Karpathy：Agent 写代码混乱，Sonar 推验证方案

Karpathy said something that feels wrong at first:

He said he has stopped fighting how messy agent-written code gets.

His AGENTS[.]md rules told agents to keep every line doing one thing, using intermediate variables instead of stacking calls together.

The agents kept doing it anyway, chaining functions and indexing results inline, no matter how many times he wrote the rule down.

Clearer instructions didn't solve this for Karpathy, which means the fix will lie somewhere outside prompting.

When a human opens a PR, the reviewer assumes the author understood the codebase.

An agent doesn't carry that.

It writes code that compiles and clears the obvious checks, and that's enough to land a commit.

Whatever's actually wrong with it surfaces in CI later, by which point you're already building on top of it.

Catching this before it compounds needs verification running where the code gets written, not a separate check that runs after.

Sonar Vortex code analysis engine already does this inside an agent's own session, applying the same quality and security checks your pipeline runs, regardless of how the code got written.

Gitar is Sonar's AI-native PR review layer for the pull request itself, and the team worked with me on this post to show how it works.

It reads the change with context on your codebase and conventions, not just the diff, catching functional and logic bugs a syntax-level scan wouldn't name.

When it finds something, it writes a patch, runs it against your CI, and doesn't call the job done until the build passes.

Sonar calls the full loop Agent Centric Development Cycle (AC/DC).

It covers guiding the agent, verifying what it produces, and fixing what's wrong when it isn't.

Gitar closes that loop without a human acting on a comment first.

Teams running this combination are 44% less likely to see outages tied to AI-generated code.

With Sonar Vortex, token usage drops too, by roughly 8% with up to 36%, since agents spend less time reasoning and re-parsing a codebase that isn't piling up the kind of mess Karpathy described.

The PR used to be where mistakes got caught.

Now it's where they get fixed before anyone has to read them.

Start with AI-native code validation with Sonar: https://fandf.co/4gyUIJA.

Verification at the point code gets written is one-half of working this way. The other half is the loop behind it, why an agent can't be the one to decide it's done.

My co-founder wrote a full breakdown on that, including the maker/checker split that makes "done" provable instead of claimed.

Read it below.