In the Land of AI Agents, the Verifiers Are King — Tariq Shaukat, Sonar

AI Engineer · 18 min · 188 sentences · from YouTube's caption track

Each timecode opens YouTube at the start of that sentence. Line anchors (#s42) are the cue ids in the WebVTT, and every line carries its start and end seconds. All transcripts has every talk, and the whole corpus as one file.

00:01[music]
00:12Please join me in welcoming the chief executive officer at Sonar, Tariq Sha.
00:34Morning everyone.
00:36Did you enjoy that last talk?
00:37That was amazing.
00:38Um, you particularly love the end the being unreasonable part.
00:42I thought that was awesome.
00:44Um, I also want to just I'm trying to calculate the odds of t following tar as the first two sessions in the morning.
00:51Uh, I think the odds are pretty low on this one, but uh, thrilled to be here today.
00:56Um, as as we just mentioned, I am with Sonar.
00:59We are in the code verification space and I'm here today to talk about verification.
01:04And I think we're all here uh in large part because we believe to some extent that AGI is here.
01:11It's coming.
01:12The models we just heard about Fable.
01:14It's really incredible what is going on in the world today.
01:18And yet we work almost exclusively with enterprises around the world.
01:23And the conversation that we have more is the question mark version.
01:27Is AGI here?
01:28And why are they asking these questions?
01:31It's because you can read the news every day.
01:35And I'm not trying to name and shame here, but if you look at KPMG putting out reports that they have to uh retract because of hallucinations, uh EY doing the same thing, law firms
01:49getting into lots and lots of trouble because of madeup citations, madeup case law, things like this.
01:56I think we can really start to question how do we get value out of AI?
02:01The models are amazing as we just heard, but the hard part as the other target just said is getting value out of it.
02:09The struggle is that AI slop is everywhere.
02:14I'm sure you all see this inside of your organizations.
02:16I'm sure you see this in your everyday life.
02:20That AI is amazing.
02:21The models are incredible at generating very plausible output.
02:25They're incredible at generating things that sound correct.
02:29But are they correct?
02:30And how do you know that they're correct is a big problem.
02:33And it's a big problem in professional services as we saw.
02:36It's a big problem in legal.
02:38But really, I think if we're honest, it's it's a big problem in every sector, in every field, whether it's marketing or finance or you name it.
02:46You have this question of how do you actually know if it's true?
02:50How do you know if it's good or if it is slop?
02:53And the question that we we deal in the coding space in particular, we deal with software development.
02:59And the question we get as we talk to I'm sure many of the people here in the room and a lot of our customers is, isn't software development different?
03:09And we can look at the data on this and uh the mythos models.
03:15Um this is data from um meter.
03:18Uh you may have seen this mer.
03:20Um the coding agents are getting better uh very quickly.
03:23They're getting a lot better very quickly.
03:25And you can see uh the progression, the exponential curve here.
03:28What this shows on this chart is how capable are the models at completing tasks that humans would take.
03:36So can they complete a task that takes 1 hour, 2 hours, whatever it is.
03:40the latest Mythos model, at least per the benchmarking which was done a month or so ago in the preview mode was you're getting to 16 to 18 hours.
03:49So they're actually able the agents are able to complete longunning tasks and it really is starting to transform how work is happening.
03:59But the critical caveat when you read the data is this is at a 50% success rate.
04:05Okay.
04:05So it is again able to complete tasks but is it able to complete tasks correctly is the question.
04:13So if you start looking at let's dial up the accuracy rate you dial it up to 80%.
04:19And there's still progress but it is much slower progress.
04:22Instead of 18 hours you're at about 3 and a half hours or something along these lines.
04:27And by the way this is still at 80% accuracy.
04:31And as I was presenting this to the CTO of one of my uh large customers, his response was, "Butic, I would still put someone who gave me 80% accurate information
04:41on a performance review probably, right?
04:43This isn't necessarily enterprise grade.
04:46The problem is that the models themselves, and full disclosure, we have not yet uh done this benchmarking on the Fable models obviously because they are just being released.
04:59But as you look at the models, the models are getting smarter, but they still produce a lot of problem problematic code.
05:07This is benchmarking that we do.
05:08We give the models a series of over 4,000 problems and we basically ask it to generate the response to the problems and then we analyze both the functional correctness
05:20which is critical and they all do extremely well on this notion of functional correctness, right?
05:25Um, but then we look at how complex is the code, how buggy is the code, how secure is the code.
05:32And what you see with even the state-of-the-art models is that complexity is still high.
05:37It's actually quite variable as you can see here.
05:40Um, GPT55 has done particularly well on the complexity side of things.
05:44It still generates bugs.
