AI code review agents in 2026

Coding agents made writing a pull request cheap. Reading one didn't get any cheaper. Teams that adopted AI merge far more pull requests than they used to, and the time those pull requests wait for review has gone up with them. So the industry did the obvious thing: it pointed AI at the review too. In eighteen months, AI code review went from a preview feature to something that runs on most pull requests at Microsoft and Uber, on one in five reviews on GitHub, and inside a $1.5B startup.

We collected the adoption, money, accuracy and security numbers published up to 16 October 2026: vendor disclosures (GitHub, Anthropic, Cursor, CodeRabbit, OpenAI), company engineering blogs (Microsoft, Uber, Atlassian), peer-reviewed and preprint studies, benchmarks, and engineering-analytics data (Faros AI, Jellyfish, LinearB). Vendor numbers are their own claims, and every number links to its source. Most of these sites were blocked from the sandbox we researched in, so each headline number was checked against at least two independent reports; the methodology has the details.

Why review became the bottleneck#

The supply of pull requests jumped. GitHub users merged 43.2 million pull requests a month on average in the year to August 2025, up 23%. By September 2026, our own count found that 25.8% of new public pull requests on GitHub carried a coding agent's signature, up from 6.9% a year earlier. Anthropic says code output per engineer at the company grew 200% in a year, and puts it plainly: "Code review has become a bottleneck, and we hear the same from customers every week."

Telemetry from engineering-analytics companies shows where the extra output goes. Faros AI compared teams with high and low AI adoption across more than 10,000 developers: the high-AI teams completed 21% more tasks and merged 98% more pull requests, but their pull requests were 154% larger and took 91% longer to review. A Harvard job-market paper by Fiona Chen and James Stratton, using Jellyfish data on 725,938 workers at 718 firms, found that after teams adopted coding agents, they wrote about 30% more code and opened 23% more pull requests, review-related time rose 49%, and finished work didn't rise significantly, according to coverage of the paper.

Agent-written pull requests also wait longer. LinearB's 2026 benchmarks, drawn from 8.1 million pull requests, say AI pull requests wait 4.6 times longer before review but are reviewed twice as fast once someone picks them up, and 32.7% are accepted against 84.4% of unassisted ones. Reviewers have reasons to slow down. CodeRabbit's own analysis of 470 open-source pull requests found about 1.7 times as many issues in AI-co-authored ones (10.83 per PR against 6.45). In Stack Overflow's 2025 survey, 46% of developers said they distrust the accuracy of AI output, against 33% who trust it, and in Sonar's January 2026 survey 96% said they don't fully trust AI code to be functionally correct, while only 48% always check it before committing.

How fast AI review spread#

GitHub's reviewer is the default for most teams because it's already in the product they use. GitHub says more than a million developers tried Copilot code review in the month-long preview before general availability in April 2025. By March 2026 it had done 60 million reviews, usage had grown tenfold, and 12,000 organizations ran it automatically on every pull request. Among Jellyfish customers using review agents in 2025, 67% used Copilot and 12% CodeRabbit, and the biggest jump in adoption came the month Copilot's reviewer became generally available.

The independents grew too. CodeRabbit says it runs more than two million reviews a week for over 17,000 customers. Its free reviews on public repositories passed a million in a month for the first time in September 2026, the company says, across more than 300,000 installed public repos. Cursor says Bugbot reviews more than two million pull requests a month. OpenAI says Codex reviews almost every pull request opened inside OpenAI.

Who sells it#

There are three kinds of seller. Platforms bundle a reviewer with what you already pay for: GitHub with Copilot, Cursor with Bugbot, OpenAI with Codex, Anthropic with Claude Code, Google with Gemini Code Assist. Independents (CodeRabbit, Greptile, Qodo, Macroscope, Baz, Cubic) sell review as the product and work across all of them. And companies with enough engineers build their own: Microsoft, Uber, Atlassian, Google, Meta.

The independents raised most of the venture money. CodeRabbit alone has raised $219M across three rounds, and its valuation went up 2.7 times in eleven months. Graphite raised $52M at a $290M valuation in March 2025, and Axios reported that Cursor paid "way over" that nine months later.

What it costs#

Pricing is moving from seats to runs, because an agent can open more pull requests than a person. Cursor moved Bugbot from $40 per user a month to usage-based billing in May 2026, about $1.50 per run on average. GitHub started charging Actions minutes for Copilot reviews on private repositories on 1 June 2026. Anthropic's Code Review is billed by tokens and generally averages $15–25 per review, because it runs several agents for about 20 minutes per pull request.

The difference adds up. For a ten-person team opening 400 pull requests a month, reviewed once each, our arithmetic puts the bill at a few hundred dollars for a per-seat or per-run reviewer and several thousand for the deepest per-token one.

Does anyone act on the comments#

The most useful measure of a reviewer is whether its comments lead to a change in the code. Every study measures it a little differently ("accepted", "resolved", "addressed in the same changeset"), so the numbers below aren't a ranking. They do split cleanly by who did the measuring.

The largest independent study looked at 31,073 CodeRabbit comments in 10,191 pull requests across 239 GitHub repositories. Developers accepted 36.4%, discussed 7.3% and rejected 56.3%, mostly because the suggestion was a false positive, redundant or out of scope. At Mozilla and Ubisoft, reviewers accepted 8.1% and 7.2% of a research tool's generated comments; refactoring suggestions did far better (about 18%) than comments about functionality (about 5%).

