Notifications
Clear all
Topic starter
14/09/2026 10:09 am
TL;DR: Developer teams are being asked how they are handling the shift from AI-assisted writing to AI-heavy review workflows, after last year’s survey found 42% of committed code was AI-generated and only 48% of developers always verified AI output before commit, according to Sonar. The governance question is no longer whether AI writes code, but whether verification, accountability, and change control still work when agents accelerate production.
NHIMG editorial — based on content published by Sonar: the call for responses to the next State of Code developer survey
By the numbers:
- 42% of committed code was AI-generated in last year’s State of Code survey.
- Only 48% of software developers always verified AI output before committing it.
- The survey reached more than 1,100 professionals, giving the findings a broad practitioner base.
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why do AI coding assistants create new security review risks?
A: They can produce code that looks correct but still contains weak authentication, unsafe data flows, or hidden secret handling mistakes.
Q: How do you know if AI code review controls are working?
A: Look for reduced defect density in AI-assisted pull requests, faster closure of high-severity findings, and fewer escaped issues in authentication, authorisation, and session workflows.
Practitioner guidance
- Measure review integrity alongside delivery speed Track the percentage of AI-authored changes that receive independent human review before merge, then compare that rate with the volume of AI-generated commits and the number of exceptions granted in protected branches.
- Separate generation, review, and approval duties Prevent the same identity, tool, or model chain from writing code, validating it, and authorising release for security-sensitive paths such as authentication, secrets handling, and privilege checks.
- Apply stricter controls to sensitive code paths Require extra test evidence, targeted review, and explicit sign-off for code that changes access logic, token handling, secret storage, or permission checks, because these patterns create downstream identity risk.
What's in the full report
Sonar's full survey call-out covers the operational detail this post intentionally leaves for the source:
- The questionnaire prompts on AI-authored changes reaching production without separate human review.
- The specific comparison between AI writing and AI reviewing, including how teams are handling self-review concerns.
- The timing and effort questions around whether productivity gains have plateaued as agents become part of the workflow.
- The 20-minute response path for practitioners who want to contribute to the next State of Code dataset.
👉 Read Sonar's call for responses to the next State of Code developer survey →
AI code review under pressure: are verification controls keeping up?
Explore further
14/09/2026 10:10 am
AI-assisted development is becoming an identity and governance problem, not just a code-quality problem. When agents generate more of the software estate, the organisation is no longer governing only human developer behaviour. It is governing machine-assisted change, review trust, and the privilege to introduce code into production. That makes this topic relevant to IAM, PAM, and application governance because code pipelines increasingly decide who or what can alter business-critical controls. Practitioners should treat AI coding as a governed access path, not a productivity feature.
A question worth separating out:
Q: Should security and engineering teams separate code generation from approval rights?
A: Yes, for any change that can affect authentication, secrets, permissions, or production access. Separation of duties reduces the chance that one automated path can create and authorise risky changes end to end. That principle becomes more important as agentic workflows compress the time between writing, review, and release.
👉 Read our full editorial: AI code verification is lagging behind agent-generated output