05:46It doesn't generate massive amounts of bugs, but it still generates bugs and it still generates security issues.
05:53So this is the output of the models that are going into the agentic workflows.
05:59And again, this is not, you know, I'm at the AI engineer conference.
06:02This is not me saying AI is fake or or um incorrect, but it is um trying to address this question of how do you really get value in a production setting out of AI?
06:17This is a study that was done in Carnegie Melon uh University and it looked at what is the actual productivity benefit that you see from the use of AI
06:28coding agents.
06:30And what you see I think really resonates with a lot of what I see firsthand in the market which is you have a initial just amazing boost of productivity of velocity in particular.
06:44what you see is a three to 5x boost in productivity or in in velocity.
06:48Um that dissipates in three months.
06:51At the end of three months, it starts to come back to the the normal before you were using the agents.
06:57And if you ask why, it is because of the two pieces in red here that you start to see there's an increase in velocity, but there's an increase in security issues,
07:08there's an increase in maintainability issues, there's an increase in reliability issues, and there's an increase in complexity.
07:15So essentially, you're building the technical debt as quickly as you are generating the code or maybe even more quickly.
07:22And that creates a different set of work.
07:25it creates a different bottleneck.
07:28And so to us, this is now the critical question in AI, which is in a world in which code is provable.
07:37And there's sessions that um I'm actually very much looking forward to attending about formal methods and proofs and things like this, code is provable, but when you start dealing with large code bases, software is not.
07:49It's still very complex.
07:51It is still very messy.
07:52there's lots of um dependencies.
07:54There's lots of uh technical debt already in most code bases.
07:59And so this question of verification is actually key.
08:03And what I'm going to be arguing is that you can treat verification as an afterthought or you can bake verification into the process.
08:12And if you bake it into the process of generating code, of doing software development, you can actually start to get materially better outcomes from the coding agents than if you view it as an afterthought.
08:24If you view it as just the old school code review.
08:28So as we've been thinking through this, we basically have constructed a framework and there's lots of competing frameworks around this, but I'll just talk you through uh ours.
08:36We call it the agent centric development cycle.
08:39for shortand we call it AC/DC sometimes and the idea here is how do you get verification powered to Gentic loops at the center there's a lot of focus on
08:50the code generation piece like how do you actually get the models and the agents to generate the code that you need to solve the problem and what we argue is that
09:00you should surround this with the right disciplines the right tools the right processes to do three things to guide the agents and t is talking a lot about different aspects of this actually.
09:12Guide the agents, verify the outcomes and then solve the problems.
09:16And you have to make this part of the discipline, part of the process, part of the new software development life cycle if you want to be successful in the AI world.
09:27So if I double click on some of these pieces, what do we mean by guide?
09:31We've done a lot of experimenting around guide.
09:34We've just launched a product um yesterday I think called sonar vortex that starts to get into this area.
09:40What we find is critically important is to think about guide as context and constraints and we separate out context and constraints very deliberately because context is you have your code repositories.
09:53How do we make it easier for the agents to understand for the models to understand what is in your codebase?
10:00If you have a million lines of code, if you have a hundred million lines of code, you have a billion lines of code, the agents work better if they understand your codebase.
10:08So, how do you give it architectural awareness?
10:10How do you provide uh semantic navigation uh maps um and uh and help them understand the territory to borrow what Tar was just talking about and we find it equally valuable and I don't think this part is talked enough about to provide
10:25the constraints as well.
10:27You have guidelines that you want your code to follow.
10:31You have dependencies you are okay using.
10:35You have dependencies that you are not okay having.
10:38You have coding standards.
10:39You have guardrails.
10:40You have intended architecture.
10:41We spend a lot of time talking about existing architecture.
10:44But what about where you want to go?
10:46And so this idea of context and constraints uh we've found in our testing generates a massive improvement in agent effectiveness and a massive uh improvement in token consumption o over 30% reduction
11:02in tokens being used to solve a given problem.
11:06And and if you ask why it's because you're actually making the life of the agent easier.
11:10You're helping it navigate better.
11:13So then we get into the heart of this and we really think of guide as preemptive verification.
11:18How do you make sure there's less to verify, less to fix, this sort of thing.
11:21Then you get to the heart of verification and what we believe quite strongly and what we've seen work in practice is this idea of zero trust multi-layered verification.
11:33Zero trust.
11:34Every model has biases.
11:36Every model produces has a character has a personality.
11:39So, let's make sure we use different models and different techniques to make sure your code is safe, to make sure it's reliable, to make sure it's secure.
11:46And multi-layered really speaks to the earlier point that software is complex.
11:53Software is very messy.
11:54Software has lots of of of intricacies involved with it.
