2025 in Review: Agents, Amplifiers, and the New SDLC

If 2024 was the year AI moved from demo to decision, 2025 was the year it started acting on its own. AI agents began writing code, opening pull requests, and calling tools across the software lifecycle. The question for leaders shifted from "should our developers use AI?" to "what are we letting AI do, and how would we know if it went wrong?"

This is the second of two retrospectives looking back at the years I wasn't publishing here. (The first is 2024 in review.) Here are the moments from 2025 that I think defined it, and what each one means for engineering and business leaders.

1. The cost of intelligence dropped overnight

In January, DeepSeek released its R1 reasoning model, and the market reacted to how cheaply it had reportedly been built. In a single day, Nvidia lost close to $600 billion in market value. Whatever you think of the specific claims, the signal was clear: capable AI was getting cheaper and more widely available, fast.

In February, Andrej Karpathy coined the phrase "vibe coding" for building software by describing what you want and accepting what the AI produces. It was meant playfully. It also captured exactly what keeps security and reliability leaders up at night.

What I'd tell a CTO: assume AI capability will keep getting cheaper. Your advantage won't come from access to models. It will come from how well your organization can absorb AI-generated change safely.

2. Agents got a common language

The Model Context Protocol, introduced by Anthropic in late 2024, became an industry standard in 2025. In March, OpenAI adopted MCP across its products, and by December it had been donated to a new Agentic AI Foundation under the Linux Foundation. Agentic coding tools that could plan, edit across a codebase, run tests, and open pull requests went from preview to everyday use on many teams.

When agents can act, governance stops being theoretical. Every tool an agent can call is a permission. Every action it takes is a change that needs an owner and a way back.

What I'd tell a CTO: inventory what your agents can touch, the same way you'd inventory service accounts. Put agent-generated changes through the same guardrails as human ones: review, staged rollout, and a kill switch.

3. The productivity story got complicated

Two pieces of research made 2025's AI debate more honest.

In July, METR published a randomized controlled trial with 16 experienced open-source developers working on 246 real tasks in mature codebases they knew well. When AI tools were allowed, developers took about 19% longer. More striking, they had expected AI to make them about 24% faster, and even afterward they believed it had made them about 20% faster. The study was small, and METR was careful to say it doesn't mean AI rarely helps. But the gap between perceived and measured productivity should get every leader's attention.

Then the 2025 DORA report, based on nearly 5,000 technology professionals, found that about 90% of respondents now use AI at work. Its central conclusion was that AI is an amplifier: it magnifies the strengths of high-performing organizations and the dysfunction of struggling ones. The biggest returns came from the system around the tools, such as platform quality, clear workflows, and team alignment, not from the tools themselves.

What I'd tell a CTO: don't measure AI by how fast it feels. Measure outcomes such as lead time, change failure rate, and recovery time, before and after. And invest in the foundations AI amplifies, because it will amplify whatever you already have.

4. Regulation arrived for general-purpose AI

On August 2, 2025, the EU AI Act's obligations for providers of general-purpose AI models began to apply. Most engineering teams aren't model providers, but the direction is unmistakable. Documentation, transparency, and accountability for how AI is used are becoming expectations, not nice-to-haves.

What I'd tell a CTO: start keeping a record now of where AI is used in your products and your delivery pipeline, and who is accountable for each use. It's much easier to build that habit than to reconstruct it under deadline.

5. One race condition, half the internet

On October 19–20, 2025, an outage in AWS's us-east-1 region took down a long list of apps and services. AWS traced it to a latent race condition in DynamoDB's automated DNS management, which left the service's regional endpoint with an empty DNS record. The initial fault was fixed within hours, but the knock-on effects on other services stretched full recovery to roughly 15 hours.

The lesson echoed CrowdStrike in 2024. In highly automated systems, small faults can cascade quickly, and recovery takes longer than the fix. Resilience is an investment decision, and someone has to make the business case for it before the outage, not after.

What I'd tell a CTO: know your blast radius. Which customer-facing capabilities depend on a single region, provider, or automated control plane? What would degraded mode look like? If you can't answer that in plain language, your executive team can't either.

What 2025 taught me

• Agents raise the stakes on guardrails. When software can act on its own, the ability to limit, observe, and reverse its actions becomes core infrastructure.
• AI amplifies systems, not individuals. Leaders who invested in platforms, clear workflows, and safe release practices saw AI pay off. Leaders who only bought licenses mostly bought speed without confidence.
• Measure what's real. The gap between how productive AI feels and how productive it is was the most important leadership lesson of the year.

2026 is the year these lessons get tested at scale. I'll be writing about that as it happens.

Sources: Model Context Protocol (Wikipedia) · eWeek, Developers using AI take 19% longer on tasks (METR study) · Google Cloud, 2025 DORA report announcement · InfoQ, AWS DynamoDB outage postmortem