AI code review in 2026: how teams review agent-written pull requests

The numbers behind the review bottleneck

A study by Harvard researchers Fiona Chen and James Stratton, reported by Ars Technica on 9 October, used Jellyfish engineering data covering more than 700,000 employees at over 700 software firms. After companies introduced AI coding agents, pull requests rose 23 percent on average, but resolved Jira issues and epics did not change in a statistically significant way. The time from a pull request being opened to being merged grew 49 percent, the share of pull requests with changes requested nearly doubled, and comments per pull request rose 35 percent. The authors conclude that coding gains are “absorbed by downstream constraints in the production process.”

The same study found that 80 percent of the firms used some form of AI code review by March 2026, yet AI agents wrote only 23.3 percent of review comments. In other words, most teams had bought a review tool but people were still doing most of the reading.

Practitioners describe the same pattern. In a DevOps.com article on 21 October, Mayank Bhola, co-founder of TestMu AI, said engineering leaders “are not seeing the compounding quality debt that accumulates when review capacity does not scale with generation capacity.” His prescription: “The solution is not slower generation. It is smarter review.” Qodo CEO Itamar Friedman put the risk more bluntly in the same piece: “Do you blame the AI or do you blame yourself for not making it clear that quality matters?”

What shipped in October 2026

How the heaviest users actually review

The most detailed account so far comes from the Claude Code team itself. In a 15 October post, Addy Osmani, Morgan Westlee Lunt and Qing Wang write that changes landing per day in Anthropic's monorepo went from about 2,500 in May to more than 30,000 in September. Their summary of how they coped: “We didn't remove review. But we did move most of the reading to machines, optimized for human time and attention, and invested heavily in making it fast and easy to undo mistakes.”

Their process is layered. The agent must verify its own work with tests, a build or a screenshot before a pull request exists. Every pull request then gets an AI review and a separate security review, and a pull request cannot merge while findings are open. Human approval is scaled by risk: none for low-risk docs and flagged changes, one person for ordinary product changes, two for the riskiest paths. One rule stands out: “An agent's approval never counts as a person's, either.” They also cap review rounds at three, after one pull request went through more than fifty overnight rounds between an agent author and an agent reviewer.

Meta reports similar results at a larger scale. A paper presented at ASE 2026 describes RADAR, a risk-aware system that classifies each change and lets low-risk ones land after automated review. It has reviewed more than 535,000 diffs, and Meta reports that RADAR-reviewed diffs have one third the revert rate and one fiftieth the production incident rate of other diffs, while median time to close fell by more than 4.3 times.

What AI reviewers still miss

None of these vendors claims their reviewer replaces people. Anthropic's announcement and documentation describe a tool that posts findings, not approvals, and GitHub's AI Scan cannot block a merge. AI reviewers can produce false positives, miss bugs that depend on business context, and approve code that looks clean but solves the wrong problem.

The Claude Code team lists what people still own: deciding whether something should be built at all, reviewing risky areas such as billing and release workflows, judging architecture that others will copy, and owning the outcome of every change that ships. Boris Cherny, who created Claude Code, is quoted on why verification matters so much: “Verification looks different for each domain. It might be as simple as running a bash command, or running a test suite, or testing the app in a browser or phone simulator.”

A practical AI code review checklist

• Keep pull requests small. A reviewer, human or AI, reads a 100-line change far more carefully than a 1,000-line one.
• Make the agent prove its work before review: passing tests, a successful build and screenshots of any UI change.
• Add one AI reviewer on one repository first, write down your project rules for it, and tune it for a few weeks before rolling it out.
• Run a separate security check, and do not let an advisory-only scanner be your only gate.
• Decide risk tiers in advance. Payments, logins, personal data and deployment settings always get a human reviewer.
• Never let a bot approval count as a human approval, and re-approve when new commits land.
• Track wait time for first review and revert rate, not just how many pull requests you merge.
• Ship behind feature flags, keep backups, and make rollback a one-step job.

Where CoreCodify fits

Agent-written code is only as good as the review and testing around it. For a business website or app, that means small reviewed changes, real-device testing, backups before every release and a live check afterwards, whoever or whatever wrote the code.

At CoreCodify we build websites, mobile apps, UI/UX and AI solutions with AI tools in the loop and humans accountable for every release. If you want a website or app built or reviewed with that balance of speed and care, hire me for custom work at usamify.com.