Loading…
Topic
Code Review
41 posts about Code Review. Every summary links to the original.
- 41 posts
- 19 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Optimizing a 200,000-line Python codebase overnight with Gemini 4 Argon
Google tested Gemini 4 Argon on google/adk-python, a 205,000-line Python framework with 800 source files and 17,000 unit tests. The model ran unattended for 11 hours, guided by a /goal prompt and .agents/skills rulefiles that encoded maintainer conventions. Argon first wrote a benchmark script, spent 70 minutes measuring before editing code, and proposed six optimizations across 32 files; two shipped after human code review. The shipped changes cut in-memory session prep time by about 40% in long sessions and sped up cold package imports by 21% by filtering events before copying and using lazy module accessors. The other four proposals were rejected for relying on fragile state, private library internals, or synthetic-only gains, illustrating a division of labor where the agent explores and the maintainer subtracts.
Faster Developers Don’t Make a Faster Team
Discovery calls with engineering organizations reveal that widespread use of AI agents has not translated into faster team delivery. Individual developers gain speed, but three structural bottlenecks stall team-level progress. Teams lack shared prompts, rules, and configurations, forcing every agent to start cold and re-explain conventions. Code review processes designed for human-paced change become the new constraint, with some teams measuring increased pull request time. Automating routine work like library upgrades creates its own operational burden, as teams struggle to maintain and distribute automation pipelines across projects. Without shared infrastructure, coordination breaks down and the gap between proficient users and the rest widens.
Our Framework for Reviewing AI-Generated Code
JetBrains Research, in collaboration with Lund University, studied how to review AI-generated code as AI agents produce thousands of lines across multiple files quickly. The core problem identified is trust calibration: developers cannot gauge an LLM’s confidence per line, making line-by-line review unscalable. The study proposes a three-level conceptual framework: overview for high-level hypotheses, file-level risk stratification, and code snippet-level chunk decomposition with chain-of-thought linkage. This framework was developed through participatory design with 17 practitioners and a follow-up survey of 43 professionals, and will be presented at ESEIW 2026. The paper argues that current diff viewers are inadequate for AI-generated code and that tools must surface risk and confidence signals at the granularity where developers allocate attention.
Conversations in the AI Era: Manchester Meetup Recap
Twilio and Ciptex hosted the Conversations in the AI Era meetup in Manchester on September 3rd, 2026, drawing developers, tech leads, and founders from the local scene. Darragh O’Connor demonstrated using a SIP trunk to connect callers directly into a livestream, emphasizing solving the problem with the simplest tool. Matthew Duggan of Ciptex presented an architecture where AI and human agents share conversation state and tools, treating handoff as a change of ownership rather than a recovery path. Paul D’Ambra of PostHog discussed how cheap code generation made reviewing code the bottleneck, leading them to build AI review agents that substantially dropped their revert rate. The next meetup is scheduled for November 4th, 2026.
Responsible AI adoption needs developer workflow design
Responsible AI adoption struggles when organizations rely on static policy documents instead of integrating guardrails directly into engineering workflows. Developers under delivery pressure inevitably turn to unapproved shadow AI when sanctioned routes introduce friction. Stack Overflow survey data reveals that 84% of respondents use or plan to use AI tools, yet more developers distrust AI accuracy than trust it. Operational controls must be embedded inside repositories, build pipelines, and pull request reviews to match specific failure modes like those listed by OWASP. Organizations achieve dependable adoption by pairing automated controls with clear role ownership, psychological safety, role-specific training, and outcome-based engineering metrics.
Why AI-Generated Code Is Easy but Engineering Trust Is Hard
At Salesforce, engineering teams discovered that AI coding agents could produce internally consistent code and passing test suites that still failed to meet actual requirements. To ensure correctness before writing code, the team developed an agentic Spec-Driven Development workflow centered on explicit specifications and gated verification. The system separates evidence-based repository lookups handled by agents from subjective judgment calls escalated to human engineers. Implementation plans must cite repository evidence reviewed by a Skeptic Agent, while a Compliance Matrix traces each success criterion directly to executable test proof. Finally, a multi-agent review system evaluates the implementation under an asymmetric rule allowing an independent judge to downgrade passing checks but never override failed gates.
