The explosion of AI‑generated code is outpacing developers’ ability to review it, creating a dangerous verification bottleneck that threatens the security of shipped software, a new report from Sonar has warned.

The code quality platform’s latest State of Code Developer Survey found that almost three-quarters (72%) of devs who have tried AI use it every day, with AI accounting for 42% of all committed code, a volume expected to rise to 65% by 2027.

Sonar’s survey reveals an industry moving through a turbulent transition, with the promise of AI hitting practical limitations. For instance, while 64% of developers use AI agents, the surge of automation has not reduced software ‘toil work’, like reviewing and debugging AI outputs, which takes up nearly a quarter (24%) of the work week.

Despite leaning into a ‘vibe then verify’ approach, a critical disconnect has emerged, with 96% of developers saying they do not fully trust AI-generated code, but less than half (48%) taking the necessary steps to verify AI output before it’s committed.

This is creating significant ‘verification debt, ’ Sonar warned, with 38% of developers agreeing that reviewing AI-generated code requires more effort than reviewing code written by their human colleagues.

Meanwhile, AI’s impact on technical debt also appears to be a double-edged sword, as almost all (93%) of developers report positive effects, including improved documentation (57%) and test coverage (53%), 88% also cite negative impacts, specifically around the generation of code that looks correct but isn’t reliable (53%) or is unnecessary and duplicative (40%).

Recommended reading

• The Biggest LLMs Are Generating Vulnerable Code by Default
• Comment| Vibe Coding Blurs the Line Between Innovation and Exposure
• Report: 65% of Devs Say AI Code Needs Major Fixes

“We are witnessing a fundamental shift in software engineering where value is no longer defined by the speed of writing code, but by the confidence in deploying it,” said Tariq Shaukat, CEO of Sonar.

“While AI has made code generation nearly effortless, it has created a critical trust gap between output and deployment. To realise the full potential of AI, we must close this gap. 

“The winners in this new era will be those who empower their developers to use AI as a true force multiplier, pairing rapid generation with the automated and comprehensive review and verification needed to ensure strictly high-quality, highly-maintainable, secure code.”