Sonar's 2026 State of Code survey landed last month, and one number stands out: 96% of developers do not fully trust AI-generated code. That's near-universal skepticism. The industry knows the code is suspect.
Here's the other number: only 48% always verify it before committing. Half the time, code that nobody trusts ships without anyone checking.
AI now accounts for 42% of all committed code — up from single digits two years ago, and projected to hit 65% by 2027. We're not talking about a fringe experiment. This is nearly half the codebase, written by a system everyone agrees is unreliable, verified by a coin flip.
Sonar is calling it the "verification gap." It might be the most dangerous pattern in software engineering right now.
The gap isn't laziness. 38% of developers say reviewing AI code takes more effort than reviewing human-written code. That's counterintuitive — wasn't AI supposed to save time? — but it makes sense if you've ever tried to review a 200-line function that looks perfectly reasonable and has a subtle off-by-one three layers deep.
Human-written code carries fingerprints of the developer's intent. You can read the commit message, look at the ticket, understand what they were trying to do. AI-generated code carries no intent. It's a statistical average of what "correct" looks like, and the failure modes are the places where the average diverges from your specific requirements.
Reviewing that takes longer because you have to reconstruct the intent yourself, then check whether the code actually achieves it. Most developers, under deadline pressure, don't have time for that reconstruction on every commit. So they spot-check. Or they don't check at all.
The code ships. The tests — if they exist — pass. The bugs hide.
While the verification gap was growing, Cyera was cataloging what happens on the other side of it.
Their analysis of 7,200 publicly reported AI incidents between 2023 and May 2026 identified 344 verified cases of enterprise agent damage. These weren't edge cases or research demos. They were production systems. Deleted databases. Unauthorized financial operations. Runaway API spending. Silent data corruption.
The most striking finding: 188 of those 344 incidents involved no external attacker at all. The agents weren't compromised. They weren't manipulated. They completed their assigned tasks — and the tasks caused damage because nobody tested what would happen when the agent actually ran.
More than half of verified agent damage was self-inflicted. The agent did exactly what it was told. The instructions were wrong, or incomplete, or correct for a scenario that wasn't the one that actually occurred. And nobody ran the flow in advance to find out.
A separate report from Kiteworks found that 65% of firms experienced AI agent security incidents in 2026. Two thirds. This isn't a tail risk. It's the baseline.
The traditional response to untrustworthy code is more rigorous code review. But that's exactly the part that's failing — 38% say it's harder, not easier, and only half are doing it consistently.
Code review works when the reviewer can spot the bug by reading the code. It works less well when the bug is a function that handles authentication correctly in 99 cases and silently drops a session token during one specific redirect chain. That's not a code review bug. That's a behavior bug. You find it by running the flow, not by reading the diff.
53% of developers say AI has negatively impacted technical debt by creating code that looks correct but isn't reliable. "Looks correct" is doing heavy lifting in that sentence. The code passes review. It passes unit tests. It passes the AI's own confidence threshold. It breaks when a real user hits the edge case that the training data didn't cover.
The Ranorex Software Quality Pulse Report — a survey of nearly 4,000 QA engineers and developers — found that teams have automated an average of 57% of their tests. That sounds reasonable until you realize that nearly half of those teams are still dissatisfied with their QA process, and only 26% have their testing fully integrated with their CI/CD pipeline.
So the picture is: AI writes 42% of the code. Half the developers don't verify it. The test automation that's supposed to catch problems covers 57% of test cases. And three quarters of teams aren't even running those tests automatically on every push.
The verification gap isn't just about code review. It's a stack of gaps — code review, test coverage, CI integration, and flow coverage — each one leaking defects to the next. AI-generated code amplifies every gap because it produces more code, faster, with more subtle failure modes.
The math isn't complicated. If the code is less trustworthy and the review is harder, the thing that catches bugs can't be review. It has to be testing. And not unit tests that verify the code does what the code says — integration tests that verify the app does what the user expects.
The 344 agent incidents in the Cyera report didn't happen because code review was skipped. They happened because nobody ran the full flow. Nobody clicked through the sequence of actions that a user (or an agent) would actually perform and verified that the outcome was correct. The damage was behavioral — the agent followed the steps, and the steps produced the wrong result.
That's the same class of bug that AI-generated code introduces at scale: code that looks right, passes static checks, and fails when it meets real user behavior. The fix is the same in both cases. Run the flow. Against the real app. Through the real network. With real state.
The teams in the Sonar survey that used systematic verification tools reported 44% fewer outages caused by AI-generated code. The ones that didn't were part of the 53% watching their technical debt grow.
The verification gap will keep widening as AI writes more code. The only question is whether your testing closes it — by verifying the behavior that actually ships — or whether you're in the 52% that commits it and hopes for the best.