From PHP to team lead of agents: rethinking judgment, review, and data with Google's Andi Gutmans (Part 1)
Software development is experiencing an architectural shift as artificial intelligence agents transition individual contributors into orchestrators and reviewers of automated workflows. Rather than spending effort on manual coding, developers increasingly focus on defining system architecture, guiding agent execution, and managing operational risk through tiered human and agent review loops. The primary bottleneck for agentic systems lies in preparing organizational data so that agents can effectively reason over enterprise knowledge. To address this challenge, Google published an open knowledge format and is adopting agent-driven semantic ontology generation to infer relationships across messy data estates. This evolution transforms ontology building from manual human toil into automated generation, allowing engineers to focus on high-value data curation and strategic system design.
How we built an automated debugging workflow at Sentry
Sentry automated its internal debugging and issue triage workflows to handle bugs and pull requests generated by AI agents. The company deployed Seer, an AI-powered debugging agent, across several repositories to determine root causes, create fix plans, and open pull requests. To manage the resulting influx of pull requests, Sentry built an automated Slack routine powered by Claude that periodically scans for unaddressed pull requests opened within four hours. The routine asks Seer to identify relevant reviewers using GitHub commit history, verifies pull request status, and tags engineers to request merges, closures, or feedback. Early metrics show a 21 percent increase in pull request action rates, a 13 percent increase in 48-hour response rates, and a 12.5 percent rise in pull requests closed without merging due to duplicate or expanded fixes.
Turn one giant AI-generated pull request to a reviewable stack
Coding agents often consolidate full-stack features into monolithic pull requests spanning thousands of lines, resulting in delayed reviews and lower feedback quality. To resolve this bottleneck, engineers can decompose comprehensive features into ordered, single-concern layers using GitHub stacked pull requests and the gh-stack CLI extension. Distinct specialized agents handle individual branches—ranging from foundational data access modules up to client interfaces—while CI checks continuously evaluate each layer against the stack base. When reviewers request upstream modifications, running gh stack sync executes a cascading rebase across all dependent branches, preserving commit signatures and keeping the entire pull request chain mergeable.
Developers are attached to tools because tools encode trust
Traditional developer tools like Vim, Emacs, and IDEs earn trust through predictability, bounded roles, and muscle memory developed over time. In contrast, agentic coding tools operate across the entire software development lifecycle using ambiguous natural language, rapidly generating vast amounts of code that developers do not inherently trust. This influx shifts development bottlenecks from code authoring to code review, validation, and infrastructure cost management. Tooling additions such as automated code reviewers, context managers, and memory systems cannot repair broken software development lifecycles unless organizations actively adapt their culture and workflows. Teams can establish trust in agentic environments by providing explicit contextual specifications, reusing verified components to avoid duplicate implementations, and restricting non-deterministic artificial intelligence to appropriate problem domains.
Cursor, now on iPad
Cursor is now available on iPad for all paid plans, extending its mobile workflow for creating, reviewing, and merging pull requests. The iPad layout uses the larger display with pinned sidebar chats, split-screen review alongside chat, full-file diffs, and expanded markup that supports screenshot comments and Apple Pencil drawing. On both iPhone and iPad, the review screen covers the full PR, including comments, checks, approvals, reviewer changes, and prompts to an agent to resolve comments. An Inbox organizes active work, attention items, and PRs under review, while additional updates add Bitbucket and Azure DevOps SCM support, multi-PR sessions, and in-app switching between teams.
The cost of saying yes has changed
Generating initial code patches has become significantly cheaper with AI agents, shifting the primary expense of small feature requests from writing code to debating scope in meetings. Teams can use agent-generated patches as diagnostic probes rather than final deliverables, turning abstract scope debates into concrete artifacts that reveal true system touchpoints and risks. However, low generation costs do not translate to low ownership costs, as changes touching areas like authorization, compliance, or public contracts still demand significant human review. Constrained attempts allow engineers to price uncertainty quickly and shift scope discipline from pre-implementation speculation to evidence-based code review.
Better tools made Copilot code review worse. Here’s how we actually improved it.
When migrating GitHub Copilot code review from custom navigation tools to shared Unix-style CLI utilities—grep, glob, and view—benchmarks revealed higher review costs and fewer caught issues. Rather than an issue with the underlying tools, trace analysis showed the agent used general-purpose coding assistant instructions that triggered expansive repository browsing loops. In response, the team rewrote the tool guidance to enforce a review-specific workflow anchored to pull request diffs. The updated instructions direct the agent to narrow candidate call sites and files using batched discovery before reading minimal line ranges with view. This workflow tuning reduced average review costs by approximately 20% in production while maintaining review quality.
