Topic starter
20/08/2026 5:49 pm
TL;DR: AI now accounts for 42% of committed code and is expected to reach 65% by 2027, according to Sonar's 2026 State of Code Developer Survey of more than 1,100 developers, yet 96% of developers do not fully trust it and only 48% always verify it before committing. The result is a verification bottleneck that shifts risk from creation speed to review quality, where automated checks and disciplined code security become the difference between productivity and hidden defects, according to Sonar.
Editorial analysis by NHI Mgmt Group, based on content published by Sonar: “State of Code Developer Survey report: The current reality of AI coding”.
By the numbers:
- AI now accounts for 42% of committed code today, according to Sonar’s 2026 State of Code Developer Survey.
- AI-generated code is expected to reach 65% by 2027, according to Sonar’s 2026 State of Code Developer Survey.
- 96% of developers do not fully trust AI-generated code, according to Sonar’s 2026 State of Code Developer Survey.
Key questions
Q: What breaks when AI-generated code is only checked after commit?
A: Post-commit controls miss the moment when risky code is created, so secrets, insecure patterns, and policy violations can enter the repository before security ever sees them.
Q: Why do AI coding tools create a security risk even when code looks correct?
A: They optimise for syntax and pattern completion, not contextual security reasoning.
Q: What are the warning signs that AI code review is failing?
A: Look for large pull requests approved with minimal discussion, reviewers unable to explain the change, repeated exceptions to standards, and security checks treated as ceremonial.
Practitioner guidance
- Implement mandatory AI-code verification gates Require static analysis, secret scanning, dependency checks, and test coverage thresholds before AI-assisted code can merge.
- Tighten review for privileged code paths Apply deeper human review to code that touches authentication, authorization, secrets management, and cloud permissions.
- Track AI-generated change provenance Tag AI-assisted commits, retain prompt or tool metadata where feasible, and preserve evidence of who approved the change.
Bottom line: AI-assisted development has shifted the critical bottleneck from code creation to code verification, where review quality now determines whether speed is an asset or a liability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:28 pm
Verification has become the new control plane for AI-assisted development. The article shows that generation is now cheap while assurance remains expensive, which flips the traditional productivity narrative. Security and quality teams need to treat review capacity, automated test coverage, and policy enforcement as primary controls rather than downstream hygiene. The practitioner conclusion is simple: if verification does not scale, AI code adoption scales risk faster than value.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should engineering teams treat AI-generated code differently from human-written code?
A: Yes. AI-generated code should pass the same security and quality standards, but it often needs stricter provenance, deeper review on sensitive paths, and stronger automated controls because volume and ambiguity increase the chance of missed defects. The right response is not special treatment, but stronger governance where risk is highest.
👉 Read our full editorial: AI-generated code is creating a verification bottleneck for developers