CMU研究：AI编程助手短期提效但长期降低代码质量

CMU's new study is an eye-opener for coding agent users.

They tracked 807 GitHub repos that adopted Cursor.

Each was matched against a similar repo that did not, so the difference reflects the agent, not the project.

In the first month after adoption, the agent-assisted repos showed more productivity, adding 3 to 5x more code. That gain was real but short-lived, and it faded within two months.

What did not fade was the hit to code quality.

Static analysis warnings rose around 30% and code complexity around 41%, and both stayed elevated for the rest of the study.

The obvious objection is that this is a skill problem, fixable with sharper prompts and review.

But even after controlling for how much code was added, complexity still climbed faster in the agent-assisted repos than in the controls. The agent adds to the problem, not just the developer using it.

The instinct is to have the agent review the code it just wrote, or add a second agent to check it.

That does not work as well as expected because the model that wrote the code carries the same blind spots that produced the defects.

A second model trained on similar data shares most of them, so an AI reviewer misses what the AI author missed.

Catching this reliably needs deterministic verification, structured, repeatable analysis, instead of another probabilistic guess.

SonarQube actually implements this as a plugin inside Claude Code, and they partnered with me on this post.

It runs SonarQube Agentic Analysis in the session, all while flagging for issues, complexity, and exposed secrets after every edit across the project.

For instance, in the video below, I typed a prompt with a GitHub token in it, and SonarQube blocked it before it reached Claude. The token never entered the context window. I worked with the Sonar team to put this together for you.

To get started in Claude Code, run /plugin, find sonarqube, install it, reload, then run /sonarqube:integrate.

You can read the CMU study on arxiv here: https://fandf.co/4vVbJCz.

Deterministic analysis in the loop is one half of working this way. The other half is how the code gets written in the first place, breaking work into plan-execute-verify cycles so the agent stays on a short leash.

My co-founder wrote a full playbook on that, including why the last 20% is where agents quietly add the most complexity.

Read it below.