Don't just generate it, verify it: AI code quality with Sonar

Don’t just generate it, verify it: AI code quality with Sonar

2025.12.04

With the explosion of generative AI tools (GitHub Copilot, Cursor, Windsurf, etc.), developers are writing code at an unprecedented speed. At first this seems like a huge gain, but Sonar’s official “AI Code Quality” page is quite clear: the volume of code is growing exponentially, while actual developer review capacity is not. This gives rise to what they call the “engineering productivity paradox” — productivity seemingly increases, but the risk is very real.

Throughout, the page shows how AI acceleration and code quality can be combined without the risk getting out of hand: “vibe, then verify” — in other words, developers can freely “spin up” code with AI, but at the end an automated, reliable verification layer closes the process.

What is the problem with AI-generated code?

Sonar highlights three main risks:

1. “Mind the gap” — the capacity gap

   AI dramatically speeds up code writing, but people’s time for review is finite. The volume of code grows, while the proportion of time that can be spent on genuine review shrinks — this is what leads to the productivity paradox mentioned above.

2. A crisis of trust in AI code

   Developers often do not trust complex or unfamiliar solutions suggested by AI. They fear hidden bugs, instability and security flaws.

3. Hidden security vulnerabilities and lax standards

   LLMs can “pass on” bad patterns, vulnerable code snippets and poor practices found in their training data. Without control, injection flaws, bad dependencies, or simply solutions that deviate from the team’s own coding standards can slip into the code unnoticed.

All in all: with AI more code is produced, but it becomes harder to keep track of and to maintain quality, and there is a serious risk that defects multiply “silently”.

The role of SonarQube: AI code, fast but supervised

From Sonar’s perspective, the solution is not to block the use of AI, but to put a security and quality framework around it. According to the page, SonarQube promises that it:

• supports the acceleration of AI-based development,
• while enforcing quality and security control on every line of code,
• and makes the inflow of AI code manageable at the organisational level.

The emphasis throughout is that developers should not slow down, but whatever AI produces should pass through a consistent set of rules — the same quality and security expectations as “classic” hand-written code.

Key features: how does Sonar “verify” AI code?

Sonar organises its AI-code-specific features into four major capability groups.

1. AI-ready quality gates

The familiar Sonar quality gate logic (“it can’t be merged if it’s red”) is applied specifically to AI code as well. The essence:

• AI-generated code passes the same — or even stricter — quality and security thresholds as human code,
• the merge can only happen if these are met (based on metrics such as bugs, code smells, vulnerabilities, coverage, duplication, etc.).

This layer provides the basic confidence that the AI code being merged is not “second-class” compared with the rest.

2. AI Code Assurance — automatic feedback in the DevOps platform

AI Code Assurance is essentially Sonar automation focused on AI code, which:

• checks quality, security and compliance at pull request level,
• gives feedback directly in the DevOps platform developers use (GitHub, GitLab, Azure DevOps, etc.),
• helps to separate and handle changes created by AI separately.

From the developers’ point of view, this means there is no need to open a separate tool — the “Sonar verdict” appears in the same place where they work anyway.

3. Real-time in-IDE feedback

SonarQube’s “AI code quality” solution also addresses the IDEs in which AI assistants (Cursor, Windsurf, Copilot integrations) now work. According to the page:

• the developer receives immediate feedback in the IDE on AI code that has been pasted in or modified,
• this helps quality and security problems surface while the code is being written, not just in the pipeline,
• the source (AI, developer, copy-paste) essentially does not matter — Sonar performs the check.

This is especially important where developers really are “chatting in code” with the AI assistant: it matters in what state quickly accepted suggestions end up in the repo.

4. Built-in security review

Sonar’s AI solution does not stop at code quality; the page highlights that:

• it uses automated analysis to look for critical vulnerabilities — e.g. injection flaws,
• it also examines dependency risks, which LLMs tend to “reproduce” based on their training data,
• this layer is particularly important with AI, because the model does not “know” that a given version of a library is already vulnerable — it just copies patterns.

In effect, this builds an AI security shield around the code, relying on Sonar’s classic security capabilities but specifically tailored to AI scenarios.

Summary — what are the key takeaways?

The problem: AI dramatically speeds up code writing, but this increases the risk of unchecked, inconsistent and vulnerable code getting into the system.

The solution: around SonarQube, Sonar builds a framework that,

• with AI-ready quality gates,
• AI Code Assurance,
• real-time feedback in the IDE
• and built-in security review, automatically checks AI code and brings it up to the same level as the output of human development.

The message: using AI is not risky in itself — what is risky is letting it into the product without control. Sonar’s solution promises that the organisation can retain control over code quality and security while confidently allowing developers to rely on AI assistants in their daily work.