uh, developer, that j that just started, most of the work are being done from him, for him, and, and that can, uh, eventually get him to be, uh, less professional maybe, but still, uh, if it will remain vigilance, then he, he of course, will catch everything and will be able to be a professional, uh, developer.

But again, it's, it's about not being lazy and let AI do everything for you, and if it doing everything for you, make sure that you have the right tools that will prevent him to leak, uh, secrets or, uh, you know, um, create some SQL injection zero day vulnerability, because again, we developer, we made it ourself. We, we created bug. We may, might, uh, put a zero day vulnerability, but we have a SaaS tools and, and things like that that that helps us.

So also AI needs these, uh, you know, these guardrails that will prevent, uh, AI from injecting this, uh, code into our organization. And yeah, uh, again, people were not coding, and I also, I heard about, uh, about someone who developed an application and, and deployed it to AWS and, and like he, he, he posted the, um, post on, on Twitter or x how, what it's called now, right now. Uh, so, uh, and, and eventually people understood and found some zero day vulnerabilities there and start exploiting these vulnerabilities, which eventually caused them pay a lot of money to AWS because people start mining some bitcoins and stuff like that.

So, yeah. Uh, because he wa he, he is not a developer and he is not aware of what's going on, and he didn't have any tool that could, uh, tell him, Hey, look, you did something bad here. You might want to change it to this and that.

So yeah, of course, um, especially people who are not, and, but not, not only, but of course people who are not developers, they need these tools, but also people and organization that, you know, that they're being, uh, under regulation and stuff like that, they have to, uh, get the tools, the right tools and the right policies and processes that will keep them safe. Um, because, because it's so fast and everyone is bringing code, what I said, what, what took me one month, um, before now taking a few days, and this few days, I mean, I got it with lots of, uh, velocity thanks to ai, but, but still, uh, most of the lines I probably I didn't look for and I didn't understand what it really got in. So you need to, uh, put yourself kind of, uh, process, uh, built in process and, and make reviews and make sure that you have enough quality gates, uh, that, so those, uh, risk will not, uh, get into your application eventually.

And, and to production, Will we need something that feels like an AI agent to review the code created by the AI and to provide all that governance that you talked about, because it's not clear to me we have enough people to go review all that code in the first place, Right? So, uh, I'm not, I don't know if it's an another AI agent, but it's, uh, we will need to, uh, supply the AI agent with tools that will make it, uh, understand whether it should use something in a way it should. For example, let's say before you use a package, let's say just for an example, Axios, Hey, check, uh, my organization policies about this access package.

Do I use it in my organization? Is it blocked by, I know by policies, by security policy? So once this AI agent and we see with MCP now, um, giving tools to those AI agent is so easy.

So, um, so before two, uh, AI agent will decide to put a packaging, it'll first know that it, it goes and check with the organizational policies. And if it's, if he gets a green light, he continues, it might slow him down a bit a bit, but still, uh, he will be much safer. This is a small trade off, but it's, it's definitely worth it.

Are we really gonna be more productive or are we just gonna generate a lot more code that winds up being, need to be reviewed and fixed and eventually just kinda winds up slowing us down more than it speeds us up? So eventually, I, I, I have no doubt we will definitely, uh, we will become more productive. Um, yeah, as for now, we do get lots of, uh, lines of code.

Uh, some of of these lines are probably redundant and can be better, but with the time, and we see the evolvement and we see new model, uh, goes every, uh, couple of days. Uh, so yeah, I have no doubt that we will, we, we already more productive. I mean, we, we see things, um, getting, you get things much more faster.

You, you summarize the whole conversation in, in just, you know, 10 seconds. Uh, so yeah, we, we are, uh, more productive already. Um, but again, it comes with noise and it comes with a price, as you said.

Uh, and, and we need to be, to be aware and stay, uh, cautious about, about what it's bringing in and, you know, so be able to, to let it work for, for us and not us walk for it. So yeah, this is the main point. So as you think about vibe, coding and everything else that's going on, what's your best advice to folks about how to approach this and get started, but maybe not go too crazy?

Yeah, I, I I, I would say start small, start with don't, don't give it the old Bible and telling, do it now. Start small with, with small tasks, break it down. So we'll be able to, to review this, what it's bringing in.

Um, don't, don't immediately give it the all application and, and just, uh, sitting and wait everything to happen. Start small, uh, be vigilant about what it's bringing in, uh, and, and understand this is a great opportunity to learn. If we talked about these, uh, junior developers, um, this is great.

It's, it's a tool that people didn't have before and now they have the opportunity to learn, so we definitely should get advantage on it. Um, so yeah, my, my advice would be, uh, start small, uh, stay aware of what's going in and, and don't let any zero day, uh, vulnerability sneak in because it might, Alright, folks heard it here. Hey, everybody likes to go fast, but the thing about going fast is that if and when you suddenly crash, it hurts a lot more.

Hey, Jonathan, thanks for being on the show. Thank you very much, Mike. All right.

And back to you guys in the studio.