How NUS Computing Research Became the Technology Behind Sonar’s Globally Launched AI Remediation Agent
Professor Abhik Roychoudhury spent decades working on how to make software fix itself. His research at NUS Computing became AutoCodeRover, was acquired by Sonar in 2025, and now underpins a commercial offering used by developers worldwide — SonarQube Remediation Agent.
In May 2023, Prof Roychoudhury stood on stage at the International Conference on Software Engineering (ICSE) to accept the Most Influential Paper Award for “SemFix: Program repair via semantic analysis,” a paper he had co-authored a decade earlier. During the discussions that followed, fellow researchers kept asking the same question: was this the end of program analysis, now that large language models could write code from prompts?
Prof Roychoudhury saw it differently. LLMs would write code, yes. But if there was a harness of program analysis tools around them, the code produced could be more trustworthy and less costly, because the analysis would ensure the LLMs were not invoked more often than necessary.
That thinking led to AutoCodeRover.
A decades-long thread
Prof Roychoudhury’s work on automated program repair stretches back to his PhD thesis on formal verification. The central challenge, as he describes it, has stayed the same across eras: gathering developer intent. Developers rarely write full specifications for their code because it is difficult and time-consuming. Without those specifications, it is hard to establish what “correct” even means.
His approach has always centred on specification inference: automatically extracting what a program is supposed to do, rather than waiting for someone to write it down. His research group — Trustworthy and Secure Software (TSS)@NUS — developed a suite of techniques known as semantic program repair, where the behaviour of test executions is analysed to construct a generalisation of the intended behaviour.
AutoCodeRover pushed that thinking further. “Even when there are no specifications available, there are still specifications,” Prof Roychoudhury explains. “Even when there are no specifications about software behaviour, there are implicit specifications which can be extracted from the structuring of the software. The way a programmer has divided a task into sub-tasks by constructing classes, methods, loops and so on, captures the programmer’s thinking.”
He sees this as a natural evolution of his earlier work, one where even informal specifications like tests are no longer assumed, and yet an understanding of the program’s intended behaviour can still be reached.
The observation applies beyond human-written code. As AI agents generate more code, the same principle holds: the structuring of AI-generated code can reveal the reasoning behind it, opening the door to documenting and verifying that code automatically.
Building in quiet
Work on AutoCodeRover began in the later part of 2023, led largely by Prof Roychoudhury’s PhD students Yuntong Zhang and Haifeng Ruan. The directive he gave them was simple: we do not see code as text; assume all the program analysis tools are available to the LLM.
This was a departure from how other research groups, many from AI backgrounds, approached the problem. They treated a software project as a collection of files. Prof Roychoudhury’s team worked with program representations instead, a different approach shaped by years of software engineering research.
The team kept its work private. In early April 2024, they published the paper on arXiv and posted a tweet. The response was immediate, with online excitement and journalist enquiries. Prof Roychoudhury chose not to give interviews. He wanted the team to be focused on the technology.
He is candid about the missteps along the way. When users requested a Discord server for community feedback in April 2024, the team declined. “In retrospect, this was not the correct move,” he says. “Setting up a Discord server at that time would have allowed us to get faster feedback from the community.” He shares this openly:
“It is useful for us all to appreciate that the innovation process is a complex one, and we do not get everything right — mistakes do get made, but you continue learning and moving forward.”
From lab to acquisition
Prof Roychoudhury recognised early that AutoCodeRover could become more than a publication. He co-founded the startup with members of his research team.
Sonar, which describes itself as the global leader in AI code verification, efficiency, and governance, had been aware of AutoCodeRover and approached the team. For Prof Roychoudhury, the fit was clear. He was already familiar with Sonar’s core platform, SonarQube, through his research, and the platform’s global reach – trusted by over 7 million developers – offered a direct path from research to real-world developer workflows.
Sonar acquired AutoCodeRover in February 2025. The technology was refined into the Sonar Foundation Agent, which holds the #1 position on the SWE-bench Verified leaderboard, the leading benchmark for AI agents on real-world software engineering tasks. By October 2025, a beta programme was underway. In May 2026, SonarQube Remediation Agent, built on AutoCodeRover’s technology, was launched globally at ATxSummit in Singapore.
Roots in Singapore
The acquisition brought more than a technology transfer. Sonar established its regional headquarters in Singapore, with support from the Economic Development Board (EDB) and a partnership with the Infocomm Media Development Authority (IMDA), which served as a strategic design partner for the launch of SonarQube Remediation Agent. R&D positions were also created in Singapore.
“Many companies have sales offices in Singapore, which is valuable, but it is even better when they also build R&D capabilities here,” Prof Roychoudhury says. “Singapore’s R&D ecosystem can now contribute further to continue the innovation process with Sonar, EDB, and IMDA. Continuity between research, product development, and commercialisation is exactly what helps an ecosystem mature.”
Sonar has also committed to continued collaboration with Prof Roychoudhury’s Trustworthy and Secure Software research group. In January 2026, Prof Roychoudhury co-organised an AI for Code Roundtable on the sidelines of AAAI 2026, where Sonar’s Chief Growth Officer, Harry Wang, joined as an invited speaker.
Round-trip engineering
Prof Roychoudhury continues as a full-time NUS Computing faculty member while serving as Sonar’s Senior Science Advisor. He sees the dual role as essential rather than incidental.
“We often think of translation as a linear flow — from basic research, to applied research, to translation,” he says. “In reality, good quality research and good quality translation often involves round-trip engineering, where we can look at the state of the practice and formulate research problems to improve the practice.”
Prof Roychoudhury takes his learnings with Sonar to feed directly back into his academic research.
The road ahead
Managing, maintaining, and verifying code is becoming the central challenge in software engineering as AI tools generate more code than ever. Reports from companies suggest human programmers are increasingly being asked to review AI-generated code, a situation Prof Roychoudhury sees as unsustainable without better automated tools.
“I have been a researcher in program repair for many years, and I always used to mention in my classes at NUS that my aim was to put automated program repair in use before I retire,” he says. “I am happy to see it becoming a reality well before then.”
He is already working on what comes next. In June 2026, Prof Roychoudhury co-launched “AI for Program Reasoning” under Singapore’s AI for Science Programme, alongside Cristian Cadar from Imperial College London. The project aims to use agentic reasoning for formal verification of code, ensuring that AI-generated software behaves as intended, reliably and provably.
It is, as he puts it, round-trip engineering. And the next trip has already begun.
