In March 2026, Anthropic launched Code Review, a tool that dispatches a team of agents to inspect pull requests in parallel, verify bugs, and rank them by severity. The company's internal testing showed that on large pull requests of more than 1,000 lines, 84% received findings, averaging 7.5 issues per review. The tool is priced on token usage, averaging $15 to $25 per pull request.
It is, by any measure, a serious product aimed at a serious problem. The problem is that AI is now writing more code than humans can realistically read. And the solution Anthropic is selling — AI reviewing AI — is arriving at the exact moment when human review is disappearing.
The Review Bottleneck
The numbers describing the state of code review in 2026 are stark.
According to Anthropic and research firm Material's 2026 State of AI Agents Report, which surveyed more than 500 U.S. technical leaders, 86% of organizations have moved past pilot projects and are running AI coding agents against production code. 42% already trust agents to lead development work, with humans providing oversight rather than gatekeeping every change.
The volume of AI-generated code is outgrowing the capacity of human review. LinearB's 2026 benchmarks, analyzing more than 8 million pull requests from 4,800 engineering teams, found that AI-assisted pull requests are 2.6 times larger than human-written ones, and agentic AI pull requests sit idle 5.3 times longer before a reviewer picks them up. A separate analysis found AI-generated PRs contain 1.7 times more issues per review than human-generated ones — 10.83 issues versus 6.45. AI-generated PRs have a 32.7% acceptance rate, compared to 84.4% for human-written PRs.
And then there is the number that matters most. A peer-reviewed 2026 study found that 61% of AI-agent pull requests receive no review at all.
The code is being written, merged, and shipped. The humans in the loop are increasingly clicking "approve" on diffs they have not read.
The Two Responses
The industry has split into two camps, and the split runs along a familiar fault line.
The product camp — led by American labs and tooling companies — believes the answer is better tooling. Anthropic's Code Review is the highest-profile example, but it is not alone. CodeRabbit, Greptile, Cursor Bugbot, and Qodo have all launched AI review products in 2026, with pricing ranging from $1.00 to $1.50 per run for Bugbot to $24 per developer per month for CodeRabbit. The thesis is straightforward: if AI is generating the code, AI should review it too. The bottleneck is a throughput problem, and throughput problems are solved with automation.
There is evidence the approach works. Anthropic reported that its engineers marked less than 1% of Code Review's findings as incorrect — a remarkably low false-positive rate for any code review system, human or machine. On large PRs, the tool found issues in 84% of cases. The company has been running Code Review internally for months, and the tool is now available to enterprise customers.
The gatekeeping camp — led by open-source maintainers and some engineering leaders — believes the answer is tighter controls, not more automation. The Godot game engine project made this position explicit in July 2026. The project announced that it would prohibit almost all use of AI from contributors, citing an overwhelming number of pull requests that appeared to be AI-generated. "AI cannot take responsibility, and we can't trust heavy users of AI to understand their code enough to fix it," the maintainers wrote. Autonomous AI agent contributions and "vibe-coded garbage" would continue to trigger automatic bans from the project's GitHub repository. New contributors with three or fewer merged pull requests would need explicit permission before submitting features or significant refactoring. AI assistance would be limited to "menial things (like code completion, regex, or find and replace)" — and any AI use must be disclosed in the PR discussion.
The maintainers described AI pull requests as "demoralizing" for the team. One Godot-using game studio was more blunt: AI PRs were "largely garbage," came from users who didn't understand what they were proposing, and were "a total shitshow."
The two responses are not merely different strategies. They reflect different beliefs about what code review is for. The product camp treats review as a quality-assurance step that can be automated. The gatekeeping camp treats it as a knowledge-transfer mechanism and a responsibility checkpoint — something that cannot function if the person clicking "approve" doesn't understand the code.
The Ownership Problem
The gatekeeping camp's concern is not just about quality. It is about accountability. "AI cannot take responsibility," the Godot maintainers wrote. That sentence captures the core tension of AI-assisted development in 2026. Someone merges the code. Someone is on call when it breaks. Someone's name is on the commit.
But if nobody read the diff, who owns the mistake?
The industry is beginning to experiment with answers. Some engineering teams have moved to reviewing the specification, not the diff — writing a detailed, code-level spec first, having AI implement against it, and having humans review whether the implementation matches intent rather than inspecting every line. Others have introduced risk-tiered review: low-risk changes proceed automatically, high-risk changes require human approval, and the middle tier is triaged by automated gates. One team reported that unhealthy connectors dropped by 60 to 70 percent after implementing risk-tiered automation.
These are pragmatic adaptations. But they are adaptations to a situation that was not designed. The pull request was invented as a gatekeeper for open source, where strangers submit code to projects they do not own. Inside a company building software, the PR has always been a weaker checkpoint. Add AI agents that generate a PR every few minutes, and the queue grows forever.
The China Angle
The code review crisis is not an American problem. But the responses are shaped by different institutional contexts.
In the U.S., the dominant response has been productization. Anthropic sells Code Review. Cursor sells Bugbot. The market is responding to the review bottleneck by building tools that companies can buy. The assumption is that enterprises will pay for quality assurance, as they have always paid for security software, testing infrastructure, and CI/CD pipelines.
