AI Coding Agents Are Breaking Big Codebases — Dan Adler, Sourcegraph

Hey, welcome everybody. I'm Dan Adler, CEO at Sourcegraph. It is, uh, great to see you all here today. Thank you so much for coming out and joining us. Um, this is a talk today about the unglamorous but load-bearing work of owning a large, complex codebase, and why AI and agentic coding tools today make that job more difficult and more important than ever before.

Just to start, the software that runs the world is not pretty. It's not new. It's not clean. It's how everything actually works. 72% of software industry employment is in companies with more than 500 people. These are the large enterprises of the world. These are the companies managing thousands of repositories and decades of codebase history. Few of your peers work at startups, at the hot companies you may hear about on social media, and even fewer of them are

actually, like, ex-solopreneurs making a living off of their f- um, social feeds. Most of us work in large, long-lived codebases. Those codebases are how your bank account will reject a transaction in real time if you hit your limit. They're how your insurance carrier calculates the reimbursement rate for a policyholder with dual coverage. It's how a chip in a warehouse scanner will actually allow Amazon to tell you when your socks arrive. It's how your Uber estimates an arrival time. It's how an airplane uses radar to, uh,

adjust trajectories, how your paycheck gets issued. It's how your office air conditioner ticks on, and on, and on, and on, and on. These are the things that keep the world moving. We are all completely, utterly dependent on massive, decades-old, super complex codebases that have been built over many, many years by thousands of engineers.

And coding agents are writing more, better code today faster than we have ever seen before. A tidal wave of code is coming for you. It's coming for your codebase and for all of your engineers on your team who are trying to just keep their heads above water. Every one of us has felt this pain, this flood of AI-generated code that we now have to review and make sure is healthy for our codebase, and we're exhausted by it. And look, there are now code review agents. I'm sure there's a lot of them around this room right now. There

are tools designed to help you measure your codebase's he- codebase's health and so on. And look, the new ... The major coding agents will start to pull this stuff in. The models will get better. Over time, we'll keep putting sandbags down to keep this flood held back, right? We're gonna keep finding these local maxima to help ourselves sort of avoid this problem. But meanwhile, what's happening is that these codebases, these massive ones that keep the world running, are beginning to decay. Millions of

lines of code, tens of thousands of repositories, way too much to fit into a context window or even just to clone and grep in real time. That's just not possible, and this is causing big problems. We're publishing new features, new patches at record speed. There are different coding standards being applied in different places by different agents across the codebase. There's duplicated code proliferating. Your, you already have a library that does this, but your agent doesn't know that. There's cross-service

dependencies that are becoming more brittle. There are slight deviations in standards that are creating more insidious hidden issues across the codebase. And maybe more important than anything else here, there are new vulnerabilities being uncovered by agents every single day. They require constant, constant oversight and upkeep of all of these massive legacy codebases that nobody wants to think about or deal with. The job of owning a codebase is harder today than it has ever been

before.

And at the end of the day, the problem here is actually the volume of code. The call is coming from inside the house, right? The very tools that are speeding all of us up and letting us write more code faster than ever are also the tools that are creating the conditions that will cause these massive codebases that run our world to begin to fail.

Every day, I talk to technology executives at these large companies, and they are feeling this so viscerally. The same pain that I imagine many of you are feeling too, right? "I want to give my devs the best tools possible, but just today I overheard a dev say, 'I don't know what this code does. AI wrote it for me.'" This is a tech leader and executive at a top 10 car manufacturer. When you're writing vehicle autopilot code and you have thousands of engineers in your org that you have to manage and you want to enable, this is

terrifying.

All right, here we go.

So what I deli- um, deeply believe is that these codebase owners deserve better. Today's agentic dev tools are not meeting the moment for this. The infrastructure to see and understand a 50,000 repo codebase is not being built or sold by OpenAI, by Anthropic, by Cursor, by the rest of them. This is a hard and unique problem. Their agents are so unbelievably good at smalling th- at solving the small scale problems that most developers deal with every

day that they are ... Their demand is growing faster than ever before, and this bigger problem of these codebases beginning to fall apart is going unnoticed. So this session, this is a call, first of all, of, to celebrate the people, the owners of these codebases, people around the world who are actually keeping them alive and keeping them running, most of our software engineer peers around the globe. So thank you all so much for what you're doing. But this session is also a call to dev

tools companies out there, to the agent harness builders, to people who are building the infrastructure for these agents, to help build the, the infrastructure, the, the ability to go see and understand these massive scale repositories and give that to their agents.

