In October 2026, GitHub published ReviewBench, an open benchmark for AI code review agents evaluated on 219 real pull requests from 187 public repositories across 19 programming languages. The leaderboard's top entry, Copilot Code Review in its balanced configuration, posted a grounded precision of 87.8 percent and a grounded recall of 26.0 percent.
That pair of numbers describes the tool market's central promise and its central limitation in the same line. The precision is high: when the tool flags something, it is usually right. The recall is low: the tool catches roughly one in four of the known issues in the benchmark. The other three are left for someone else to find.
ReviewBench has also drawn scrutiny for a methodological reason. Nearly half of the benchmark's true-positive answer key comes from Copilot Code Review itself, which raises a self-inclusion question when evaluating the same tool against that key. The 87.8 percent precision figure should be read with that caveat in mind.
An enterprise that buys this tool has purchased a fast, accurate, partial reviewer. It has not purchased a solution to the bottleneck. The bottleneck was not detection speed but review capacity: the volume of code arriving for review had outgrown the human capacity to absorb it. The tool accelerates one step in the process while leaving the final decision where it was, and it has not changed that arithmetic.
The Bottleneck Is Capacity, Not Detection
The data describing the review bottleneck has become difficult to dispute.
The Harvard working paper on 700 firms and 700,000 workers found the same thing this series opened with: AI agents raised code output by 30 percent, completed software did not move, and review-and-merge time stretched from 7.03 to 10.48 days. The gain went into the queue.
Faros AI's telemetry, covering 4,000 teams and 22,000 developers, found that review time extended by 441.5 percent, and the share of pull requests merged without any review at all rose 31.3 percent. The review system was not keeping up. It was being bypassed.
The review tools were already deployed when those measurements were taken. By March 2026, approximately 80 percent of the firms in the Harvard sample were using some form of AI-assisted code review. The tools were present. The bottleneck persisted. The two facts are not in tension. They describe the same outcome: adding detection capacity to a system whose constraint is decision capacity does not increase throughput.
What the Tool Market Sells
The American AI code review market has grown rapidly by selling detection capacity. CodeRabbit is the mid-market leader, with an average contract value of roughly $6,700 and 5x customer growth exiting 2025. Sourcegraph dominates the enterprise segment, with average contract values just under $300,000. The global AI code review and SDLC governance market was valued at approximately $924 million in 2025, forecast to reach $2.46 billion by 2032.
The products are useful. A tool that catches 87.8 percent of what it flags, with high precision, reduces the noise a human reviewer has to sort through. But the tool's value proposition is framed as a substitute for review capacity, and the data does not support that framing. ReviewBench's recall of 26 percent means the tool cannot substitute for the reviewer's judgment on three-quarters of the known issues. The human still has to find them. The tool changes what reviewers spend time on, not how much time they have.
The review tool market's growth is real. The bottleneck it was supposed to solve is also real. The two have coexisted for more than a year.
The Process Alternative
The Chinese enterprise market has approached the same problem from a different direction, and the difference is visible in the architecture of the tools rather than the benchmarks they score on.
Tencent Cloud's documentation for WorkBuddy states the premise directly: the bottleneck in code review is rarely that no one is looking, but that the looking happens too late. When review sits in a pull request queue, the cost is not just the time spent reviewing. It is the time the change spends waiting, the context switching it imposes on reviewers, and the defects that leak past review into testing and production because the queue was too long to inspect everything carefully.
WorkBuddy's response is not a faster reviewer. It is a merge gate — a set of automated assertions embedded in the CI/CD pipeline. The gate is configured as five stages: compilation, static analysis, AI review, unit test generation, and coverage validation, each with its own risk-tiered threshold. If the code does not pass, it does not merge. The review happens at the moment of commit, not days later in a queue.
The merge gate does not replace the human reviewer. It changes what reaches the human. The routine checks — compilation, static analysis, test coverage — are handled before the human sees the change. The human spends time on architecture and business logic, not on the things a machine can verify deterministically.
The same pattern shows up in Kitta, the review agent deployed in the OpenAnolis community: more than 70,000 patches processed, a 97 percent gate accuracy rate, a 62 percent merge rate. Passing the gate there is a precondition for merge, not a suggestion.
Why the Merge Gate Changes the Arithmetic
The difference between a review tool and a merge gate is not the quality of the detection. It is the location of the decision.
A review tool produces findings. A human reads the findings, decides what to do with them, and merges or rejects the change. The tool has accelerated the finding step. The decision step remains human, and the human's capacity is unchanged.
A merge gate produces a pass or fail. The code either meets the threshold or it does not. There is no queue of findings waiting for a human to triage them. There is a queue of changes that failed the gate, and those changes have to be fixed before they can re-enter the pipeline. The gate does not ask the human to review more code. It prevents code that fails the automated checks from reaching the human in the first place.
That distinction matters most under volume. A human reviewing 30 percent more code with a tool that catches 26 percent of the issues is still reviewing 30 percent more code. A pipeline that rejects non-compliant code at commit time does not accumulate a backlog of unreviewed changes. The code that reaches the human has already passed the checks that do not require human judgment.
