According to Sonar, which builds automated code review platforms, AI is reshaping software development by changing how software is written, reviewed, and verified.
In this interview, Tariq Shaukat, CEO of Sonar, discusses the operational risks of AI-generated code, how AI is changing the economics of technical debt, and why verification is becoming a more important part of enterprise software development.
What happens to software quality when AI-generated code outpaces verification?
Software quality and security are ultimately compromised when code generation outpaces verification.
Our State of Code Developer Survey found that while 96% of developers express some level of distrust in AI-generated code, only 48% consistently verify it. This creates a growing backlog of unreviewed code that can introduce defects, vulnerabilities, and operational risk.
The challenge is not purely procedural. When AI generates code faster than developers can reasonably assess it, there is a tendency to approve rather than scrutinise. We describe this as “cognitive surrender,” a gradual decline in critical evaluation when review demands exceed human capacity. Combined with “verification debt,” a term used to describe the growing backlog of unverified code, it creates a compounding risk that organisations cannot ignore.
As advanced AI models become increasingly accessible to threat actors, the speed at which enterprises identify and remediate vulnerabilities may become just as important as the speed at which they deliver new software.
What are the operational risks of AI-generated code?
The primary operational risk is that organisations can produce software faster than they can reliably validate it. This creates review bottlenecks, shifts risk downstream, and can reduce the benefits of AI adoption if verification processes do not keep pace.
The challenge becomes more pronounced in agentic workflows, where AI systems autonomously generate code, run tests, and iterate without continuous human oversight. Each cycle can introduce additional issues that build on previous ones, and if verification is not integrated into the process, the review burden grows rapidly.
Our benchmarking of coding models has found significant variation in areas such as maintainability, issue density, and code complexity. Concise code is not always easier to review; in some cases, fewer lines of code can conceal greater complexity and require more review effort.
As coding models improve and generate more software, the burden of verification is likely to increase. That verification gap is where many production issues emerge.
How does AI-generated code change the economics of technical debt?
AI changes the economics of technical debt by making it easier to create and harder to detect early.
While AI reduces the cost and effort required to generate code, it shifts costs towards verification, review, maintenance, and remediation. Our State of Code Developer Survey found that 47% of developers believe AI has had a positive impact on technical debt, yet 38% reported that reviewing AI-generated code requires more effort than reviewing human-written code. Additionally, 88% identified at least one negative impact of AI on technical debt.
As a result, technical debt can become less visible while accumulating more quickly. Organisations may realise short-term productivity gains but incur greater long-term costs through rework, maintenance, and delayed remediation.
Agentic development also introduces a direct economic cost. Every unnecessary iteration consumes compute resources and tokens. When flawed code requires repeated correction cycles, those costs accumulate. Integrating verification earlier in the development process can reduce correction cycles, lowering token consumption and improving efficiency.
When should enterprises trust AI-generated code?
Trust should be earned through verification rather than assumed.
A risk-based approach is often the most effective. For lower-risk applications, such as prototypes or internal tools, organisations can move more quickly provided the code passes automated quality and security checks. For systems that handle sensitive data, financial transactions, regulated processes, or safety-critical functions, verification standards should be significantly higher.
In such environments, AI-generated code should pass independent, deterministic, and auditable verification before reaching production. Verification helps ensure code aligns with organisational requirements, compliance obligations, and operational standards.
More broadly, enterprises should adopt a layered approach to verification. Static analysis, AI-assisted code review, software composition analysis, testing, and CI/CD validation each identify different categories of issues. Together, they provide more comprehensive coverage than any single control mechanism.
What does Sonar’s internal AI development stack look like today?
Our approach is intentionally hybrid and model-agnostic. Rather than relying on a single coding assistant or foundation model, we use a combination of approved development tools, including GitHub Copilot, Cursor, Windsurf, Claude Code, and direct access to model APIs where appropriate.
The objective is to support experimentation and productivity while maintaining governance and oversight. Our development approach also follows the core stages of the Agent Centric Development Cycle (AC/DC) framework. Sonar runs within the inner loop of its AI agents, where every loop iteration is verified before the agent proceeds.
Verification is embedded throughout the development process rather than being limited to final review stages, helping to identify issues earlier and prevent them from accumulating over multiple development cycles.
What are the biggest lessons from deploying AI in software development?
One of the most significant lessons is that software development is no longer differentiated by the ability to generate code quickly. AI has largely commoditised that capability. The differentiator is increasingly the ability to determine what should be built, evaluate what has been generated, and verify that it meets required standards.
A common challenge is that developers often know AI-generated output should be reviewed carefully but lack the time or tools to do so effectively. Organisations that manage this successfully treat verification as a systemic discipline rather than an individual responsibility. They embed controls, transparency, and accountability into the development process itself.
This thinking underpins our AC/DC framework, which is built around three stages: guide, verify, and solve. Agents are guided with the appropriate architectural, security, and project-specific context before they generate code, each output is independently verified, and issues are addressed before technical debt and risk have an opportunity to accumulate.
The rise of autonomous AI agents makes this approach even more important. Unlike traditional development, where issues are often identified during coding, agentic systems can iterate through many cycles before human intervention occurs. As a result, verification needs to be integrated throughout the workflow rather than applied only at the end.
Organisations that successfully balance AI-driven productivity with rigorous verification will be better positioned to build software that remains secure, reliable, and maintainable over time.
