Can LLMs generate Enterprise Quality Code? — Prasenjit Sarkar, Sonar

Key Concepts

• Agentic Coding: A shift from manual IDE-based development to using AI agents that generate code based on natural language instructions.
• Functional Correctness: The ability of an LLM to pass standard test cases (e.g., HumanEval, SWE-bench).
• Cyclomatic Complexity: A metric measuring the number of linearly independent paths through a program's source code (branching logic).
• Cognitive Complexity: A proprietary Sonar metric measuring how difficult code is for a human to read, understand, and maintain.
• ACDC Framework: Sonar’s "Agent-Centric Development Cycle" consisting of Guide, Verify, and Solve phases.
• MCP (Model Context Protocol): A standard used to connect AI agents to external tools and data sources.

---

1. The State of AI-Generated Code

Prasanjit Sarkar highlights a paradigm shift in software development where "English is the new programming language." While 55% of developers now regularly use AI agents (e.g., Cursor, Wind Surf, Devin), there is a significant gap between functional correctness and enterprise readiness.

• The Trust Gap: While LLMs boast high pass rates (80%+) on benchmarks like SWE-bench, they often fail in real-world engineering requirements: security, maintainability, and architectural integrity.
• The "Bloat" Problem: Newer models are increasingly verbose. For a set of 4,444 Java assignments, models like GPT-5.4 generated 1.2 million lines of code, compared to <250,000 lines from older models. This excessive code generation increases technical debt.
• Inherent Risks:
  • Mixed Quality Training Data: Models ingest both high-quality and insecure code from open-source repositories.
  • Probabilistic Nature: The same prompt yields different results, making code non-deterministic and difficult to audit.
  • Lack of Context: Models lack awareness of specific company architectures and internal standards.

2. Evaluation Findings

Sonar evaluated 53+ models using 4,444 Java programming assignments. Key findings include:

• Gemini 3.1 Pro High: Currently leads in functional correctness (84.17%) with relatively manageable complexity.
• Claude Sonnet 4.6: Identified as having higher security risks, with approximately 300 security issues per million lines of code.
• Evolution of Bugs: While total vulnerabilities are decreasing as models mature, the remaining bugs are becoming more subtle and harder for humans to detect.

3. The ACDC Framework (Agent-Centric Development Cycle)

To bridge the gap between AI-generated code and enterprise standards, Sonar introduced the ACDC framework:

Phase 1: Guide

• Sonar Context Augmentation: Injects the company’s existing codebase context into the LLM to ensure generated code aligns with internal architecture.
• Sonar Sweep: Cleans the data used to train or prompt the model to prevent the generation of insecure patterns.

Phase 2: Verify

• Agentic Analysis: A tool that integrates with AI agents (via MCP) to analyze code in 1–5 seconds before a commit is made. This allows the agent to self-correct before the code reaches the CI/CD pipeline.

Phase 3: Solve

• Remediation Agent: If issues slip into a Pull Request (PR), this agent automatically generates fixes.
• Regression Prevention: The agent runs the fix through compilation and analysis again; if the fix introduces new regressions, it is discarded, ensuring only safe code is proposed.

4. Notable Quotes

• "English is now the new programming language."
• "The models which are getting matured enough day by day... are creating some more finer bugs that is very, very hard for a human being to detect."
• "We are not going to give you the code which is going to create a regression. We don't do that."

5. Synthesis and Conclusion

The transition to agentic coding is inevitable, but current LLMs are not inherently "enterprise-ready." They suffer from verbosity, security vulnerabilities, and high cognitive complexity. Sonar’s approach suggests that the solution is not to abandon AI, but to wrap it in a rigorous Verify and Solve loop. By implementing automated, real-time analysis (ACDC framework) that acts as a guardrail for AI agents, organizations can leverage the speed of LLMs while maintaining the security and maintainability standards required for professional software engineering.