The new bottleneck
AI coding tools have significantly lowered the cost of generating software, yet many engineering organizations fail to realize overall delivery speed improvements. Applying the Theory of Constraints reveals that eliminating code production as a bottleneck shifts inventory directly into surrounding legacy processes that remain unadjusted. New friction points consistently emerge across underspecified requirements, prolonged design handoff gates, senior engineer review capacity, and external sign-offs from legal or security. Organizations can address these blockers by interrogating legacy agile ceremonies checkpoint by checkpoint to determine if their original constraints still exist. Practical remedies include adopting real-time co-development between product and engineering, treating initial designs as fluid starting points, and restructuring processes around running rapid, high-volume experiments.
How Dropbox uses MCP and Dash to close the design-to-code security gap
Dropbox developed a system using the Model Context Protocol (MCP) and Dash's semantic search to bridge the gap between security threat models and code implementation. By retrieving original security documents during pull requests, an LLM agent automatically evaluates whether the proposed code adheres to previously agreed-upon security requirements. This approach surfaces design regressions and missing controls that traditional static analysis tools miss.
Bugbot is now over 3x faster, 22% cheaper, and finds 10% more bugs
Bugbot has been updated to run over three times faster, cost 22% less, and find 10% more bugs per review; 90% of runs now finish in under three minutes. The /review command lets users run Bugbot or Security Review before pushing code, while /review-bugbot and /review-security invoke those agents directly. Reviews run through /review sync with Bugbot on GitHub and GitLab, allowing a matching pull-request diff to skip a duplicate review, and Bugbot can now be configured to inspect only changes since its last review. The gains come from harness improvements and training Composer 2.5, which powers Bugbot; organizations opting out of that model use the next best available model, with speed and performance varying by configuration.
Beyond code generation: rethinking engineering productivity in the age of AI agents
Dropbox shares how widespread AI code generation shifts software development bottlenecks downstream into code review, CI infrastructure, and validation pipelines. To adapt, they built Nova, an internal coding agent platform that safely automates scoped tasks such as migrations and flaky test remediation. They also evolved their developer productivity framework to measure end-to-end customer impact and code quality rather than simple pull request throughput.
Outcomes we want to see from AI at Medium Engineering
Medium Engineering defines desired outcomes and anti-goals for adopting AI, emphasizing leverage, learning, technical ambition, rigorous reasoning, fluency, and maintainable code rather than raw output. Engineers are expected to use AI for repetitive refactoring, testing, unfamiliar systems, design exploration, code analysis, and safer cross-stack work while retaining accountability for clarity, correctness, coverage, and judgment. The guidance rejects PR, commit, line, token, and model-spend metrics as success measures, allowing them only as debugging signals. It also warns against blind trust, unreviewable code volume, loss of codebase understanding, security or privacy regressions, misaligned vendors, environmental hand-waving, and performative tool adoption. The stated north star is achieving outcomes that let Medium’s humans move with the responsiveness of a much larger team while staying true to what makes the platform worth building.
AI as the Next Abstraction Layer: How I see engineering evolving at Thumbtack
Thumbtack is transitioning its engineering workflow from ad-hoc tool experimentation to end-to-end agentic software development. Unlike previous deterministic abstractions such as compilers or high-level languages, artificial intelligence introduces non-determinism where identical prompts can produce varying code and trade-offs. Because consumer marketplace experiments still require weeks for behavioral signals to stabilize, accelerated implementation primarily helps teams prepare cleaner experiment designs and parallelize hypotheses within experimentation bandwidth constraints. Consequently, day-to-day engineering responsibilities shift upstream from manual coding toward problem framing, system architecture, validation, and co-designing features with product managers. Teams maintain technical sharpness by rigorously reviewing generated code while accepting that long-term specialization above the abstraction layer will become standard across the organization.
Updates to Bugbot for Teams and Individuals
Bugbot is replacing its $40-per-seat monthly subscription with usage-based billing for Teams and Individual plans. Existing customers move to the new model at the first billing renewal after June 8, 2026; an annual subscription purchased in May 2026, for example, changes in May 2027, while earlier switching is available in the Cursor dashboard. Teams are billed from on-demand spend, Individuals from included usage, and an average run costs $1.00–$1.50 depending on pull request size and complexity. Usage billing also adds configurable effort levels, including deeper reviews and custom logic for selecting effort: the default retains an 80% bug-resolution rate by merge time, while high effort finds 35% more bugs in internal runs with that rate unchanged.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.