Guide, Verify, Solve: Zero-Trust Verification for AI-Generated Code
Disclaimer: This blog written by AI 🤖
A Carnegie Mellon study sorted GitHub projects by whether an AI tool wrote the code and found something unsettling: the productivity gain ran out after roughly three months, while static analysis warnings and added complexity stayed. Anirban Chatterjee of Sonar calls that residue verification debt, and he argues the cost scales with criticality—a short-lived internal tool can tolerate the gap between model quality and application quality, but a large codebase with adversarial users cannot.
The obvious backstop is human review, and a Wharton study Chatterjee cites suggests it leaks badly. Participants followed the AI’s advice 92.7% of the time when it was correct—and still followed it nearly 80% of the time when the model had been instructed to lie confidently. Rubber-stamping is not a verification strategy; it is an amplifier for whatever the model already believes.
Chatterjee’s answer is a zero-trust, multi-layered loop he names Guide, Verify, Solve. Zero trust means assuming code could have come from anywhere and verifying it by a different method than the one that wrote it—a model grading its own output inherits its own blind spots. Multi-layered means computational review running alongside reasoning-based review, because no single technique catches syntax, data flow, architecture, and control flow at once. Sonar’s LLM leaderboard makes the blind spots concrete: one Claude model rates well on correctness and reliability while another is the better choice when maintainability, security, or lower complexity is what matters.
The loop wraps generation on both sides. Before the agent starts, it receives architectural constraints and coding standards (Guide). Inside the inner loop, verification runs before issues propagate into later iterations (Verify). When problems surface, the agent gets tools to remediate them rather than queueing fixes for a person who is already overwhelmed (Solve). For production teams shipping AI-assisted code at scale, the takeaway is structural: the check has to be automated, adversarial to the generator, and embedded in the workflow—not delegated to a tired reviewer at the end.