In China and in open-source communities more broadly, the response has leaned toward gatekeeping and process control. Godot is an open-source project, not a Chinese company, but its response — raising contribution barriers, banning autonomous agents, requiring human-to-human communication — mirrors the approach taken by Chinese platforms that have faced similar challenges with AI-generated content. The Chinese regulatory framework for AI-generated content requires labeling and provenance from the start. The instinct is to control the input, not just monitor the output.
Neither approach is obviously correct. Productization gives enterprises a tool they can deploy. Gatekeeping preserves the human accountability that makes review meaningful. But both are responses to the same underlying reality: AI has made code generation cheap and code review expensive. The tools that exist today are better at finding bugs than they are at transferring understanding. And understanding — not bug detection — is what makes a review a review.
What This Means
The code review bottleneck is not a tooling problem that can be fully solved by better tooling. It is a structural mismatch between the volume of code being generated and the human capacity to comprehend it. Anthropic's Code Review can catch bugs that humans miss. It cannot make a human understand what the code does. It cannot transfer responsibility from the AI that wrote it to the person who merged it.
The teams that are managing this best are not the ones that have automated review entirely. They are the ones that have narrowed the scope of what review is for. They review specs instead of diffs. They tier changes by risk and reserve human attention for the decisions where judgment changes the outcome. They accept that some code will ship without line-by-line inspection — and they build the testing and monitoring infrastructure to catch what inspection would have caught.
The alternative is a chain in which AI writes the code, AI reviews the code, and a human clicks approve. That is not a review process. It is a ritual.
Sources: Anthropic Code Review announcement via C114 (March 10, 2026); InfoWorld "Claude Code adds code reviews" (March 10, 2026); The Register "Godot says bye bye AI, bans vibe-coded contributions" (July 1, 2026); Rootly "Nobody wants to review 1,000 lines of AI-generated code" (September 4, 2026); NeuralWired "86% of Companies Let AI Agents Ship Code Without Review" (July 14, 2026); LinearB 2026 Software Engineering Benchmarks Report via IT Brief Australia (June 11, 2026); Codacy "AI Code Review Cost Per Pull Request" (August 28, 2026); DEV Community "The Pull Requests Got Bigger and Nobody's Reading Them Anymore" (September 10, 2026); Tsecurity.de "Nobody Reads Your Code Anymore" (May 23, 2026); New Relic 2026 State of AI Coding via IT Brief Australia (June 11, 2026).
Disclaimer
The information provided in this article is for general informational and educational purposes only. It does not constitute legal, financial, or professional advice. The author and publisher are not responsible for any actions taken based on the content of this article. Readers should consult qualified professionals for advice specific to their situation. All trademarks and references to third-party products, services, or organizations are the property of their respective owners. The performance data and benchmarks discussed are based on specific research studies and may not generalize to all use cases or environments. As of the publication date, the AI landscape continues to evolve rapidly, and readers should verify current information independently.
Limitations
This analysis is based on reporting and public data available as of the article date; figures may be revised as sources update.
Forecasts from third-party analysts can change with market conditions.
Cost and pricing examples are point-in-time estimates; actual rates vary.
Country and company comparisons rely on public reporting, not operational data.
This sector moves fast; timelines and deal terms may be updated later.
Company deals and regulatory rulings may evolve; verify current status.
AI infrastructure is changing quickly; claims can become outdated soon.
Sources
- Anthropic Code Review announcement via C114 (March 10, 2026)
- InfoWorld "Claude Code adds code reviews" (March 10, 2026)
- The Register "Godot says bye bye AI, bans vibe-coded contributions" (July 1, 2026)
- Rootly "Nobody wants to review 1,000 lines of AI-generated code" (September 4, 2026)
- NeuralWired "86% of Companies Let AI Agents Ship Code Without Review" (July 14, 2026)
- LinearB 2026 Software Engineering Benchmarks Report via IT Brief Australia (June 11, 2026)
- Codacy "AI Code Review Cost Per Pull Request" (August 28, 2026)
- DEV Community "The Pull Requests Got Bigger and Nobody's Reading Them Anymore" (September 10, 2026)
- Tsecurity.de "Nobody Reads Your Code Anymore" (May 23, 2026)
- New Relic 2026 State of AI Coding via IT Brief Australia (June 11, 2026).
The information provided in this article is for general informational and educational purposes only. It does not constitute legal, financial, or professional advice. The author and publisher are not responsible for any actions taken based on the content of this article. Readers should consult qualified professionals for advice specific to their situation. All trademarks and references to third-party products, services, or organizations are the property of their respective owners. The performance data and benchmarks discussed are based on specific research studies and may not generalize to all use cases or environments. As of the publication date, the AI landscape continues to evolve rapidly, and readers should verify current information independently.
Limitations: This analysis is based on reporting and public data available as of the article date; figures may be revised as sources update.; Forecasts from third-party analysts can change with market conditions.; Cost and pricing examples are point-in-time estimates; actual rates vary.; Country and company comparisons rely on public reporting, not operational data.; This sector moves fast; timelines and deal terms may be updated later.; Company deals and regulatory rulings may evolve; verify current status.; AI infrastructure is changing quickly; claims can become outdated soon.