The makers' numbers are higher, and they also show what the right baseline is. Human review comments aren't acted on every time either. Atlassian's peer-reviewed study of its RovoDev reviewer, across 54,000 comments in 1,900 repositories, found 38.7% of AI comments led to a code change against 44.5% of human ones, and median pull-request cycle time fell 30.8%, from 20.7 to 14.4 hours. Uber says 65% of uReview's comments are addressed in the same change, against 51% of human-written comments, though the two were measured differently. Anthropic says its engineers mark fewer than 1% of findings incorrect, and that the share of its pull requests getting substantive review comments went from 16% to 54%.

Faster isn't guaranteed. At the appliance maker Beko, an AI reviewer's comments were labelled resolved 73.8% of the time, but pull requests took longer to close. In a controlled experiment with 29 professional developers, 89% of the issues an LLM flagged ended up in the humans' reviews, attention clustered on the lines the model pointed at, and the humans found no more high-severity issues and saved no time.

Benchmarks: every vendor wins its own#

Greptile's benchmark seeds 50 real bugs from five open-source repositories and asks which reviewers catch them. Greptile catches the most. False positives don't count against a tool, so a noisy reviewer can score well.

GitHub's ReviewBench, built with Microsoft and published in October 2026, puts Copilot first at 40.1% grounded F1 on 219 pull requests. GitHub ran its competitors' public versions itself, and they didn't verify their entries. Martian's independent leaderboard, which counts a comment as correct when the developer then changed the code, had Cubic first at 64.9% F1 on 6 October and Copilot fourth. At least five vendors have announced they were first on Martian's board, on different dates and metrics.

Academic benchmarks score the models rather than the products, and they're humbling. On SWE-PRBench, eight frontier models found only 15–31% of the issues human reviewers had flagged in 350 pull requests when given just the diff.

The reviewer is an attack surface#

A review bot reads untrusted input (anyone's pull request) and usually holds write access to the repository. That combination has already been exploited. In January 2025, researchers at Kudelski Security opened a pull request with a configuration file that made CodeRabbit load their code, got remote code execution on its production servers, and read its GitHub App private key, which could act on any repository where the app was installed. CodeRabbit fixed it within hours and says no customer data was accessed.

Prompt injection is the newer problem. Any GitHub user who can open a pull request or an issue controls text the review agent reads. Researchers have used that text to make review agents leak secrets, and in Ghostcommit they hid instructions where the reviewer doesn't look, so it approved what a later agent would act on.

What this means if you ship with AI#

1. Turn it on, then measure what gets acted on. Comment counts flatter every tool. Track the share of AI comments that lead to a code change, and compare it with your human reviewers' rate; at Atlassian and Uber the two were close.
2. Tune for precision. Most rejected comments are false positives, duplicates or out of scope. Limit the bot to bugs and security, turn style comments off, and run it when a pull request is ready rather than on every push.
3. Keep a human approval. AI review is a first pass, not a sign-off. Anthropic's reviewer doesn't approve pull requests, and in the one controlled experiment humans followed the model's attention rather than adding to it.
4. Make pull requests smaller. Anthropic's reviewer found issues in 84% of pull requests over 1,000 lines and 31% of those under 50. Agent-written pull requests are getting bigger; split them before anyone reviews them.
5. Treat the reviewer as privileged code. Give the app the narrowest repository permissions, never run repository-supplied config outside a sandbox, and assume pull-request text is hostile.
6. Price per review, not per seat. When agents open the pull requests, seats stop being the right unit. A deep per-token reviewer on every push can cost more than the developer seats it serves.

Not everything an agent builds needs a pull request. For the small tools, reports and pages people make for their own team, we built host0: a private link only invited colleagues can open, with one-click restore when a new version is wrong.

Methodology#

We gathered these numbers on 16 October 2026 with three parallel research passes: products and money, effectiveness and failure modes, and adoption and the review bottleneck. The network we researched from blocked most primary sites (github.blog, coderabbit.ai, cursor.com, uber.com, arxiv.org, faros.ai, linearb.io, jellyfish.co), so for each headline number we required the primary page's own text in search results plus an independent report, or two independent reports that agree. Anthropic's post was read directly. Eighteen headline numbers were re-checked with fresh searches before writing.

• Vendor numbers (reviews run, customers, resolution rates, benchmark wins) are the companies' own claims. Cursor's resolution rate is judged by an LLM.
• Field studies measure different things: accepted by the reviewer (Mozilla, Ubisoft, CodeRabbit study), led to a code change (Atlassian, Jellyfish), addressed in the same change (Uber), resolved by merge (Cursor). Uber's AI and human rates were measured by different methods.
• Faros AI and Chen & Stratton are correlational or quasi-experimental studies of analytics data; we read them through published coverage. Write-ups differ on whether Chen and Stratton's 49% is review time or time to merge.
• Costs are our arithmetic on list prices for one illustrative team.
• The agent-signature share of GitHub pull requests is our own count from the State of AI coding agents 2026 post.

The full data pack, with tiers, the spot-check log and a do-not-cite list, is in our repository at docs/research/2026-10-16-ai-code-review-agents.md.

Open questions#

• Bugs that reach production. No public study compares production defects with and without AI review. Every metric here is a proxy: a comment acted on, a pull request merged, a cycle time.
• A fair leaderboard. No independent benchmark scores Copilot, CodeRabbit, Bugbot, Claude Code Review and Codex on the same pull requests on the same day.
• Review depth over time. Only one small experiment asks whether people review less carefully once a bot reviews first.
• AI reviewing AI. A growing share of pull requests is written by one agent and reviewed by another. Nobody has published how often both miss the same bug.