Topic starter
20/08/2026 5:43 pm
TL;DR: 64% of developers now use agentic AI tools, with documentation, test generation, and code review emerging as the top use cases, according to Sonar’s State of Code Developer Survey, but effectiveness remains uneven and high-risk patching is still relatively rare. The security issue is not agent adoption itself, but the absence of deterministic verification as autonomous workflows scale.
Editorial analysis by NHI Mgmt Group, based on content published by Sonar: “The automation shift: Why 64% of developers use AI agentic tools”.
By the numbers:
- 64% of developers now use AI agentic tools, moving beyond simple assistants to autonomous agents capable of executing multi-step, goal-driven workflows.
- 68% of developers use agents for creating code documentation.
- 57% of developers use agents for automated code review.
Key questions
A: Unsafe or incomplete changes can move through the pipeline faster than humans can inspect them, creating a verification bottleneck rather than a productivity gain.
Q: Why do agentic coding workflows increase security risk even when developers trust the model?
A: Because trust in the model is not the same as control over the workflow.
Q: How can security teams tell whether agentic code review is actually working?
A: They should look for repeatable, enforced validation outcomes rather than subjective approval rates.
Practitioner guidance
- Implement deterministic verification gates Require automated policy, test, and security checks to pass before agent-generated code can merge or deploy, regardless of reviewer confidence.
- Scope agent permissions as non-human identities Assign each coding agent the minimum repository, CI, and deployment access needed for the task, and separate those permissions from human developer access.
- Log the agent execution path Capture prompts, tool calls, test results, and code diffs so teams can reconstruct how an agent reached a change and detect unsafe patterns.
Bottom line: Agentic AI is moving into everyday development work, but the central governance challenge is proving correctness before code reaches production.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:26 pm
Verification is becoming the primary control plane for agentic coding. The article shows that generation is outpacing confidence, especially where code review is involved. When autonomous tools can produce useful output faster than humans can inspect it, the decisive question becomes whether the organisation has machine-enforced validation that is independent of the model’s output. Practitioners should treat verification as the real security boundary, not a post-hoc quality step.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- A Harris Poll survey of more than 300 technology decision-makers found that 86% expect agentic AI to deliver positive ROI, yet fewer than half had AI governance policies in place.
A question worth separating out:
Q: What should organisations do when autonomous coding starts touching production-critical systems?
A: They should treat the agent like a governed non-human identity with tightly scoped access, explicit approval boundaries, and auditable actions. Production-critical systems need stronger separation between generation and release, plus stricter checks for patches, deployment changes, and secret-bearing workflows. The goal is to keep autonomy bounded where the business impact of failure is highest.
👉 Read our full editorial: Agentic AI coding is moving verification from humans to systems