The verification gap

Published by Populosoft · Sources last checked 13 November 2026 · Every figure links to its source at the end

1. AI writes the code now

In October 2024, Sundar Pichai told investors that “more than a quarter of all new code at Google is generated by AI, then reviewed and accepted by engineers.”[1] Eighteen months later he gave a new number.

“Today, 75% of all new code at Google is now AI-generated and approved by engineers, up from 50% last fall.” Sundar Pichai, CEO of Google and Alphabet, April 2026[2]

Google is not an outlier. In Stack Overflow's 2025 survey, 84% of developers said they use or plan to use AI tools.[3] In Sonar's 2026 survey of more than 1,100 developers, AI accounts for 42% of all committed code.[4]

Whatever the exact share is at your company, the direction is not in doubt. What this means for quality: when a machine can write the code in minutes, writing it is no longer the critical step. Every team now has that speed, so it sets nobody apart. The step that decides whether a product succeeds comes afterwards: establishing that the code does what the business needs.

2. Output went up. Verification did not.

Faros AI analyzed telemetry from more than 10,000 developers across 1,255 teams. Developers on teams with high AI adoption complete 21% more tasks and merge 98% more pull requests. Their pull request review time increases 91%. At company level, Faros found “no significant correlation between AI adoption and improvements.”[5]

Google's own DORA research program, which surveyed nearly 5,000 technology professionals in 2025, reached a similar conclusion from a different direction:

“AI doesn't fix a team; it amplifies what's already there.” Nathen Harvey and Derek DeBellis, announcing the 2025 DORA report[6]

DORA found that AI adoption now goes with higher delivery throughput, but that it “does continue to have a negative relationship with software delivery stability.”[6] Teams ship more, and their delivery gets less stable.

What this means for quality: the extra code is real, but it only turns into a better product if someone checks it. Checking has become the slow, expensive step, so it is the one that gets skipped. Developers know this. They just do not have the time to act on it.

• 96%

  of developers do not fully trust that AI-generated code is functionally correct. Only 48% always check it before committing.

  Half of developers do not always check it.

  Sonar, 2026 [4]

• 66%

  name “AI solutions that are almost right, but not quite” as their biggest frustration with AI tools.

  “Almost right” is exactly where bugs hide.

  Stack Overflow, 2025 [3]

• 63%

  of organizations ship code changes without fully testing them.

  So users find the defects first.

  Tricentis, 2025 [7]

Sonar's press release borrows a name for the result from Werner Vogels, the CTO of Amazon: “verification debt.”[4]

The effect shows up in the code. CodeRabbit compared 470 open-source pull requests and found that the AI-co-authored ones contained about 1.7 times as many issues as the human-only ones: 10.83 per pull request against 6.45.[8] It also shows up in production. In 2025 a scan of 1,645 apps built with the AI app builder Lovable found 170 of them, about one in ten, with database endpoints that lacked adequate access rules.[9]

This is the verification gap: the distance between how fast software can now be written and how fast anyone can establish that it works.

3. The good news: AI is the best bug-finder we have had

The technology that opened the gap is unusually good at closing it.

• DARPA's AI Cyber Challenge, August 2025. Across 63 challenges, the competing autonomous systems found 54 planted vulnerabilities and patched 43 of them. They also found 18 real vulnerabilities nobody had planted, at an average cost of about $152 per task.[10]
• Anthropic, February 2026. Using Claude Opus 4.6, its researchers “found and validated more than 500 high-severity vulnerabilities” in open-source software.[11] Working with Mozilla, the same model found 22 vulnerabilities in Firefox in two weeks, 14 of which Mozilla rated high severity.[12]
• curl, October 2025. Daniel Stenberg, who has maintained curl for more than 25 years, merged about 50 bug fixes from a list produced with AI-powered analysis tools. His verdict: “The quality of the reports make it feel like a new generation of issue identification.”[13]

Most of this evidence is about security flaws in source code, because that is where results are easiest to measure. Our daily work is the less glamorous kind of defect, such as a sign-up form that fails on mobile or a checkout that breaks after a deploy. The method carries over: an agent can explore and test far more of a product, far more often, than a person can.

What this means for quality: the volume problem that AI created can only be met by AI. People alone cannot check code that machines write at this rate. Agents can.

4. The catch: unverified AI findings are noise

A few months after praising those AI-assisted reports, the same maintainer shut down curl's bug bounty program. The reason was a flood of AI-generated reports that nobody had checked.

