AI coding tools can deliver a dramatic spike in output, but the gains prove short-lived, according to a Carnegie Mellon study examining public repositories that adopted Cursor. The research documented a three- to fivefold jump in lines added during the opening month, with the productivity increase evaporating after approximately two months. The study, which relied on SonarQube to assess code quality, also recorded a 30% rise in static analysis warnings and a 41% climb in code complexity, suggesting that the initial velocity surge carries a lasting cost in technical debt.
Tom Howlett, Sonar's Director of AI Engineering Engagement, explains that while coding has accelerated, verification—which many teams still handle through manual code review—hasn't matched the pace. If developers produce 50 times more code while depending on the same review process, time devoted to code review increases and creates a bottleneck, Howlett tells The New Stack. There's an additional wrinkle: agents don't always know how to implement the smallest change necessary to deliver a feature, and without adequate context about the codebase, they can make assumptions, generate superfluous code, and contribute to technical debt. As Howlett describes it, you wind up with more complex, verbose code, which compounds the problem.
The report introduces Sonar's code confidence formula: intent × guiderails × verification × evidence. Howlett notes that the multiplication is intentional—if any element is absent, confidence collapses. Putting that formula into practice demands more than a final review; teams need to embed it into three connected loops that compose development today: the agentic loop, as the code is created; the CI verification loop, as changes are tested and prepared for merge; and the code maintenance loop, as the codebase evolves after release. Having the model that generated the code review its own work is "like a student grading their own homework," Howlett says, and AI code review can't serve as your only line of defense.
The lesson for engineering leaders is that faster code generation doesn't automatically translate to greater value. The code produced today becomes the context future agents learn from and work on, so poor-quality code, inconsistent patterns, and technical debt can become self-reinforcing. Anirban Chatterjee, Sonar's director of product and solutions marketing, advises organizations starting to use AI at scale to ensure the code is high-quality and free of bugs and vulnerabilities. Chatterjee and Howlett recommend defining intent and setting shared standards, preparing and maintaining the codebase, experimenting in a controlled way, verifying earlier by connecting automated code verification to the agentic workflow, and guiding and governing according to risk. Howlett warns against using lines of code as a measure: "If that's going up a lot, then we've got a problem," because more output matters only if quality remains stable or improves. The real test isn't how much code agents can churn out, but whether teams can ship that code with confidence while preserving quality, security, and reliability standards. The temptation to chase velocity metrics alone may blind organizations to the structural costs accumulating beneath the surface, where mounting complexity eventually erodes the very productivity gains that justified adoption in the first place.