Sonar says fewer than half of developers who doubt AI code fully verify it

In a Sonar survey of over 1,100 developers, fewer than half of those who did not fully trust AI-written code fully verified it before pushing it. Killian Carlsen-Phelan of Sonar shared the result on the AI Engineer show.

What was said

Carlsen-Phelan said 96% of those surveyed did not fully trust AI-generated code. Only 48% of that group fully verified the code before pushing it. That figure measures full verification. It does not say the rest did no checking at all.

He found the gap alarming: "That terrifies me that we are just blindly setting off code into production without verifying it." Coding agents write faster than people can review by hand, he said.

His answer is a Sonar plugin called Vortex. It runs a fixed-rule analysis each time the agent edits a file. He stressed one property: "every time you run the analysis on this code, you get the same result back." In plain terms, the same code always gets the same verdict.

He argued against using AI as the checker. Sonar found an AI checking its own work to be one of the least reliable methods, he said.

He gave a worked example. According to the show notes, Vortex caught a temp-file permission bug that the agent's own tests missed. It also rejected the agent's first fix.

Why it matters

Our reading: the risk here sits in habit, not only in model error. A team can doubt AI output, and say so in a survey, yet not fully verify what it ships.

For managers, stated doubt is a poor stand-in for safety. A better question is what share of AI-written changes gets fully verified. Sonar says its check runs on every edit automatically. Verification then does not depend on a developer remembering to do it.

The example also shows why the checker matters. A test written by the same agent can share the agent's blind spot. A reviewer that gives the same answer every run is easier to audit than one that varies.

The other side

Sonar sells code-checking tools, so the framing favours its product. The 48% figure comes from Sonar's own survey. The excerpts do not say how "fully verified" was defined, or whether answers were self-reported.

Carlsen-Phelan gave no reason why developers skip full checks. The source also does not show whether Vortex changes what developers verify before pushing. It checks the agent's edits.

He did not argue against AI review. He said he likes it and that Sonar makes an AI reviewer too. He described Vortex as a layer alongside it.