Pangram verdict · v3.3
We believe that this text is a mix of AI and human-written content.
AI likelihood · overall
MixedArticle text · 1,311 words · 11 segments analyzed
Automated Software Verification in the Age of AI Coding Agents We are living in peak AI, with more and more developers shipping code without actually writing (or sometimes reviewing) it themselves. According to a 2026 study by Faros, which analyzed two years of telemetry from 22,000 developers across 4,000 teams, engineering throughput is increasing, while bugs, rework, review load, and production incidents are rising even faster in organizations with high AI adoption.
The numbers are striking: Faros reported 54% more bugs per developer, a roughly fivefold increase in median PR review time, and more than three times as many incidents per PR when comparing periods of lower and higher AI adoption. These are correlations, not proof that AI caused every one of those outcomes. A subsequent Q3 report also found that some of the earlier effects were easing, while verification, remediation, and operational costs continued to pile up downstream.
We need to slow down enough to understand, and improve, what we are doing here. One cannot expect a small team to meaningfully review enormous AI-generated diffs. At the speed at which AI can now push out code, even ordinary review practices are struggling to keep up. So how do we preserve the speed of AI-assisted development without sacrificing software quality, reliability, and maintainability? Simple: automated software verification. With the same clever tools, skills, and harnesses we use as AI engineers to push code at breakneck speed, we can build elaborate testing and verification automations. Automated software verification that builds justified trust and confidence is the way forward. Not because any system can guarantee bug-free software, but because we need more ways to catch problems before they reach users. What’s available right now? There are a few concepts circling around at the moment. Superpowers One concept that has caught on is Superpowers, an agentic development methodology and collection of skills that works with coding agents and supported harnesses. It encourages your agent to behave more like a disciplined software engineer instead of immediately jumping into code. For example, it can help refine what is actually being built instead of just assuming things. It emphasizes planning, test-driven development, debugging, and reviews, including having separate agents review the work. This is a great start.
However, depending on the task, following the whole methodology can slow down development, and it still doesn’t replace the broader checks needed to gain confidence in our code’s correctness and security. No plugin alone makes software bug-free or vulnerability-free. RoboRev Another interesting framework, RoboRev, comes from Wes McKinney, the developer behind the widely used pandas library. RoboRev brings continuous AI code review into the local development loop. The idea is compelling: just like in-person peer reviews, we can have another LLM review code that our first LLM wrote. Having a separate reviewer, potentially using a different model, may catch mistakes or architectural problems that the authoring agent missed. It is another perspective, though not a guarantee of an unbiased or correct review. In a typical RoboRev setup, you commit your code and a local daemon automatically reviews the commit using a configured coding agent. It surfaces findings that you can feed back into your current LLM and coding harness, fixing issues while the context is still fresh. RoboRev also supports follow-up review workflows and targeted review tasks. The appeal is that verification becomes part of the coding loop, not something you remember to do at the very end. Its documentation covers the available commands and integrations.
But the concept of code review is not new. In 2026, providers such as Claude, Codex, GitHub Copilot, Cursor, Greptile, CodeRabbit, and Qodo offer AI-assisted code reviews.
Explaining all of them would put even the most terminally online engineer to sleep, so instead let us focus on the main ones. Claude Code Review Anthropic’s hosted Code Review is a heavy-duty PR reviewer. When triggered on a GitHub pull request, it sends multiple specialized agents to investigate changes in parallel and look for logic errors, security vulnerabilities, regressions, and missed edge cases, among other things. The goal is a deeper review that may take more time and cost more than a quick local pass. As of October 2026, Anthropic lists this hosted service as a research preview for Team and Enterprise plans, with separate usage-based billing. There is also an Anthropic-maintained /code-review plugin for Claude Code. It runs a review from your coding workflow and can post findings to a PR. It is a different workflow from the hosted review service, so I wouldn’t treat them as identical in depth, setup, or pricing. Check your plan and usage terms before assuming the review is included. OpenAI Codex Review Codex code review takes a similar approach to reviewing pull requests against the repository’s context and instructions. You can request a review with @codex review on a connected GitHub PR or configure automatic reviews. