Topic
The practice of using large language models or AI agents to review source code and pull requests for bugs, style issues, and security flaws.
GitHub's September 23 Copilot code review update adds separate automatic-review switches for draft pull requests and new pushes, plus Lite or Balanced effort. Its review is still a comment that cannot satisfy a merge rule, so each extra trigger adds reading without adding a gate.
Reality
Six LLMs on a 12-task Kaggle security benchmark all caught SQL injection, hardcoded keys and pickle RCE, but Gemini 3.7 Flash missed a path traversal. With one scenario per flaw class, the run shows which textbook patterns the models know and says little about trusting one to review real code.
Reality
AI code reviewers lose hosted rule ingestion first on self-managed GitLab, Azure DevOps Server and Bitbucket Data Center, a dev.to comparison says. Of the three mechanisms it compares, only a pass/fail rule can block a merge, and vendors tend to put that one on paid tiers.
Reality
LinearB's 2026 benchmark finds only 32.7% of AI-assisted pull requests accepted within 30 days, against 84.4% of manual ones. The figures are associations, but they put review cost in the queue and in repeat rounds, where faster diff reading helps little.
Reality
GitLab's v19.5 docs send AI reviews started by Duo Enterprise seat holders to the single-pass reviewer that reads only the merge request and its diffs. To check cross-file rules on every review, a group Owner has to move seat holders onto the credit-billed Code Review Flow.
Reality
Copilot code review for Azure Repos needs admins at three levels to enable it, in order, before it can comment on one pull request. It is a limited preview with no SLA, so whether review runs at all is configuration an Azure DevOps shop has to own and keep checking.
Reality
WorldScript Studio tracks fifteen automated reviewers in a JSON registry, and only four deterministic security scanners may block a merge. The design keeps LLM false positives off the merge path and keeps pull-request code away from the checker that judges it.
Reality
GitHub's agentic autofix now saves a pattern from each security fix it creates in Copilot Memory and passes those patterns to code review and the cloud agent. Teams that enable Memory now decide whether an agent's fixes deserve to guide reviews across a repository.
Reality
Blog vs Bytecode, a 28-item Kaggle benchmark, graded empty proxy responses as wrong and scored DeepSeek-R1 at 17% until a second gateway showed 100%. Once capture was fixed, frontier models lost points by flagging sound code, while a small Gemma model missed most of the planted flaws.
Reality
LinearB scored 16 hand-built bugs on noise and clarity; DeepSource ran the same product category against OpenSSF's public CVE corpus and published F1. Each vendor wins on its own instrument, and the two tests reward different behaviour.
Reality
One operator ran spec-driven development at full BMAD weight for four weeks on an autonomous coding repo. The planning stage produced 1,782 files and 16 MB of artifacts, and a single story burned around thirty million tokens.
Reality
Code Review Bench reconstructs the timeline of 16,017 open source pull requests and publishes precision and recall beside every F1. The top five tools sit within five points of each other, on samples of very different size.
Reality
A two-model code review produced rebuttals and a clean verdict while the raw logs showed no changed positions and no new evidence. The rebuild enforces independence by withholding each verdict until both are committed.
Reality
GitHub's podcast companion post argues that a production authentication refactor and a CSS experiment need different review, and it puts the same conditional test to "RAG is dead" and "Skills killed MCP".
Reality
Qodo's five-agent comparison ranks Qodo first and publishes no method behind the grades, while Graphite's own integration guide lists four ways to wire a reviewer into GitHub and only one of them owns merge protection.
Reality
The New Stack says AI-assisted teams have moved the bottleneck from writing code to verifying it, and the remedy it proposes is an afternoon spent sorting the last 100 review comments into rules, tests and judgment.
Reality
Severity labels come back from Claude, get checked against four allowed values, stable-sorted and then cut with slice() at a constant, with the count of what got cut printed in the review body, while the priority order inside the cut still comes from the model.
Reality
The expensive part of software work has moved from writing code to proving it. An engineer building agent systems puts the deny outside the model where no prompt can reach it, and says plainly which defects his deterministic checks still miss.
Reality
Alibaba ran the reviewer internally for two years across tens of thousands of developers before releasing it. The write-up is specific about how files get selected and comments get positioned, and it stops short of publishing the benchmark scores.
Reality
In an InfoQ talk, Duolingo engineer Sarah Deitke describes the hands-on labs and usage dashboards her DevEx AI team built to make engineers comfortable with AI, and says they trust in-house content over a vendor's.
Reality
Build · September 14, 2026 · 1 publisher
Build · September 14, 2026 · 1 publisher
Build · September 13, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Build · September 10, 2026 · 1 publisher
Build · September 10, 2026 · 1 publisher
Build · September 9, 2026 · 1 publisher
Build · September 8, 2026 · 1 publisher
Build · September 8, 2026 · 1 publisher
Build · September 6, 2026 · 1 publisher
Build · September 2, 2026 · 1 publisher
Product · September 2, 2026 · 1 publisher
Build · September 2, 2026 · 1 publisher
Build · August 31, 2026 · 1 publisher
Build · August 30, 2026 · 1 publisher
Build · August 29, 2026 · 1 publisher
Build · August 28, 2026 · 1 publisher
Build · August 28, 2026 · 1 publisher
Leadership · August 28, 2026 · 1 publisher
Product · August 27, 2026 · 1 publisher
Build · August 26, 2026 · 1 publisher
Build · August 25, 2026 · 1 publisher
Build · August 25, 2026 · 1 publisher
Build · August 22, 2026 · 1 publisher
Product · August 20, 2026 · 1 publisher
Build · August 19, 2026 · 1 publisher
Build · August 19, 2026 · 1 publisher
Build · August 19, 2026 · 1 publisher
Build · August 17, 2026 · 1 publisher
Build · August 14, 2026 · 1 publisher