Manish Kapur

The best beginnings are quiet. Hello, 2026. #sunrise

💯 We’ve been saying this at @SonarSource for a while: LLMs can speed up code creation, but they don’t lower the bar for correctness. Software runs on determinism, same input should give the same output every time. LLMs don’t guarantee that, so “probably right” is not enough, especially in automated workflows. The answer is to use deterministic-first and multi-layered review and verification approaches.

In an industry built on determinism, I feel we might be underestimating the work we all will need to do with LLMs exactly because they are nondeterministic. But for so much of automation/workflows, determinism (aka "make sure it doesn't make a mistake") is a baseline expectation

@ScottiePippen It still hallucinates…

AI is just getting better... and better... and better...

@GaryMarcus LLMs change how code is written, not the need for validation. Trust comes from checks, not from the source.

Can you trust the output of LLMs?

@Scobleizer If open models become as good or better than SOTA models, I wonder what happens to the sky high valuations. The giant GPU/cloud deals that underpin these valuations also become less defensible.

Anthropic banning the Claw. Open Source models running locally is the way.

@Grady_Booch Software is easier to generate, not easier to trust. The hard part was never just writing code, it’s making sure it’s reliable, secure, and doesn’t quietly break things at scale.

Marc is profoundly wrong, in every dimension of the word wrong.

@GergelyOrosz That’s a sharp observation, and probably more common than people admit. AI makes it incredibly easy to start a lot of things, which creates a sense of momentum. But starting isn’t the same as finishing.

The more I use AI tools, the more I have to admit that I'm not that much more productive... I simply FEEL that much more productive. In reality, the context switching of kicking several things off wipes out my perceived productivity gains. At least in many/most cases!

We are happy to announce three new open beta products from @SonarSource - Context Augmentation, Agentic Analysis, and Remediation Agent. Together, they are designed to help teams guide AI coding agents with the right context, verify code as it is created, and remediate issues before they slow teams down. Read more: sonarsource.com/blog/the-futur…

Your AI wrote Java 25 code. It compiled. It passed review. It crashed in production. The problem? AI models were trained on preview APIs that no longer exist in the final release. SonarQube from @SonarSource now catches exactly these failure modes. Here's what's going wrong: sonarsource.com/blog/ai-can-wr… #Java #AI

@OfficialLoganK Have you looked at how we are looking at solving this? sonarsource.com/blog/the-futur…

The bottleneck has so quickly moved from code generation to code review that it is actually a bit jarring. None of the current systems / norms are setup for this world yet.

The "LLM for everything" strategy is a high-stakes risk. While the "LLM-everything" workflow looks good on paper, it lacks the critical independent verification needed for production-grade software. Relying on LLMs for writing, testing, review, AND deployment is a single point of failure waiting to happen. LLMs hallucinate; deterministic tools don't. Use AI to accelerate coding, but use tools like SonarQube to verify.

@baby_face_goat True. Sadly, it’s a lost season

Actually no point in Steph returning this season

@BabyFaceDubs Yeah! Starters 😢

TRIGGER WARNING: The Golden State Warriors play basketball tonight. Please don’t watch the game for your mental health to all the fans watching 🙏🏻💔

@warriors Lost season 😢

Halftime

All the starting line up @warriors players today vs the @Timberwolves are bench players. 😮 #nba #warriors #timberwolves

Connect Claude Code to the SonarQube MCP Server for an autonomous code review workflow. Let Claude scan its own work, fetch feedback, and refactor code directly in the terminal until it passes. Learn how: bit.ly/4bC3m7o

Thanks for sharing your observation. SonarQube rules don't conflict with each other. What probably happened is subtler. The agent applied some naive fixes that addressed rule A's error without considering the broader code, and then the fix accidentally violates rule B. And then the agent just kept looping because there was no iteration cap. We will soon update the blog post to explain this condition in more details.

@SonarSource Letting the agent review its own code is a neat loop but you need guardrails on how many iterations it runs. We had an agent stuck in a fix-break-fix cycle for 40 minutes because the SonarQube rules conflicted with each other.

Thoughts on Claude Code Security via @SonarSource, by @kapmani sonarsource.com/blog/thoughts-…

On one end, the Anthropic team is a massive user of AI to write code (80%+ of all code deployed is written by Claude Code). They ship amazingly fast. On the other hand, seeing these beyond terrible reliability numbers suggests there might be a downside to all this speed:

How SonarQube minimizes false positives in code analysis below 5% from @SonarSource, by @kapmani sonarsource.com/blog/how-sonar…