11:59And so what we believe and again have found to be quite um impactful here is that a combination of algorithmic verification looking at things like data flows, control flows, known patterns, secrets,
12:13these areas combined with what is now possible with agentic verification looking at intent, business logic, the unknown unknowns.
12:22Actually again to borrow from the last uh presentation the fusion of these things the the deliberate multi-layered fabric that you put in place can actually you can see the results of this in production.
12:36So as we look at our partners and customers who use a multi-layered verification approach they are reporting AI derived production outages being 44% less frequent than the ones who do not.
12:51So you can start seeing a material improvement in reliability, in security and in maintainability.
12:58And then the last point I mentioned is technical debt does explode.
13:03Right?
13:03As you generate code, technical debt is also generated.
13:07And again, this is not stop doing it.
13:10This is be aware and let's start controlling it.
13:14And so what we um have seen be super effective is to have an active process to have an active discipline again around code maintenance and thinking about how you do verified
13:28code maintenance.
13:29Um I won't walk through every step of this but a the agents whether that is a set of remediation agents whether it's a strong discipline around verification does keep your codebase clean
13:42and a lot of people have asked me all right but do agents care about clean code human developers care about clean code do agents care about clean code and what we find again is they absolutely do because the agents have to
13:56understand the codebase if they're going to operate on it so this is a oneshot view.
14:00Um, we think this is something that compounds.
14:03But if you just do the exact same agentic tasks on a typical codebase and then one that has been cleaned, you see a material reduction in the amount of tokens,
14:13reasoning, energy, etc. needed for those cleaner uh code bases versus the typical code bases.
14:21Right?
14:21If you make the life of the of the agent easier, if you maintain your codebase, then you'll actually see compounding effects.
14:29Now, the important thing in our mind is to construct the system.
14:33This is how I started is saying, you know, I'm sure all of us do code reviews, you may use static analysis tools, you may use AI code uh review tools, a whole range of things.
14:43And we believe that you have to put this in a system.
14:46And again, uh, we're happy to in our booth downstairs talk through what this looks like, but we really believe that the construction of the software development life cycle in an AI world
14:58um, needs to embed this notion of guide, verify, and solve inside of it.
15:03And you need to do it in three loops.
15:05And you need to think about these three loops.
15:07There's the agentic loop, which I think is the key buzzword of the conference.
15:11Um now but how do you provide the agents as it's generating the code as it's doing the work with the context and constraints with the inloop verification so that the agent is getting verification
15:23as it's working and how do you fix problems that's that's the blue loop here what we what we talk about is the inner loop verification piece.
15:32There's a second which is your continuous improvement process and how do you really combine the power of algorithmic and agentic to generate your your pull request review the code and by the way the velocity of this has to go up massively so to review the code using agents and to do this multi-layered verification
15:54and then you have your evals and I think the opening speaker talked about how eval may be the buzzword of the um conference you have your EV valves and you have your quality gates to check are you actually passing.
16:06So you have your your code maintenance loop, agentic loop, CI verification loop and deliberate design of these loops with verification at the center is a compounding system.
16:20It's a system that reinforces itself and it reinforces itself in the positive and it reinforces itself in the negative.
16:27And we've seen customers who uh have kind of neglected as they've rolled out AI coding tools, they've neglected verification, they've neglected this idea of code quality, of code um maintenance,
16:41things like that, and you get into a downward spiral pretty quickly.
16:44This is what the Carnegie Melon uh case study uh or study actually shows is that you actually have all the benefits start to dissipate or you can get into the self-reinforcing
16:55loop.
16:56And one of the tests we did with one of the large banks who are using some of the cutting edge the folks who are all around here today um cutting edge agentic
17:05coding tools they can get a 92% reduction in issues if you actually take this guide verify solve approach inside of those agentic loops.
17:15If again this compounds it's not that each loop is 92% better.
17:20that as you go through solving the problem over minutes and hours that you actually see a compounding benefits.
17:29So that is uh essentially how we see the benefit here.
17:34The how we see the controlled um value creating use of AI in enterprise settings and when I say enterprises people with existing code bases people with with you know millions of lines of code already.
17:49There's the agentic loop, there's a CI verification loop, there's the code maintenance loop.
17:55I'm required by my marketing team to put up a version of this that has our products on here.
17:59So these are our products and you can come and see us later.
18:02But the most important thing is really to say our recommendation is this agent the AC/DC agentcentric development cycle.
18:10The core part is deliberate verification built into the system.
18:15So if you'd like to learn more um we have a booth.
18:17It's the big red booth downstairs.
18:19We'd love to talk more.
18:20We have some doubleclick sessions coming up.
18:23So, please do uh join those and uh have a great conference.
18:26Thank you all.
18:51[music]