AI Code Review

What Is AI Code Review?

AI code review is the use of a large language model to examine code changes for bugs, security issues, logic errors, and style problems, typically as an automated first pass on pull requests. It supplements human review by catching mechanical defects early, leaving people to judge architecture, intent, and fitness for purpose.

Key Takeaways

• AI review works at the diff level with repository context, so it catches cross-file inconsistencies and missed call sites that linters and static analysis cannot see.
• Its best position in the pipeline is before human review: the model clears the mechanical findings so human attention goes to design and correctness of intent.
• It becomes more important, not less, as teams adopt agentic coding, because generated code volume outgrows human review capacity. By March 2026, GitHub Copilot alone had performed 60 million code reviews, more than one in five code reviews on GitHub, with 71% surfacing actionable feedback at an average of 5.1 comments per review [1].
• The model cannot know your business rules or roadmap. It verifies the code against the code, and against the spec only if you give it one.
• False positives are the adoption killer. Teams tune review prompts and severity thresholds the same way they tune linters, or engineers learn to ignore the bot.

How It Works

A review agent triggers on a pull request, reads the diff, and pulls in surrounding context: the full files being changed, callers and callees of modified functions, project conventions from AGENTS.md or CLAUDE.md, and sometimes the linked ticket or spec. It then reasons through the change looking for real defects: null paths, race conditions, broken invariants, missing error handling, injection risks, and divergence between what the PR description claims and what the diff does. Findings come back as inline comments, usually with a severity and a suggested fix the author can apply in one click.

Products in this space, including GitHub Copilot code review, CodeRabbit, Graphite's Diamond, and reviewers built on Claude Code or similar agents in CI, differ mainly in context depth and noise control. Demand arrived fast: over 1 million developers used Copilot code review during its roughly one-month public preview before general availability in April 2025 [2]. The better ones learn from resolved and dismissed comments, check the diff against the team's stated conventions, and stay quiet when they have nothing above the confidence bar. Some teams close the loop entirely for agent-authored changes: one agent writes the code, a differently prompted agent reviews it, and a human arbitrates disagreements, which keeps human in the loop judgment where it pays most.

Placement matters as much as capability. Run before human review, the AI pass shortens the human one. Run as a required check with a strong prompt about severity, it becomes an AI guardrails layer for changes nobody requested review on, such as automated dependency bumps.

Example

A team wires an AI reviewer into CI as a non-blocking check. On a PR migrating session storage to Redis, the bot leaves three comments: the TTL constant disagrees with the value documented in the config README, one call site in a cron job still constructs the old session object, and the new client is created per request instead of pooled. The first two are real bugs the author fixes in ten minutes. The third is intentional for this service's traffic, so the author dismisses it with a note, which the reviewer's memory records to avoid repeating the comment on future PRs. The human reviewer then spends her time on the actual question, whether the migration's cutover plan is safe, instead of hunting stale call sites.

What People Get Wrong

The mistake is treating AI review as a replacement for human review rather than a filter in front of it. A model checks the change for internal defects; it cannot know that the feature contradicts a decision made in a meeting, that this module is scheduled for deletion, or that the "fix" papers over a deeper design flaw a senior engineer has been tracking. Teams that route small PRs straight to merge on a green bot pass discover this slowly and expensively. The reliable division of labor: AI reviews the code, humans review the intent, and nothing merges that no human has thought about at all. The caution is warranted and widely shared, since 30% of respondents in the 2025 DORA survey reported little or no trust in AI-generated code [3].

FAQ

Can AI do a full PR review on its own? For mechanical quality, largely yes: an AI PR review pass catches bugs, style drift, and security smells with good recall. For approval decisions, no. The model has no knowledge of intent beyond the artifacts you provide and no accountability for the outcome, so a person should own every merge.

Does AI code review catch security vulnerabilities? It catches many common ones, including injection patterns, missing authorization checks, and secrets in diffs, and it reasons about novel code better than signature-based scanners. It complements rather than replaces dedicated SAST tooling and cannot certify compliance.

What makes AI review effective for agent-generated code? Volume and independence. Agents produce more diffs than humans can deeply read, and generated code fails in characteristic ways: plausible-looking calls to functions that do not exist, subtly wrong edge behavior, tests that assert too little. A reviewer model with a different prompt, and ideally a different vantage point, catches a meaningful share of these before a human ever looks, and the human review that follows starts from a cleaner diff.

Sources

1. GitHub Blog. "60 million Copilot code reviews, share of reviews on GitHub, and actionable-feedback rate." https://github.blog/ai-and-ml/github-copilot/60-million-copilot-code-reviews-and-counting/. Accessed August 2026.
2. GitHub Changelog. "Copilot code review general availability and public preview usage." https://github.blog/changelog/2025-04-04-copilot-code-review-now-generally-available/. Accessed August 2026.
3. Google Cloud / DORA. "2025 DORA report: trust in AI-generated code." https://cloud.google.com/blog/products/ai-machine-learning/announcing-the-2025-dora-report. Accessed August 2026.