1. Executive summary: why model price alone is the wrong cost metric
Most conversations about AI coding ROI start with the price per million tokens. That number is easy to compare, and it keeps falling. The Stanford AI Index found that the cost of running a model at GPT-3.5 level dropped more than 280x between November 2022 and October 2024.
Yet AI budgets in engineering keep rising. Coding agents do not answer a single prompt. They read files, call tools, run tests, fail, retry, and re-read. A study of eight frontier models on SWE-bench Verified found that agentic coding tasks use about 1,000x more tokens than code chat, that input tokens drive most of the cost, and that two runs of the same task can differ by up to 30x in total tokens (Bai et al., 2026).
Tokens are also only the visible part of the bill. The larger costs come after generation: review, CI cycles, rework, escaped defects, and code that gets harder to change. Faros AI telemetry across 1,255 teams showed that teams with high AI adoption merged 98% more pull requests, while PR review time rose 91% (Faros AI, 2025).
For CTOs and engineering leaders, three points follow:
- Measure cost per accepted change, not cost per token. An accepted change passes your quality gates, gets merged, and stays in production without being reverted or rewritten.
- The biggest savings come from fewer retries and less rework, not cheaper models. In the example below, halving the model price saves about 3% of cost per accepted change. Better codebase context and earlier verification save about 47%.
- Verification is an economic control. Every issue caught inside the agent’s loop is one that does not cost a CI run, a reviewer’s hour, or an incident.
2. The hidden cost stack: context retrieval, generation, retries, reviews, defects, and maintenance
Context retrieval is the largest token line. Most agent tokens go into reading code, not writing it. As Sonar's research team put it, what drives the cost “isn’t how much the agent writes, it’s how much code the agent has to look at in order to write it” (Sonar, 2026). A useful rule of thumb: agent cost is roughly the number of turns multiplied by the context carried on each turn.
Retries cost more than successes. One independent analysis of mini-SWE-agent runs on SWE-bench Verified found that unresolved attempts cost about 1.5x as much as resolved ones (swe-bench-token-waste). Bai et al. also found that more tokens do not buy more accuracy: on the same task, accuracy often peaks at moderate spend, then flattens.
Review is now the bottleneck. Sonar’s 2026 State of Code Developer Survey of more than 1,100 developers found that AI accounts for 42% of committed code. Yet 96% of developers do not fully trust that AI-generated code is functionally correct, only 48% always check it before committing, and 38% say reviewing AI code takes more effort than reviewing a colleague’s (Sonar, 2026). Faros AI’s 2026 report, covering about 22,000 developers, reported median review time up roughly fivefold, incidents per pull request more than tripled, and bugs per developer up 54% as AI adoption grew (Faros AI, 2026).
Defects and maintenance compound. GitClear’s analysis of 211 million changed lines found code churn rose from 3.1% in 2020 to 5.7% in 2024, while moved lines, its proxy for refactoring, fell from 25% of changed lines in 2021 to under 10% in 2024 (GitClear, 2025). Veracode found that across 100+ models and 80 coding tasks, AI chose the insecure coding option 45% of the time (Veracode, 2025). A Carnegie Mellon study of open source projects adopting Cursor found a large but temporary jump in development speed, with lasting increases in static analysis warnings and code complexity that drove a later slowdown (He et al., 2025).
None of this appears on the token invoice. All of it is part of the real cost.
3. A measurement framework for AI coding ROI
What metrics matter for agentic development governance? One outcome metric, explained by a small set of driver metrics.
Cost per accepted change = (tokens across all attempts + CI compute + review time + rework time + cost of escaped defects) ÷ accepted changes
Failed attempts count in the numerator but not the denominator, so retries show up as cost. Rework and defects are included, so fast but wrong code does not look cheap.
A worked example (illustrative)
These inputs are assumptions chosen for clarity, not customer data. Assume $4 in tokens per agent attempt, $100 per loaded engineering hour, one hour per rework, and $800 per escaped defect.
Tokens are under 10% of the total in both workflows. Halving the model price in Workflow A saves $3.60, about 3%. Moving from A to B saves about $50 per accepted change, about 47%. At 1,000 accepted changes a month, that is roughly $50,000, most of it engineering time.
4. How codebase context changes token consumption and first-pass quality
If most tokens go to reading code, token optimization starts with making agents read less and find the right code sooner. Two factors control this: the health of the codebase, and the context the agent receives.
Codebase health is a cost lever. Sonar built six pairs of repositories that shipped the same application and passed the same tests but differed in structure: function size, naming, nesting, and the issues SonarQube flags. The team ran 27 tasks 10 times on each side with Claude Code and Sonnet 4.6, about 540 runs (Sonar, 2026; arXiv). On the healthier side, agents used 7.2% fewer input tokens and 8.5% fewer output tokens, re-read files they had already edited about 34% less often, and showed no meaningful change in task completion. The pass rate did not change; the work needed to reach it did. Results varied by task, from 40% input-token savings to slightly higher cost on a few.
Targeted context cuts wasted reads. Without precise context, agents explore by reading whole files, and every wrong read stays in the context window for the rest of the session. Sonar tested semantic code navigation in Sonar Vortex across six refactoring tasks, ten runs each (Sonar, 2026). Median input tokens fell 11% to 31%. Mean cost per run fell by up to 36% on the clearest navigation-heavy task and 20% on two others. Where navigation was not the constraint, median cost stayed within a few percent of baseline. Context helps most where agents waste the most effort finding code.
