Hype and Reality of the AI Coding Shift
AI coding tools have gone from novelty to core infrastructure in under three years. Today, many devs use AI daily, a substantial share of new code is AI-generated, and expectations for automation are rapidly increasing.
Sonar is a company specializing in analysis of code quality and security, and they recently released a new survey – the State of Code Developer Survey. The survey provides a deep examination of how developers are using AI in real production environments, and where the real-world gaps and risks still exist.
Chris Grams is the CVP of Corporate Marketing at Sonar, and Manish Kapur is the VP of Product Marketing and Developer Relations at Sonar. In this episode, they join Matt Merrill to discuss what the survey reveals about AI-assisted development, why 96% of developers still don’t fully trust AI-generated code, how deterministic verification layers fit into agent-driven workflows, and what engineering leaders should prioritize as AI shifts from experimentation to production infrastructure.
Matt Merrill is a software engineering leader with over 20 years of experience building and scaling software teams across enterprise and product-focused organizations. His background is in backend development, cloud architecture, and distributed systems design. He currently architects and delivers software products and leads a team of engineers at DEPT® Agency. You can learn more about his work at code.theothermattm.com.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Hype and Reality of the AI Coding Shift appeared first on Software Engineering Daily.
Code security for software engineers
Brought to You By:
• Statsig — The unified platform for flags, analytics, experiments, and more. Statsig are helping make the first-ever Pragmatic Summit a reality. Join me and 400 other top engineers and leaders on 11 February, in San Francisco for a special one-day event. Reserve your spot here.
• Linear — The system for modern product development. Engineering teams today move much faster, thanks to AI. Because of this, coordination increasingly becomes a problem. This is where Linear helps fast-moving teams stay focused. Check out Linear.
—
As software engineers, what should we know about writing secure code?
Johannes Dahse is the VP of Code Security at Sonar and a security expert with 20 years of industry experience. In today’s episode of The Pragmatic Engineer, he joins me to talk about what security teams actually do, what developers should own, and where real-world risk enters modern codebases.
We cover dependency risk, software composition analysis, CVEs, dynamic testing, and how everyday development practices affect security outcomes. Johannes also explains where AI meaningfully helps, where it introduces new failure modes, and why understanding the code you write and ship remains the most reliable defense.
If you build and ship software, this episode is a practical guide to thinking about code security under real-world engineering constraints.
—
Timestamps
(00:00) Intro
(02:31) What is penetration testing?
(06:23) Who owns code security: devs or security teams?
(14:42) What is code security?
(17:10) Code security basics for devs
(21:35) Advanced security challenges
(24:36) SCA testing
(25:26) The CVE Program
(29:39) The State of Code Security report
(32:02) Code quality vs security
(35:20) Dev machines as a security vulnerability
(37:29) Common security tools
(42:50) Dynamic security tools
(45:01) AI security reviews: what are the limits?
(47:51) AI-generated code risks
(49:21) More code: more vulnerabilities
(51:44) AI’s impact on code security
(58:32) Common misconceptions of the security industry
(1:03:05) When is security “good enough?”
(1:05:40) Johannes’s favorite programming language
—
The Pragmatic Engineer deepdives relevant for this episode:
• What is Security Engineering?
• Mishandled security vulnerability in Next.js
• Okta Schooled on Its Security Practices
—
Production and marketing by https://penname.co/. For inquiries about sponsoring the podcast, email podcast@pragmaticengineer.com.
Get full access to The Pragmatic Engineer at newsletter.pragmaticengineer.com/subscribe
#224 Tariq Shaukat: How Safe Is AI-Assisted Coding?
This episode is sponsored by Oracle.
Oracle Cloud Infrastructure, or OCI is a blazing fast and secure platform for your infrastructure, database, application development, plus all your AI and machine learning workloads. OCI costs 50% less for compute and 80% less for networking. So you're saving a pile of money. Thousands of businesses have already upgraded to OCI, including MGM Resorts, Specialized Bikes, and Fireworks AI.
Cut your current cloud bill in HALF if you move to OCI now: https://oracle.com/eyeonai
In this episode of the Eye on AI podcast, Tariq Shaukat, CEO of Sonar, joins Craig Smith to explore the future of code quality, security, and AI's role in software development.
Tariq shares his journey from leading roles at Google Cloud and Bumble to helming Sonar, a company disrupting code assurance for developers worldwide. With over 7 million users and support for 30+ programming languages, Sonar has become a critical tool in ensuring clean, maintainable, and secure code.
We dive into Sonar's innovative AI Code Assurance Workflow, which integrates seamlessly with generative AI tools like Copilot and Codium. Tariq discusses how Sonar addresses the challenges of AI-generated code, tackling issues like security vulnerabilities, maintainability problems, and the accountability crisis in today's coding landscape.
Tariq also unpacks the importance of hybrid deterministic and AI-driven approaches, the role of design and architecture in modern software development, and how Sonar is helping companies manage tech debt across billions of lines of code.
With Sonar's recent enterprise-grade SaaS launch and commitment to reducing developer toil, this episode offers valuable insights for developers, tech leaders, and anyone interested in the evolving intersection of AI and software engineering.
Don't forget to like, subscribe, and hit the notification bell for more discussions on AI, technology, and innovation!
Stay Updated:
Craig Smith Twitter: https://twitter.com/craigss
Eye on A.I. Twitter: https://twitter.com/EyeOn_AI
(00:00) Introduction to Tariq Shaukat and Sonar
(01:23) Overview of SonarQube
(03:03) Deterministic Systems and AI Integration
(07:36) Challenges of AI-Generated Code
(10:12) Early Issue Detection in Development
(12:33) Accountability in AI Code Generation
(16:20) Importance of Rigorous Code Reviews
(19:34) Managing Tech Debt with Continuous Improvement
(22:16) Why Sonar Focuses on Integration
(25:08) Reviewing Billion-Line Code Bases with Sonar
(29:37) Tailoring Sonar for Specific Codebases and Workflows
(32:40) Avoiding Overwhelming Developers with Noise
(37:49) Governance and Managing Complex Codebases
(40:50) Addressing Tech Debt in Legacy Systems
(45:07) Sonar's Open-Source Model and Philosophy
(48:11) What's Next for Sonar
The new pair programming: an AI agent that cleans your code as you write
Tariq Shaukat, the former president of Google Cloud and Bumble, is the CEO of Sonar. Follow him on LinkedIn.
Sonar offers code quality and security solutions that help developers write clean code and remediate existing code organically. Their product SonarQube helps devs ensure the quality and security of AI-generated code.
Watch Olivier Gaudin, founder of Sonar, explain why clean code is the foundation for well-functioning dev teams.
Stack Overflow user Ogglas earned a Populist badge by explaining How to access the appsettings in Blazor WebAssembly.
See Privacy Policy at https://art19.com/privacy and California Privacy Notice at https://art19.com/privacy#do-not-sell-my-info.