This is a great quote that I heard from, um, a tech leader at, uh, one of the top 10 US banks, tens of trillions of dollars in assets, uh, in custody or administration. "Sure, Claude Code can, uh, make this change, but I have 90,000 repositories to make it in." This is actually a specific quote about a specific supply chain vulnerability, uh, an npm thing. Won't get into it. But if you're a bank and you're seeing agents uncover and create these new vulnerabilities at an unprecedented pace,

and you're being told to go use Claude Code to solve this, that's a problem. Good luck doing that in 90,000 repositories, mapping out how these code bases all come toge- together, what's actually living in production across your company, across your product offerings.

Because at the end of the day, right, what's really funny about all this is that we-- if we know anything about LLMs, it's that they just love to search. It's like a new hire getting up to speed on the code base. It's how agents build models of the world. The repo architecture that you're plugging into your AGENTS.md files, like, let's be real, that's barely moving the needle here. This agent is going to grep, grep, grep, grep, grep, grep, grep, grep, grep its way to code base understanding. That's simply how it works. But

understanding is a context problem. You can't grep what you literally cannot see. This is tools and infrastructure that's needed. And the infrastructure to go see and search and really deeply understand a five hundred or five thousand or fifty thousand or half a million repo code base is not being built by the agent builders today.

And so that's where, what we're solving, what we're working on as a company. This is what Sourcegraph is built around, right? Give us a second. If you'll let me sort of take a moment and predict the future of our industry, these massive code bases are not going away. In fact, there will be more code. There will be much, much, much more code out there in the future. And we believe very m- deeply that building tools to give agents the

ability to actually see and understand and evolve those large code bases is essential for the future.

And where this comes from, at the end of the day, is having a graph, that code graph in mind. The foundational graph of your code base, including search and then the actual compiler accurate output, um, if you go in and do that analysis, that is essential to give your agents the ability to go and understand how to make changes effectively. Visibility is infrastructure.

And we actually built a lot on top of this, right? We're not stopping here. Actually, just today, we launched our new, um, our new Agentic Batch Changes product into beta. This is a frontier agent. Uh, and its job is to let the owner of a massive code base actually execute code changes across hundreds or thousands of repositories at once, starting with a single prompt. This is a product that will iteratively roll out changes across that, that code base, self-heal, respond to CI status, PR comments, use coding agents where it makes sense, where judgment

is needed, use deterministic scripts where it's not, and provide tracking and auditability to be sure that you've covered one hundred percent of the places where that patch is needed, where that change is needed. Because like I keep saying here, at the end of the day, this is an infrastructure problem. When you're putting code out there into the world, you need to make sure that it's actually gonna keep your code base healthy, that it's actually gonna make-- be able to, um, adapt to the places where your code base is beginning to fall apart.

Here's a great quote from an early access user, um, uh, actually at Mercari, a global, um, shopping tool out of Japan, incredible company, massive code base, hundreds and hundreds of independent microservices running in production. This user was using, um, this product to go actually patch a GitHub, uh, code injection issue where you have to set environment variables correctly. Um, he ran this on two repos where he knew this issue existed and then said, "Yeah, go explore the rest of our code base," and found eighty other potential vulnerabilities across their code base in other places. This

is like base... This is like config files. This is basically just going and doing that scan. Patching them all in one go with a sort of deterministic script that can go make sure it's making that change consistently, effectively across one hundred of the places where that risk exists, that is what confidence is all about in the agentic coding era.

So yeah, I'll stop here. If you're wondering right now about, like, how many repos in your code base, how many forks are there out there, how many, um, copies of r- repos are there out there, how many repos have your in-- your developers brought into your, um, company and are now being plugged in as a library or an API somewhere in your code base that's live in production that you're not aware of, that's the sort of thing that we're here to help, right? If you're wondering what code is deployed right now and how you can go scan it all and see it all and make sure it's all updated, come talk to me.

And, uh, tonight, we're actually hosting a, uh, event here in SF called Code, Cocktails, and Cutovers. Come on out, join us. Um, come find us. Bring your gnarliest code-based stories. This is where we want to, uh, talk and hear from all of you about what you're trying to deal with and how you're dealing with the tidal wave of code that's coming for you.

Cool. Thank you. I'll stop there. Any questions? Thank you.