Notifications
Clear all
Topic starter
20/08/2026 5:43 pm
TL;DR: 64% of developers now use agentic AI tools, with documentation, test generation, and code review emerging as the top use cases, according to Sonar’s State of Code Developer Survey, but effectiveness remains uneven and high-risk patching is still relatively rare. The security issue is not agent adoption itself, but the absence of deterministic verification as autonomous workflows scale.
NHIMG editorial — based on content published by Sonar: State of Code Developer Survey, chapter 4 on agentic AI
By the numbers:
- 64% of developers now use AI agentic tools, showing that autonomous workflows are moving into everyday development work.
- 68% of developers use agents for documentation creation, making it the most common agentic use case in the survey.
- Only 52% of developers rate agents as highly effective for automated code review, leaving a visible trust gap in verification workflows.
Questions worth separating out
Q: How should security teams govern AI-enabled workflows that can act on their own?
A: Treat them as identity-governed execution paths, not just software features.
Q: Why do AI coding tools increase verification risk in CI/CD pipelines?
A: They increase risk because they can produce plausible output faster than humans can inspect it, which raises the chance that defects, insecure patterns, or brittle fixes pass through review.
Q: What breaks when autonomous coding agents are given broad access?
A: Control breaks down when the agent can move across tools and repositories without tight limits on scope, attribution, or revocation.
Practitioner guidance
- Scope agent permissions to specific development tasks Limit each agent to the repositories, pipelines, and tools required for a single workflow, and remove broad standing access that is not tied to an approved use case.
- Require deterministic verification before merge Pair every agent-generated change with automated tests, policy checks, and static analysis that must pass before a pull request can be merged.
- Inventory agent credentials as NHIs Track tokens, service accounts, and delegated access used by agents in the same inventory as other machine identities, with clear ownership and revocation paths.
What's in the full report
Sonar's full report covers the operational detail this post intentionally leaves for the source:
- Chapter-level survey results on agent adoption, effectiveness, and team size differences across SMB and enterprise environments.
- The underlying methodology and respondent breakdown behind the 1,100-plus developer sample.
- The wider State of Code findings on technical debt, trust gaps, and the engineering productivity paradox.
- The article series context covering daily AI coding habits, verification, and shadow AI in development teams.
👉 Read Sonar's State of Code survey findings on agentic AI and verification →
Agentic AI coding: are your verification controls keeping up?
Explore further
20/08/2026 6:26 pm
Agentic coding is becoming an identity governance problem, not just a productivity trend. Once software can create, test, and review code across multiple systems, it needs governed credentials and bounded authority like any other non-human identity. The security question is no longer whether the agent is helpful, but whether its access can be constrained, attributed, and revoked with the same discipline applied to service accounts. Practitioners should treat agentic workflows as part of the identity estate.
A question worth separating out:
Q: How do organisations reduce the risk of AI-generated code reaching production?
A: They need policy-driven gates that require tests, static analysis, and human approval for high-risk changes before deployment. The best control is not more generation tooling, but a stronger assurance layer that stops unsafe changes from crossing the release boundary.
👉 Read our full editorial: Agentic AI coding is moving verification from humans to systems
