LLM Hallucinations in Production Code

▶ Watch (05:03)

Hallucinations in code aren’t rare edge cases. They produce SQL injection vulnerabilities, off-by-one logic bugs, and references to libraries that don’t exist. Cursor generates roughly one billion lines of code per day, and LLMs hallucinate throughout. That volume makes code review harder to skip. When hallucinated code fails, the consequences are production outages, security breaches, and maintenance work spent tracing calls to non-existent APIs.

“of AI-generated code is not optional, it’s essential.” — Manish Kapur

Who Owns the Bug?

▶ Watch (08:19)

When AI-generated code causes an incident, the liability question doesn’t resolve itself. Kapur called it an accountability crisis: the developer who accepted the suggestion, the LLM vendor, and the organization that deployed the code all have a claim, but regulators will find the last of those most convenient. In regulated industries, that isn’t abstract. The development team ships the binary. Whatever the source of the code, they own what runs in production.

“This question isn’t just philosophical.” — Manish Kapur

AI Code Assurance: Auto-Detection and Quality Gates

▶ Watch (11:02)

SonarQube’s AI Code Assurance layer addresses verification in two steps. First, it auto-detects code written by GitHub Copilot and similar assistants, then routes that code through a stricter quality gate called Sonar Way for AI Code Quality Gate. That gate checks for security vulnerabilities, bugs, code smells, and test coverage. Code that passes earns a badge, displayed in the repository or documentation, giving compliance officers and engineering managers a verifiable signal rather than a developer’s word.

AI CodeFix and the Full SDLC Pipeline

▶ Watch (13:31)

AI CodeFix sits at the end of the SonarQube pipeline. When branch or pull request analysis flags a bug or vulnerability, CodeFix generates a context-aware fix. Not a generic patch, one that reads the surrounding codebase. Developers apply it in one click. Organizations choose which LLM backs the suggestions, letting them match performance, privacy, and compliance requirements. The same logic runs both in the IDE, catching issues in real time, and in SonarQube Server or Cloud for full project sweeps.

“but we need a trust-but-verify approach when adopting AI” — Manish Kapur

Notable Quotes

of AI-generated code is not optional, it’s essential. Manish Kapur · ▶ 7:33

This question isn’t just philosophical. Manish Kapur · ▶ 8:37

but we need a trust-but-verify approach when adopting AI Manish Kapur · ▶ 16:58

Key Takeaways

  • LLM hallucinations produce SQL injection, phantom APIs, and logic bugs in AI-generated code without warning.
  • SonarQube AI Code Assurance auto-detects Copilot output and applies a stricter quality gate before merge.
  • AI CodeFix patches discovered issues in one click, using the LLM the organization already trusts.