Sonar Principal Engineer Outlines AI Code Review Strategy

Sonar is expanding its code verification capabilities following its May 2026 acquisition of Gitar, an AI-native platform designed to automate code reviews and diagnose continuous integration failures. Gautam Korlam, Gitar co-founder and now Principal Engineer at Sonar, is leading the integration of these agentic tools into Sonar's flagship SonarQube platform. The company, which serves over 22,000 customers and seven million developers, currently analyzes more than 750 billion lines of code daily.

The push for robust verification comes as rapid AI code generation threatens to overwhelm development pipelines. According to Sonar's 2026 State of Code Developer Survey, software teams spend roughly a quarter of their work week checking and fixing AI-generated output. While 96 percent of developers do not fully trust the functional correctness of machine-generated code, only 48 percent actually review it before committing. Korlam, who previously experimented with open-source models like StarCoder, OctoCoder, and Code Llama at Uber, argues that validating code has become a far more difficult challenge than generating it.

To address this, Sonar is advocating for a multilayered verification process that pairs probabilistic AI reasoning with deterministic, rule-based analysis. Traditional static analysis remains the gatekeeper for decidable issues like hardcoded credentials or null pointer dereferences. Meanwhile, AI agents analyze developer intent, business logic, and architectural boundaries. To prevent autonomous systems from introducing regressions, Gitar's remediation tool is strictly bounded; for instance, it stops attempting to fix a broken build after two follow-up commits rather than endlessly modifying code.

For software engineers, this hybrid workflow shifts daily responsibilities away from tedious triage tasks, such as parsing thousands of continuous integration log lines to find a root cause. Instead, developers will focus on defining system constraints, writing policy guardrails, and making high-level design decisions. By automating mechanical fixes while keeping deterministic quality gates in place, teams can safely accelerate their delivery pipelines without compromising software reliability.