Craig Nielsen on How AI Coding Velocity Breaks Legacy Enterprise Infrastructure

Craig Nielsen: Why faster AI coding is exposing the limits of enterprise software delivery

GitLab's Asia Pacific and Japan vice president Craig Nielsen has named a pattern security teams have been quietly absorbing for months. The velocity at which AI now writes code has outrun every downstream system designed to catch what that code actually does. According to a Tech Edition interview, the bottleneck is no longer generation. It is review, testing, and the governance plumbing that was sized for human commit frequency.

The mechanism is not subtle. Most enterprise toolchains were assembled stage by stage over the past decade, and each stage now runs its own AI agent that cannot share context with the others. Nielsen cites Airwallex as the exception that proves the rule: after consolidating its stack onto a single platform, the fintech reportedly shipped customer-facing features four times faster. Bolt agents onto a fragmented pipeline instead of a consolidated one, and the fragmentation compounds. Hundreds of agents touch dependencies. Deployments fire faster than governance processes can track. Infrastructure built for people committing code at human cadence takes the first hit.

What breaks first

Three failure modes appear predictably. Reliability cracks under volume. Agents produce diffs that look correct in isolation but miss context that only surfaces in production. Cost climbs, because agents burn compute reconstructing information they cannot see across siloed stages. Nielsen describes this combination as the hidden cost of adoption — and it lands hardest in large, complex environments where a single misaligned deploy can fan out across services.

The security implications are uncomfortable. Each agent interaction is an authentication event, a privilege boundary, a potential exfiltration path. When the agent layer is federated across unintegrated tools, the audit trail fragments in the same shape as the toolchain. A reviewer cannot trace which agent touched which dependency at which timestamp, because no single system holds that view. That is not a productivity problem. It is an attack surface problem, and it grows with every new agent you connect.

Where the gains are actually landing

Nielsen argues that productivity gains are landing in the wrong place. Output is up. Production throughput is not, at least not proportionally. The gap between code written and code shipped safely is widening, and as that gap grows, it becomes the binding constraint on AI's actual return. Enterprises measuring only generation speed will conclude that AI is winning. Enterprises measuring deployment frequency, incident rate, and mean time to recovery will draw a different conclusion — one their boards will eventually notice.

Across Asia Pacific and Japan, the calculus sharpens. Differences in data residency, regulation, deployment requirements, and cost compress the margin for a fragmented agent layer to misbehave. The same agent sprawl that produces novel failure modes in a permissive environment becomes a compliance liability in a regulated one. Nielsen's framing is blunt: AI coding tools arrived before the infrastructure to govern them did, and the organisations that consolidated first are the ones positioned to scale agents without inheriting the mess.

The takeaway for platform and security teams is not "use fewer agents." It is consolidate the surface they touch before scaling them. Airwallex's four-times figure is not a story about better AI. It is a story about removing the seams. Agents across a unified pipeline with shared context can be governed. Agents across a federation of legacy tools cannot — and the failure mode will not look like a slowdown. It will look like an incident.