Productivity surges from AI-assisted coding often come with a hidden cost. Research from Carnegie Mellon examining public repositories that adopted Cursor showed a three- to five-fold spike in lines added during the opening month, yet this advantage faded within roughly two months. The same study, which leveraged SonarQube to track code quality, revealed that static analysis warnings climbed 30% and code complexity jumped 41%. The velocity windfall therefore masks a lasting accumulation of technical debt.

Tom Howlett, Director of AI Engineering Engagement at Sonar, points out that while code generation has accelerated, the verification process—still largely dependent on human code review in most organizations—has not. When developers produce 50 times more code while relying on identical review mechanisms, code review time balloons and becomes a chokepoint. Agents frequently lack sufficient codebase context to make minimal, targeted changes; instead, they make assumptions, generate surplus code, and compound technical debt. According to Howlett, this results in unnecessarily intricate and verbose implementations.

For engineering leadership, the takeaway is straightforward: faster code generation does not automatically translate to greater value delivery. Organizations must establish confidence that generated code achieves its purpose and adheres to their standards. Sonar frames this through its code confidence formula: intent x guiderails x verification x evidence. Howlett emphasizes that the multiplication is intentional; if any component is absent, confidence collapses.

Implementing this formula demands more than a final checkpoint. Development today operates across three interconnected loops that must all incorporate verification:

  • The agentic loop, as code is being authored
  • The CI verification loop, as changes undergo testing and preparation for merge
  • The code maintenance loop, as the codebase evolves following release

This continuous approach enables teams to pursue agentic velocity while upholding the code quality, security, reliability, and governance standards that dependable development demands.

The missing discipline: verification in the workflow

Allowing the model that produced code to review its own work is, as Howlett describes it, "like a student grading their own homework." Coding agents excel at their craft, but their output lacks guaranteed consistency. Because they operate probabilistically rather than deterministically, their blind spots remain unpredictable, and AI-based code review cannot serve as the sole defense.

As pull requests grow in size and frequency, human review alone cannot scale. Developers facing delivery timelines frequently approve changes without line-by-line inspection. Anirban Chatterjee, Director of Product and Solutions Marketing at Sonar, notes that postponing verification until the PR stage means an agent may repeat the identical mistake three, four, or five times. The objective should be preventing that defect from entering the PR and from recurring. Automated verification can address distinct problem categories, while human developers retain responsibility for quality and concentrate on high-stakes modifications.

Loop one: the agentic loop — improve effectiveness at creation

Sonar's Agent Centric Development Cycle, or AC/DC, embeds guidance, generation, verification, and remediation within the agentic workflow itself. The earliest intervention opportunity occurs while the agent is still composing code. In the agentic loop, guidance and automated verification operate alongside generation: the agent receives necessary context, implements a change, validates it, and resolves any issues before proceeding.

Context proves essential because agents lack the ingrained codebase familiarity that experienced developers possess—knowledge of architecture, relevant files, and established conventions. Without this grounding, agents make unnecessary assumptions, modify excessive files, or write more code than required. Chatterjee explains that agents must conduct substantial discovery work and explore multiple files, which grows expensive in complex codebases. Supplying agents with precisely what they need, when they need it—from project standards to historical issues—reduces exploratory overhead and helps generate code that integrates with the existing system.

Code verification by AI occurs as the agent makes each change, rather than waiting for the PR. This allows the agent to address problems while the scope remains contained, before identical mistakes propagate elsewhere. Chatterjee notes that the engineering community understands that earlier problem detection reduces fix costs—the same principle applies to agentic development. SonarQube's analysis runs computationally, so identifying issues does not require invoking a generative AI model to review its own output and consume extra tokens. The agent can direct those tokens toward fixing verified problems, while the developer receives a cleaner changeset to evaluate.

Loop two: the CI verification loop — scale confidence at merge

The agentic loop identifies and remedies issues during authoring. The CI verification loop then assesses the complete proposed change before it enters the shared codebase or advances toward production. It supplies an independent checkpoint for consistent evaluation of quality, security, dependencies, and maintainability, enforcing organizational standards through a defined quality gate. The first loop should reduce problems reaching CI, but the second remains vital because it provides additional scrutiny independent of the agent that created the code.

The aim is not to eliminate human accountability but to make it manageable at agentic scale and speed. The developer remains accountable, according to Howlett, but should concentrate on decisions and risks demanding human judgment. Reviewing every line with the same rigor as before is unrealistic given the volume, he adds. Automated checks and AI-assisted review narrow the focus, allowing developers to prioritize consequential design, business, and risk judgments rather than uniform line-by-line review.

Scrutiny intensity should align with failure consequences. A low-risk internal tool might warrant a lighter review process, whereas software managing a banking system processing billions daily requires additional verification layers and heightened human oversight. AI coding tools can flag areas of concern but should operate within a zero-trust, multilayered framework. No single check, including the model that generated the code, suffices alone. SonarQube performs automated code analysis, detecting bugs, vulnerabilities, architectural, and complexity issues in real time across all code. Gitar, which Sonar acquired in May 2026, contributes AI-powered review, including pull request comments, summaries, walkthroughs, and diagrams. Together, these multiple layers enable teams to scale software development at agent speed while building confidence in what reaches production.

Loop three: the code maintenance loop — protect ROI over time

AI coding tools operate against a changing codebase, not a static one. Code written today becomes the foundation future agents learn from and modify, meaning poor quality, inconsistent patterns, and technical debt can reinforce themselves. This reality makes codebase readiness a prerequisite for scaling AI. Chatterjee advises organizations beginning large-scale AI adoption to prioritize code that is high-quality and free of bugs and vulnerabilities. Ensuring code is healthy and current provides agents a stronger foundation, Chatterjee tells The New Stack, and experimenting with multiple AI tools simultaneously helps identify which ones suit your team.

All three loops are interdependent, with each improving conditions for the next. The code maintenance loop must run continuously and consistently. Background analysis and remediation can surface legacy issues, security vulnerabilities, and accumulated technical debt before they obstruct future development. Without this work, agents spend more time navigating complexity, consume additional tokens, and struggle to produce changes that are straightforward to verify. Maintenance preserves the conditions enabling effective code generation and verification.

Going after AI-enabled velocity

Leaders deploying AI coding tools at scale should begin by establishing shared organizational agreement on what good software entails. From that foundation, teams can embed verification into their workflow.

  • Define intent and set shared standards. Clarify what a change should accomplish, along with the quality, security, reliability, and maintainability criteria it must satisfy.
  • Prepare and maintain the codebase. Address existing bugs, vulnerabilities, inconsistent practices, and architectural issues so agents have a stronger foundation. Treat this as continuous work rather than a single remediation effort.
  • Experiment in a controlled way. Evaluate AI tools and workflows against the same independent standards.
  • Verify earlier. Integrate automated code verification into the agentic workflow to identify and fix issues while code is being written.
  • Guide and govern according to risk. Provide agents relevant context, clear constraints, and escalation boundaries. Apply additional verification layers, approvals, and human scrutiny where failure carries serious consequences.

Howlett, who hosts the weekly developer podcast The Next Commit, recommends measuring whether teams complete more manageable pull requests, ship more frequently, and reduce cycle time. He cautions against using lines of code as a metric. "If that's going up a lot, then we've got a problem." Increased output matters only if quality remains stable or improves.

AI coding's true value hinges less on code volume than on how confidently teams deploy that code. The three verification loops convert raw generation into reliable velocity, delivering AI-driven speed without compromising quality. SonarQube delivers independent verification, applying that discipline across the tools and environments teams select.