Topic
The practice of using large language models or AI agents to review source code and pull requests for bugs, style issues, and security flaws.
Anthropic is giving eligible Claude Enterprise organizations $10,000 to $50,000 in Code Review credits for up to 30 days after an owner claims them. Reviews keep running when the pool is gone, so the spend limit set before claiming decides the first paid day.
Reality
Meta's RADAR auto-reviews low-risk diffs after diffs per developer per month rose 51% in a year, a dev.to summary of its paper reports. The safety result it cites compares RADAR diffs with non-RADAR ones, so it transfers only to teams whose eligibility filter is as conservative.
Reality
Linus Torvalds says he likes using AI, though three-quarters of a day of kernel maintainer talks went to making AI generation and review less stressful. Teams writing an AI policy can turn his line on serious code into a test of who ends up checking the output.
Reality
GitHub's ReviewBench grades AI code reviewers on 219 pull requests from 187 open-source repositories, counting real issues found and false alarms raised. Security teams get a shared, repeatable check before letting a bot gate a release, on a test GitHub also uses to tune its own Copilot reviewer.
Reality
GitHub released ReviewBench, an open benchmark that scores AI code reviewers on 219 pull requests from 187 public repositories in 19 languages. Buyers can rerun any reviewer on the public dataset and published judge, though every score depends on one LLM's view of what counts as relevant.
Reality
JetBrains and Lund University propose review tools that flag per-segment risk in AI-written code, a design shaped with 17 practitioners and a 43-person survey. They argue diff review cannot keep up with agent-sized changes unless tools show reviewers where to read closely.
Reality
GitHub's September 23 Copilot code review update adds separate automatic-review switches for draft pull requests and new pushes, plus Lite or Balanced effort. Its review is still a comment that cannot satisfy a merge rule, so each extra trigger adds reading without adding a gate.
Reality
Six LLMs on a 12-task Kaggle security benchmark all caught SQL injection, hardcoded keys and pickle RCE, but Gemini 3.7 Flash missed a path traversal. With one scenario per flaw class, the run shows which textbook patterns the models know and says little about trusting one to review real code.
Reality
AI code reviewers lose hosted rule ingestion first on self-managed GitLab, Azure DevOps Server and Bitbucket Data Center, a dev.to comparison says. Of the three mechanisms it compares, only a pass/fail rule can block a merge, and vendors tend to put that one on paid tiers.
Reality
LinearB's 2026 benchmark finds only 32.7% of AI-assisted pull requests accepted within 30 days, against 84.4% of manual ones. The figures are associations, but they put review cost in the queue and in repeat rounds, where faster diff reading helps little.
Reality
GitLab's v19.5 docs send AI reviews started by Duo Enterprise seat holders to the single-pass reviewer that reads only the merge request and its diffs. To check cross-file rules on every review, a group Owner has to move seat holders onto the credit-billed Code Review Flow.
Reality
Copilot code review for Azure Repos needs admins at three levels to enable it, in order, before it can comment on one pull request. It is a limited preview with no SLA, so whether review runs at all is configuration an Azure DevOps shop has to own and keep checking.
Reality
WorldScript Studio tracks fifteen automated reviewers in a JSON registry, and only four deterministic security scanners may block a merge. The design keeps LLM false positives off the merge path and keeps pull-request code away from the checker that judges it.
Reality
GitHub's agentic autofix now saves a pattern from each security fix it creates in Copilot Memory and passes those patterns to code review and the cloud agent. Teams that enable Memory now decide whether an agent's fixes deserve to guide reviews across a repository.
Reality
Blog vs Bytecode, a 28-item Kaggle benchmark, graded empty proxy responses as wrong and scored DeepSeek-R1 at 17% until a second gateway showed 100%. Once capture was fixed, frontier models lost points by flagging sound code, while a small Gemma model missed most of the planted flaws.
Reality
LinearB scored 16 hand-built bugs on noise and clarity; DeepSource ran the same product category against OpenSSF's public CVE corpus and published F1. Each vendor wins on its own instrument, and the two tests reward different behaviour.
Reality
One operator ran spec-driven development at full BMAD weight for four weeks on an autonomous coding repo. The planning stage produced 1,782 files and 16 MB of artifacts, and a single story burned around thirty million tokens.
Reality
Code Review Bench reconstructs the timeline of 16,017 open source pull requests and publishes precision and recall beside every F1. The top five tools sit within five points of each other, on samples of very different size.
Reality
A two-model code review produced rebuttals and a clean verdict while the raw logs showed no changed positions and no new evidence. The rebuild enforces independence by withholding each verdict until both are committed.
Reality
GitHub's podcast companion post argues that a production authentication refactor and a CSS experiment need different review, and it puts the same conditional test to "RAG is dead" and "Skills killed MCP".
Reality
Build · September 17, 2026 · One report1 publisher
Build · September 8, 2026 · One report1 publisher
Build · September 2, 2026 · One report1 publisher