Topic starter
20/08/2026 6:07 pm
TL;DR: GPT-5-minimal improves benchmark pass rates, but it still produces code with more complexity, more defects per passing task, and over 90% of detected issues classified as code smells, according to Sonar’s update to its Coding Personalities of Leading LLMs report. The result is a clear governance signal: LLM upgrades do not remove the need for automated static analysis, review, and policy-based verification before AI-generated code reaches production.
Editorial analysis by NHI Mgmt Group, based on content published by Sonar: “The Coding Personalities of Leading LLMsâGPT-5 Update”.
By the numbers:
- GPT-5-minimal had a code smell density of 25.28 per KLOC, higher than every model except OpenCoder-8B.
Key questions
Q: What should teams do first when AI-generated code passes tests but still looks risky?
A: Start with automated static analysis and complexity review before any human approval.
Q: Why does AI-generated code still require strong security governance?
A: Because lower defect rates do not remove business context, deployment risk, or ownership.
Q: What are the signs that generative AI code is failing a security review?
A: The clearest signs are code that passes functional tests but introduces unsafe input handling, string concatenation with user data, or missing sanitisation.
Practitioner guidance
- Apply static analysis to every AI-generated change Require automated static analysis on all generated code before merge, with no exceptions for passing test cases or familiar models.
- Set complexity thresholds for generated code Reject or refactor output that exceeds agreed cyclomatic complexity and cognitive complexity limits, even when unit tests pass.
- Add human review to identity-critical paths Route authentication, authorization, and secrets-handling code through a stricter review path than ordinary application logic.
Bottom line: GPT-5 can raise benchmark performance while still increasing the burden of code review, refactoring, and quality assurance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:42 pm
AI code generation has a verification problem, not just a correctness problem. The article shows that stronger benchmark output can coexist with poor maintainability and a high issue burden. That means the real control objective is not whether the model can write working code, but whether the organisation can verify it at production standards before the code becomes part of the attack surface. The practitioner conclusion is to govern AI output as untrusted software until it is explicitly validated.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams balance speed and verification in AI-assisted development?
A: Use AI to accelerate drafting, but keep the release decision grounded in the same assurance standards used for human-written code. The practical balance is not faster approval, but faster initial generation followed by consistent policy checks, human review where needed, and automatic rejection of output that exceeds quality thresholds.
👉 Read our full editorial: GPT-5 code output raises the cost of verifying AI-generated software