Context also improves first-pass quality. Without it, agents often write code that is functionally correct but contextually wrong: it compiles and passes tests, but ignores your architecture, duplicates an existing helper, or breaks a team convention. That code clears the agent’s own checks and fails later, in review or in maintenance, where it costs the most to fix. When an agent knows the project’s rules and architecture before it writes, and checks its work as it goes, fewer changes fail later. In Sonar’s testing with a leading coding agent, Sonar Vortex reduced issues produced by 92%. Fewer issues at generation means fewer failed CI runs, retries, and review comments, which is where the larger savings in the worked example come from.
The rule: give agents the right context, not more context. Loading the whole repository into the prompt raises input tokens on every turn.
5. The cost of delayed verification and verification debt
Amazon CTO Werner Vogels uses the term "verification debt" for what happens when AI writes code faster than people can understand it: the understanding has to be rebuilt during review. Like financial debt, it accrues interest, for concrete reasons:
Agentic development makes this worse. Agents produce more code and larger pull requests than people can read line by line: Faros AI reported PR size up 51% and 31% more pull requests merged with no review at all. And a new session started hours later to fix a CI failure has lost the context the original session had, so it pays to rebuild it in input tokens.
How do teams reduce rework in agentic development?
- Verify inside the agent’s loop, so issues are fixed while the code is still in context.
- Gate in CI with an independent check that does not depend on the model or agent that wrote the code.
- Keep pull requests small. They are cheaper to verify, review, and roll back.
- Fix existing issues where agents work most. This lowers tokens and retries on every future task.
- Turn repeated findings into rules the agent sees before it writes.
6. Governance metrics for engineering, security, and finance
Finance is moving fast. The State of FinOps survey found that 98% of respondents now manage AI spend, up from 31% two years earlier (Linux Foundation, 2026). As tools move to usage-based billing, AI coding becomes a variable cost that needs the same discipline as the cloud bill.
How do you measure trust in AI-generated code?
Measure outcomes, not confidence. In METR’s 2025 trial, experienced developers expected AI to make them 24% faster, were 19% slower on measured tasks, and still believed they had been 20% faster (METR, 2025). METR says those results no longer reflect current tools, but the lesson holds: perceived and measured speed can diverge.
Track four signals:
- Gate pass rate: agent changes passing an independent quality and security gate on the first run.
- Survival rate: AI-authored lines unchanged after 30 and 90 days.
- Override rate: how often reviewers reject or rewrite agent changes.
- Attributed incidents: production issues traced to agent changes.
When these improve together, give agents more autonomy. When they diverge, add verification there.
7. AC/DC’s Guide, Verify, Solve operating model for economically sustainable agentic development
Waste enters at the start (agents without context read too much and guess), grows in the middle (unverified changes fail late), and lingers at the end (unfixed issues raise the cost of future work). Sonar’s Agent Centric Development Cycle (AC/DC) addresses each point with three continuous stages around code generation.
AC/DC runs across three loops:
- Agentic loop. Sonar Vortex injects context before the first line of code and verifies each change as it is written, where fixes are cheapest.
- CI verification loop. SonarQube quality gates and Gitar AI code review provide an independent check at the pull request. Gitar generates fixes and iterates until the pipeline passes.
- Code maintenance loop. The SonarQube Remediation Agent works through the existing backlog and opens verified fix pull requests for engineers to review, lowering agent cost on every future task.
SonarQube is the independent verification and governance platform for code written by people and agents. Because it is agent-agnostic, teams can switch models or agents as prices and capabilities change without rebuilding their quality and security controls. Governance stays stable while the most volatile part of the stack, the model, keeps changing.
8. Methodology, data sources, and limitations
- Bai et al. (2026): eight models on SWE-bench Verified. Benchmarks differ from production codebases; results depend on harness and caching.
- swe-bench-token-waste: independent analysis of one agent harness on benchmark runs. Treat the 1.5x ratio as directional.
- Sonar State of Code survey (published January 2026, 1,100+ developers): self-reported, run by Sonar.
- Sonar code health study (540 runs, one agent, one model): Sonar used SonarQube to define code health, so it is not third-party. The companion arXiv paper reports 660 trials across 33 tasks, including six calibration tasks the blog excludes, with similar results.
- Sonar Vortex benchmarks: 36% is the best case for cost per run on a navigation-heavy task; results ranged from a 36% reduction to a 5% increase. The 92% figure comes from testing with one coding agent.
- Faros AI: vendor telemetry comparing each organization's lower and higher AI adoption periods, not a controlled study; some 2026 figures come from Faros summaries.
- METR: 16 developers on early-2025 tools; cited only for the perception gap.
- GitClear and Veracode: vendors in adjacent markets. GitClear’s trends coincide with AI adoption but do not prove causation.
- Worked example: all inputs are assumptions. The direction (retries and rework outweigh tokens) holds across a wide range of inputs; exact percentages will differ for your team.
9. Assess your agentic development workflow
You can run a first assessment in a week:
- Pick one team and repository with meaningful agent use.
- Pull 30 days of data: token spend, CI runs, review time, and changes reverted or rewritten.
- Calculate cost per accepted change and see how much comes from tokens versus review, rework, and defects.
- Map where issues are caught: agent loop, CI, review, or production.
- Check code health in agent hot spots, where fixes pay back fastest.
Start with the metric, not the model. Price per token is likely to keep falling, and it will stay the smallest line on the bill. In our example, a cheaper model saved 3% per accepted change, while better context and earlier verification saved 47%. That money comes from fewer retries, shorter reviews, and less rework, and those come from giving agents the right context and verifying their work while fixes are still cheap. Measure cost per accepted change for one team this quarter, then apply Guide, Verify, and Solve where the numbers point. Explore the Agent Centric Development Cycle, see Sonar’s approach to token optimization, or start with SonarQube for free.