The Chinese enterprise market has adopted the merge gate model because its institutional infrastructure — the CI/CD pipeline, the cloud platform, the certification standard — was designed to support it. The CAICT's technical specification for code security audit agents explicitly requires CI/CD pipeline closed-loop integration as a core capability. The gate is a condition of enterprise-grade certification.
What Buying a Tool Cannot Do
The American market's preference for buying tools is rational. A tool can be procured, deployed, and measured without redesigning the development pipeline. It fits the procurement process that enterprises already have. It produces a dashboard that can be shown to leadership. It does not require the organization to change how it works.
The limitation is that the bottleneck is a property of how the organization works. A tool that accelerates one step in a process whose constraint is a different step does not increase throughput. It increases the speed at which the non-constraint step produces output that the constraint step cannot absorb.
ReviewBench's 87.8 percent precision and 26 percent recall describe a tool that is good at what it does. What it does is find some of the issues faster. It does not find all of them, and it does not decide whether the change should merge. The human still has to do that. The human's capacity is the bottleneck.
The merge gate model does not increase the human's capacity either. It changes what the human is asked to do. The human is not asked to triage a larger volume of findings from a larger volume of code. The human is asked to review a smaller set of changes that have already passed the checks a machine can perform. The bottleneck is narrowed to the decisions that genuinely require human judgment.
That is a process change. It cannot be bought as a tool. It has to be built into the pipeline, the certification standard, and the engineering culture. The tool market sells detection. The bottleneck requires a decision about where review happens, and that decision cannot be bought as a product.
Sources: GitHub ReviewBench via benchlm.ai leaderboard (October 7, 2026) and suwa-sh.github.io analysis (October 6, 2026); Harvard working paper "Artificial Intelligence in the Firm: Bottlenecks in Software Production" via Yahoo Tech (October 12, 2026); Faros AI telemetry via ADTmag (April 22, 2026); YipitData AI code review market data (March 2026); MarketResearch.com AI Code Review and SDLC Governance Market Report (July 2026); Tencent Cloud WorkBuddy CI/CD documentation (August 7, 2026); Alibaba Cloud Developer Community Kitta code review agent (October 16, 2026); CAICT code security audit agent technical specification via cn-sec.com (August 2026); Agentic Code Review Workflows research synthesis (June 2026).
Disclaimer
The information provided in this article is for general informational and educational purposes only. It does not constitute legal, financial, or professional advice. The author and publisher are not responsible for any actions taken based on the content of this article. Readers should consult qualified professionals for advice specific to their situation. All trademarks and references to third-party products, services, or organizations are the property of their respective owners. The performance data and benchmarks discussed are based on specific research studies and may not generalize to all use cases or environments. As of the publication date, the AI landscape continues to evolve rapidly, and readers should verify current information independently.
Limitations
This analysis is based on benchmark publications, vendor pricing, and public reporting available as of the article date.
ReviewBench figures reflect one benchmark's dataset and scoring methodology; results may differ on other codebases.
The precision and recall figures carry the self-inclusion caveat described in the text.
Market size and contract value figures come from third-party research and are estimates.
Vendor capabilities change quickly; product descriptions reflect the cited sources, not hands-on testing.
Reporting standards differ across jurisdictions; figures may not be directly comparable.
This sector is changing quickly; claims can become outdated soon.
Sources
- GitHub ReviewBench via benchlm.ai leaderboard (October 7, 2026) and suwa-sh.github.io analysis (October 6, 2026)
- Harvard working paper "Artificial Intelligence in the Firm: Bottlenecks in Software Production" via Yahoo Tech (October 12, 2026)
- Faros AI telemetry via ADTmag (April 22, 2026)
- YipitData AI code review market data (March 2026)
- MarketResearch.com AI Code Review and SDLC Governance Market Report (July 2026)
- Tencent Cloud WorkBuddy CI/CD documentation (August 7, 2026)
- Alibaba Cloud Developer Community Kitta code review agent (October 16, 2026)
- CAICT code security audit agent technical specification via cn-sec.com (August 2026)
- Agentic Code Review Workflows research synthesis (June 2026).
The information provided in this article is for general informational and educational purposes only. It does not constitute legal, financial, or professional advice. The author and publisher are not responsible for any actions taken based on the content of this article. Readers should consult qualified professionals for advice specific to their situation. All trademarks and references to third-party products, services, or organizations are the property of their respective owners. The performance data and benchmarks discussed are based on specific research studies and may not generalize to all use cases or environments. As of the publication date, the AI landscape continues to evolve rapidly, and readers should verify current information independently.
Limitations: This analysis is based on benchmark publications, vendor pricing, and public reporting available as of the article date.; ReviewBench figures reflect one benchmark's dataset and scoring methodology; results may differ on other codebases.; The precision and recall figures carry the self-inclusion caveat described in the text.; Market size and contract value figures come from third-party research and are estimates.; Vendor capabilities change quickly; product descriptions reflect the cited sources, not hands-on testing.; Reporting standards differ across jurisdictions; figures may not be directly comparable.; This sector is changing quickly; claims can become outdated soon.