“Starting 2025, the confirmed-rate plummeted to below 5%. Not even one in twenty was real.” Daniel Stenberg, “The end of the curl bug-bounty”, January 2026[14]

Same project, same kind of tool, a few months apart. In one case an expert stood between the AI's output and the people who had to act on it, and the result was 50 fixes. In the other nobody did, and the result was a program closed down.

Stenberg is careful not to oversell it. Of the new analyzers he also wrote: “I don't consider this new tooling a revolution.”[13] We agree. The tool is not the point. The accountability is.

What this means for quality: AI output that nobody has verified is worth less than nothing, because someone still has to sort it. The value is created at the moment an accountable person confirms what is real.

5. What the people closest to this say

The engineers who have thought hardest about working with AI keep arriving at the same place.

“Your job is to deliver code you have proven to work.” Simon Willison, co-creator of Django, December 2025[15]

“A computer can never be held accountable. That's your job as the human in the loop.” Simon Willison, in the same post[15]

Andrej Karpathy coined “vibe coding” in February 2025 for a style where you “forget that the code even exists”, and noted in the same post that it is “not too bad for throwaway weekend projects.”[16] Kent Beck, who created Extreme Programming and popularized test-driven development, drew the line for everything else:

“In vibe coding you don't care about the code, just the behavior of the system. In augmented coding you care about the code, its complexity, the tests, & their coverage.” Kent Beck, June 2025[17]

Beck's list of warning signs that an AI agent is going off track includes “any indication that the genie was cheating, for example by disabling or deleting tests.”[17] An agent that grades its own work is not verification.

Good tests are not only a safety net. They are what lets AI tools go fast in the first place. Willison again: “If your project has a robust, comprehensive and stable test suite agentic coding tools can fly with it.”[18]

6. What this means if you ship software

Three things follow from the evidence, and together they are our whole service.

• Verification has to scale with generation. If AI writes the code, people alone cannot check it all. Agents have to do the volume: exploring the product, writing tests and running them every day.
• Someone accountable has to stand between the agents and your team. A QA engineer who decides what is real, so that what reaches your developers is a short list of true defects and not a flood.
• It has to be continuous. When code changes daily, a test pass before launch is out of date within a week.

The teams that win with AI will not be the ones that generate the most code. They will be the ones that know, every day, that what they shipped still works.

See how we work

See how we work

Or scan your site free →

Sources

1. Sundar Pichai, Q3 2024 earnings call: CEO's remarks, Google, 29 October 2024.
2. Sundar Pichai, Google Cloud Next '26 remarks, Google, 22 April 2026. Self-reported; Google does not publish how the share is measured.
3. Stack Overflow, 2025 Developer Survey: AI.
4. Sonar, State of Code Developer Survey press release, 8 January 2026. Vendor survey of more than 1,100 developers; the share of AI code is self-reported.
5. Faros AI, The AI Productivity Paradox Report 2025, 23 July 2025. Vendor research.
6. Nathen Harvey and Derek DeBellis, Announcing the 2025 DORA Report, Google Cloud, 23 September 2025. Survey research; the relationships are correlations.
7. Tricentis, 2025 Quality Transformation Report press release, 13 May 2025. Vendor survey.
8. CodeRabbit, State of AI vs Human Code Generation Report, 17 December 2025. Vendor research on 470 pull requests.
9. Matt Palmer, Statement on CVE-2025-48757, 29 May 2025.
10. DARPA, AI Cyber Challenge results, 8 August 2025.
11. Anthropic, research post on finding vulnerabilities with Claude Opus 4.6, 5 February 2026. Findings were validated by human researchers before reporting.
12. Anthropic, Mozilla Firefox security collaboration, 6 March 2026.
13. Daniel Stenberg, A new breed of analyzers, 10 October 2025.
14. Daniel Stenberg, The end of the curl bug-bounty, 26 January 2026.
15. Simon Willison, Your job is to deliver code you have proven to work, 18 December 2025.
16. Andrej Karpathy, post on X, 2 February 2025.
17. Kent Beck, Augmented Coding: Beyond the Vibes, 25 June 2025.
18. Simon Willison, Vibe engineering, 7 October 2025.
19. METR, update on its developer productivity study, 24 February 2026.
20. Edsger W. Dijkstra, Notes on Structured Programming (EWD249), 1970.