CodeNote's 2026 industry map counts over 40 AI testing startups that have raised a combined $1.5 billion. End-to-end automation, test generation, security testing, performance testing — every category has multiple funded companies competing for the same pitch: AI that writes your tests so you don't have to.
In the same period, AI-generated code volume has exploded. ThinkSys's 2026 QA trends report found that 61% of QA teams report moderate to dramatic increases in testing demand driven specifically by AI-generated code. Not a general increase in workload — an increase caused by the code AI is producing.
More money is going into AI testing than at any point in the industry's history. And there is more untested code than at any point in the industry's history. Both of those things are true at the same time.
The AI testing pitch works like this: AI-generated code is shipping faster, so you need AI-generated tests to keep up. Invest in tools that write tests automatically, and coverage scales with code volume.
The math looks clean until you check the actual numbers. Tricentis's 2026 Quality Transformation Report found that 60% of organizations still deploy untested code — nearly unchanged from 63% in 2025. A full year of AI testing investment, and the number didn't move. Coverage plateaued at roughly 25% of user flows automated.
What moved was the denominator. Developers using AI coding tools daily went from a minority to 84%. Code volume surged. The absolute number of tests probably went up. But the ratio of tested-to-shipped code went sideways or down, because the code is being generated faster than any testing tool — human or AI — can verify it.
This is the part the funding pitch doesn't mention. When both the code and the testing scale with AI, but the code scales faster, the gap widens.
Break down that investment by what the tools actually do:
cy.prompt().All four categories optimize the same step: producing and running test scripts. The investment thesis assumes the bottleneck is how fast you can create and maintain scripts.
But the Tricentis report says 30% of organizations knowingly skip testing to ship faster — a prioritization choice, not a tooling gap. And another 30% say the AI-generated code volume is simply too much for their teams to handle, regardless of how the tests are authored.
The bottleneck isn't writing the test. It's deciding that the test matters enough to exist — and then running it against something real.
There's a deeper problem with AI-generated tests for AI-generated code, and it's the same one the Cloud Security Alliance flagged for security: when the same model writes the code and the test, both share the same blind spots.
An LLM that generates a checkout flow without handling the edge case where the payment provider redirects twice won't write a test that checks for double redirects. The test covers the happy path the AI imagined, not the real path the app takes. The CSA found that 91.5% of vibe-coded applications had at least one vulnerability the AI introduced — and the AI-generated tests didn't catch — because the test was built from the same understanding that produced the bug.
This is the feedback loop: AI writes code with gaps. AI writes tests with the same gaps. The tests pass. The bugs ship. Testing demand increases because production keeps breaking. The industry response: invest more in AI testing tools. The tools generate more tests with the same gaps. Repeat.
Lightrun's 2026 survey of 200 senior SRE and DevOps leaders put a number on the downstream cost: 43% of AI-generated code changes require manual debugging in production — after passing QA. The tests didn't fail. They never knew what to look for.
The flows that stay in the untested 75% aren't there because the test code is hard to write. An AI can generate a Playwright script for a login page in seconds. The flows are untested because they're hard to automate at any level of abstraction:
An AI agent that generates test code still has to solve these problems. Generating the code faster doesn't make the OAuth redirect capture any easier — it just moves the failure point from "nobody wrote the test" to "the agent wrote a test that doesn't work against the real flow."
This is why the 25% ceiling hasn't moved. The missing 75% doesn't need a smarter test generator. It needs a different approach to what a test actually is.
The teams growing coverage past 25% aren't doing it with better generation. They're making it trivial to create a test without generating anything at all.
Record the flow. Click through the signup, the checkout, the onboarding wizard. The test exists because someone did the thing, not because a model imagined the thing. No generation step means no shared blind spots between the code and the test.
Then replay against the real app. Not a mock, not a stub — the actual system with actual redirects, actual cookies, actual email delivery. The generated test that passes against a mock will fail here, because the mock didn't have the double redirect, the expired session, or the third-party domain that sets its own cookies.
This is what a proxy-level test gives you that a generated script can't. The proxy follows the real redirects, captures the real cookies at every hop, and sees what the browser actually receives. It doesn't generate assertions based on what an AI thinks the response should look like — it records what the response actually was.
$1.5 billion is building tools that write tests faster. The problem was never writing speed. It was testing what matters, against the real thing, often enough to catch the bug before the user does. The denominator is still growing. The numerator needs a different approach.