Agentic Code Review

By Addy Osmani (2026). Originally published on Substack.

An in-depth analysis of code review in the agentic era: why review is the new bottleneck, blast radius tiering, and capturing agent reasoning.

Core Extraction Summary

1. Named Frameworks & Patterns (Author’s Exact Words)

“Agentic Code Review”: Code review practices adapted to high-volume AI code generation, combining automated constraint gates with focused human evaluation.
“Verification Bottleneck”: The structural imbalance where code generation runs at machine speed while human review runs at human reading speed.
“Blast Radius Triad”: Framework determining review rigor based on 3 variables:
1. Blast radius: What happens when it breaks (zero impact vs revenue/PII damage).
2. Code lifespan: Throwaway prototype vs long-lived core repository.
3. Ownership breadth: Solo engineer holding context vs distributed team sharing ownership.
“Reasoning Capture”: Tooling practice of attaching an agent’s problem-solving trajectory, intent, and decision tradeoffs directly to the pull request.
“Evidence Packet”: Mandatory bundle required for review (diff, automated test outputs, execution logs, screenshot before/after, reviewer sub-agent findings, and explicit risk disclosures).
“Heterogeneous Reviewer Fleet”: Running multiple specialized review agents (e.g., security, architecture, performance) using distinct prompts and models.

2. Decision Rules

When code volume overwhelms human review capacity, tier reviews strictly by blast radius: permit lightweight test-backed merges for zero-user prototypes, but enforce multi-agent evidence-backed review for production systems.
When evaluating an AI-generated pull request, require an evidence packet containing execution proofs rather than relying on the agent’s prose summary.
When managing senior engineering bandwidth, measure and protect human review capacity, because cutting review time simply converts short-term velocity into long-term production incidents.

3. Anti-Patterns & Failure Mechanisms

“Summary substitution”: A reviewer reading the agent’s self-generated PR description instead of examining the code diff and execution evidence.
“Universal review dogma”: Imposing heavyweight multi-gate enterprise review on throwaway prototypes, or applying “tests pass, ship it” to core payment infrastructure.
“Zero-review normalization”: Teams quietly allowing PRs to merge unreviewed because human reviewers cannot keep pace with agent generation volume.

4. Quantitative Claims & Qualifiers

Faros AI telemetry (22,000 developers, March 2026): PRs merged with zero review increased by +31.3%; median review duration jumped +441.5%.
GitClear (2025): 4x raw code output yields only ~12% net productivity gain due to the downstream review bottleneck.
GitHub Copilot review telemetry: over 60 million automated reviews completed (>10x year-over-year increase); >20% of GitHub reviews now involve an agent.

5. What the Source Does NOT Claim

Does NOT claim that AI code review tools eliminate the need for human sign-off on production code; explicitly states “a human still has to own the merge verdict.”

Full Text

Coding agents are extraordinarily good now, and getting better fast. The interesting consequence is that the hard part of engineering moved from writing code to deciding whether to trust it, which makes review the most leveraged skill in software right now.

Code review used to work because of a happy accident of relative speed. A senior engineer could read code faster than a junior could write it. That fact no longer holds. An agent will produce a thousand lines of solid, well-formatted code in less time than it takes to read a paragraph, while human reading speed has not changed. The bottleneck moved downstream to verification.

What the 2026 Data Actually Shows

The productivity gains from AI are real, but raw output overstates them: about four times the code for a tenth more delivered value. The gap between those numbers is review work.

Faros AI (March 2026, 22,000 devs, 4,000 teams): churn +861%, incidents-to-PR +242.7%, defect rate 9% -> 54%, review duration +441.5%, zero-review PRs +31.3%.
CodeRabbit (Dec 2025, 470 PRs): AI-written code carried 1.7x more issues.
GitClear (2025): 4x raw output vs 12% real productivity gain.
GitHub: >60M Copilot reviews completed, >1 in 5 reviews involves an agent.

Everyone Is Solving a Different Problem

How much review a change needs depends on three variables:

Blast radius: Low stakes (prototype) vs High stakes (payments, auth, PII).
How long code lives: Throwaway vs multi-year codebase.
Ownership breadth: Solo developer vs multi-person team.

What Review Is Actually For Now

Review was built to check author reasoning. An agent does reason, but that reasoning is usually thrown away rather than attached to the code. Capturing reasoning in the PR makes review dramatically easier.

Writing Got Cheap, Understanding Didn’t

Writing code is increasingly solved and getting cheaper by the month; the durable advantage is the system that lets you trust what was written. Or, as Simon Willison puts it: your job is to deliver code you have proven to work.