Sonar finds GPT 5.4 generates 1.2 million lines for basic tasks

Prasenjit Sarkar of Sonar recently shared data that should make every engineering lead pause. While foundation model providers boast about high pass rates on functional benchmarks, the reality of the code they produce is often a maintenance nightmare. In a massive evaluation involving 4,444 Java assignments across 53 different models, Sonar revealed a staggering disparity in how AI handles the same requirements.

The most alarming finding involves "code bloat." While GPT-4o solved the assignments with under 250,000 lines of code, GPT 5.4 exploded that footprint to 1.2 million lines for the exact same functional output. This isn't just inefficient; it represents a massive surge in technical debt. More code means more surface area for bugs, higher cognitive load for human reviewers, and increased long-term maintenance costs.

Security flaws and hidden logic errors

Code volume is only half the battle. Claude Sonnet 4.6 recorded the highest security risk in the study, producing 300 vulnerabilities per million lines of code. These issues stem from LLMs being trained on mixed-quality open-source data that contains inherent security flaws and subtle logic errors. Because LLMs are probabilistic, they often prioritize pattern completion over architectural integrity. They lack the context of a company’s specific internal standards or existing codebase, leading to solutions that might work in isolation but fail the standards of enterprise-ready software.

Introducing the ACDC framework for agentic code

To combat this decline in code quality, Sonar proposed the ACDC (Guide, Verify, Solve) framework. This three-stage approach attempts to bring engineering discipline back to AI-driven development.

Guide and Verify

The Guide phase uses context augmentation and Sonar Sweep to ensure LLMs receive high-quality data and full codebase context before they generate a single character. The Verify phase introduces SonarQube Agentic Analysis, which performs real-time checks in just one to five seconds. This allows developers to catch issues before code is even committed, bypassing the lengthy wait times of traditional CI pipelines.

Automated Remediation

When bugs inevitably slip through, the Solve phase utilizes a remediation agent. This tool doesn't just suggest fixes; it creates a branch, applies the fix, and runs it through a local compilation and analysis loop to ensure it doesn't introduce regressions. By enforcing these rigorous gates, teams can adopt AI agents without sacrificing the stability of their production systems.