Notifications
Clear all
Topic starter
20/08/2026 5:59 pm
TL;DR: AI-generated code shifts code quality from a readability problem to a verification problem, because teams now need to detect hallucinated packages, hidden security flaws, and inconsistent architectural patterns at machine speed according to Sonar. Human review alone cannot scale to asynchronous code payloads, so quality gates must become deterministic controls rather than after-the-fact checks.
NHIMG editorial — based on content published by Sonar: Code quality in the age of AI
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: What breaks when AI-generated code is only checked after commit?
A: Post-commit controls miss the moment when risky code is created, so secrets, insecure patterns, and policy violations can enter the repository before security ever sees them.
Q: Why does AI-assisted development increase application identity risk?
A: Because many applications implement identity controls in code, and AI tools can reproduce insecure login, token, and access patterns at scale.
Q: How do you know if data quality controls are actually working?
A: Look for fewer manual remediation cycles, faster detection of inconsistencies, and higher confidence in shared datasets across teams.
Practitioner guidance
- Define merge gates for AI-generated code Require static analysis, unit tests, and security checks to pass before any AI-generated change can merge into the main branch.
- Set complexity thresholds for identity-related code Flag high cyclomatic complexity and high cognitive complexity in authentication, authorisation, and secrets-handling paths because those are the places where logic drift becomes security drift.
- Separate intent review from structural verification Use manual peer review for business intent and automated tools for syntax, control flow, dependency issues, and security findings so each review type does what it does best.
What's in the full article
Sonar's full article covers the operational detail this post intentionally leaves for the source:
- Specific code-quality dimensions and metric definitions, including cyclomatic complexity, cognitive complexity, code coverage, and technical debt ratio.
- Examples of how static analysis and automated review fit into CI/CD workflows for large, AI-assisted codebases.
- More detail on SonarQube's inner-loop and outer-loop verification model for agent-generated code.
- The article's explanation of how quality profiles and guided remediation are meant to reduce noise and speed correction.
👉 Read Sonar's analysis of code quality in the age of AI →
AI-written code quality debt: are your controls keeping up?
Explore further
20/08/2026 6:38 pm
AI code quality debt is now a governance issue, not a style issue. The article correctly frames code quality as a control problem because AI-written code can scale defects, not just accelerate delivery. In identity-heavy systems, poor-quality code often creates weak authentication paths, mis-scoped permissions, and secret exposure. Practitioners should treat generated code as part of the privileged attack surface.
A question worth separating out:
Q: Should organisations require manual review for every AI-written code change?
A: Not necessarily for every minor change, but they should require human accountability for every AI-generated contribution that reaches merge or production. The right model is selective human review plus mandatory automated testing, ownership assignment, and policy gates for code that affects secrets, access control, or external exposure.
👉 Read our full editorial: Code quality in the age of AI needs verification, not hope
