A practical look at AI coding for Australian SMEs, what AI coding agents do well, where they create tech debt and security risk, and how to use them safely.
In late 2025 a quieter shift happened in software. GLM-5.2 arrived as an open-weight model that holds its own against the top proprietary systems at the work that actually matters to a business, fixing real bugs and building real features rather than passing tidy benchmarks. Paired with agentic coding tools such as Cursor, GitHub Copilot, Codex and Cline, it means a small Australian business can now point a capable AI at routine development work for a fraction of what that work used to cost.
That is the genuinely interesting part. Not that AI can write code, which it has done for a while, but that an open-weight model now does it well enough to be useful, which changes the economics. The honest part, which gets less airtime, is that the speed comes with a catch. This piece looks at AI software development from the seat of an Australian SME, what the agents are good at, where they quietly cause harm, and how to use them without inheriting a mess.
What AI coding agents are good at
Think of a capable coding agent as a tireless, low-cost junior developer. It is fast, it never tires of repetitive work, and it has read more code than any person could. That framing is useful because it tells you both where it shines and where it needs supervision.
The clearest wins are routine and well-defined. Writing a script to clean a messy export, wiring two systems together through their APIs, generating boilerplate for a new screen, or building a small internal tool that a team has wanted for months but never justified. These are jobs where the requirements are clear, the blast radius is small, and a human can check the result quickly.
The second strength is speed on a first draft. An agent can stand up a rough working version of an idea in an afternoon, which is genuinely useful for ai mvp development, where the goal is to learn whether something is worth building properly. A prototype that would have taken a fortnight can take a day, and a day is cheap enough to throw away if the idea does not hold.
The third, and most underrated, is that it lowers the cost of small jobs. Every business carries a backlog of minor IT tasks that never reach the top of the list because they are too small to brief out and too fiddly to do by hand. A coding agent makes that backlog affordable to clear.
Where it goes wrong without senior oversight
Here is the part the demos skip. The same speed that makes an agent useful makes it dangerous when nobody is checking.
The first problem is tech debt that compounds quietly. An agent writes code that runs, but running is not the same as maintainable. Left unsupervised, it produces sprawling, duplicated and inconsistent code that works today and becomes a swamp in six months. The cost does not show up at the time. It shows up later, when a change that should take an hour takes a week because nobody, including the AI, can safely touch the tangle.
The second is security. AI coding agents introduce the same flaws a careless junior would, and they do it with total confidence. Hard-coded credentials, missing input validation, outdated dependencies with known vulnerabilities, data exposed by accident. The model does not know your data is sensitive or that a field is customer information unless someone makes sure it does. Confident wrong code is harder to catch than obviously broken code, which is exactly why it is dangerous.
This is where vibe coding earns its bad reputation. Describing what you want and shipping whatever comes back, without reading it, is fine for a personal script and reckless for anything touching customers, money or data. The trap is that it feels productive right up to the moment something breaks and nobody on the team can explain why, because nobody ever understood the code.
The contrarian truth is simple. AI speeds the draft, it does not replace the review. An organisation that skips senior oversight to move faster is not saving time, it is borrowing it at a high interest rate.
How an Australian SME should actually use it
Start where mistakes are cheap. Internal tools, data scripts, integrations and dashboards are ideal first jobs, because if the agent gets something wrong, a person notices quickly and nothing customer-facing is at stake. Keep AI well away from payments, customer data and anything with a legal consequence until your review process is solid.
Keep a developer accountable for every line that ships. The most reliable pattern is the agent drafts and a senior person directs and reviews. That review is not a formality. It is where tech debt gets caught before it sets and where a security flaw gets removed before it ships. If you do not have that person in-house, this is exactly the kind of work our software development team takes on, often pairing a developer with the tooling so the speed is real and the risk is managed.
Pick your tools to match your team. Development with Cursor suits teams that want an AI-native editor built around the agent. Development with GitHub Copilot suits teams already living in GitHub and Visual Studio Code who want the assistant to sit inside the workflow they already use. Both are good. The right one depends on where your developers already work, not on which is newer.
Treat the output like any other code. Run it through the same version control, the same testing and the same security checks you would apply to code a person wrote, because the standard does not drop just because the typing was faster. For anything that grows past an internal tool into a product customers depend on, the engineering discipline of proper custom software matters more, not less, when an agent is in the loop.
A note on the numbers people quote. You will hear claims of huge productivity gains, and they can be real for the right task, but treat any figure as illustrative rather than a promise. The gain on a one-off script is large. The gain on a complex system with strict requirements is smaller, because the bottleneck there was never the typing.
What this means for you
AI software development has reached the useful, unglamorous stage, which is the good stage. The capability is real, the cost is low, and for an Australian SME it genuinely lowers the barrier to clearing routine IT work that used to sit undone.
The catch is equally real. Unsupervised AI code creates tech debt and security risk faster than it creates value, and confident wrong answers are harder to spot than obvious ones. So the move is not to ban these tools or to hand them the keys. It is to use them where mistakes are cheap, keep a senior person accountable for the result, and hold AI code to the same standard as any other. Do that, and the agent is one of the better deals in software right now. Skip it, and you are buying speed today with a bill that lands later.
