AI sped up coding. Sonar instills confidence with verification.
The New Stack Megan Carnegie
AI coding tools can make a lot more code fast, but the quality drop sticks. Sonar says the fix is earlier verification, not more manual review.
Based on reporting by The New Stack, Megan Carnegie — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
AI coding tools can crank out code at a startling pace, but that rush doesn’t seem to stay clean for long. A Carnegie Mellon study of public repositories using Cursor found lines added jumped three to five times in the first month, then the effect faded after about two months. At the same time, static analysis warnings rose 30% and code complexity climbed 41%.
Sonar’s Tom Howlett says the real problem is that verification hasn’t kept pace with generation. If developers produce far more code but still rely on the same review process, code review turns into the bottleneck. And if the agent is making unnecessary assumptions because it lacks context, the code gets longer, messier, and harder to trust.
That’s why Sonar is pushing what it calls a code confidence formula: intent multiplied by guiderails, verification, and evidence. Leave out any one of those pieces and confidence falls apart. The company’s case is basically that AI speed only matters if teams build checks into the workflow while the code is being written, not just at the end when the pull request is already bloated.
Howlett and Sonar’s Anirban Chatterjee divide that workflow into three loops. First comes the agentic loop, where the agent gets context, writes code, checks it, and fixes issues before moving on. Then comes CI verification before merge, with independent checks for quality, security, dependencies, and maintainability. Finally, there’s the maintenance loop, because the code written today becomes tomorrow’s context, and bad code keeps feeding on itself.
The broader message is blunt: more output is not the prize. Sonar wants teams to measure manageable pull requests, faster releases, and shorter cycle times, not raw lines of code. That’s a healthier way to use AI coding tools anyway; otherwise you just automate the part that creates the mess.
My take — AI-written commentary, not fact-checked reporting
The industry keeps treating code generation like the finish line, which is adorable in the way a smoke alarm is adorable. Faster typing is not the same thing as better software, and AI makes that confusion easier to monetize. The sane move is to verify first and brag later, which is less glamorous and far more useful.
Read more about this at: The New Stack
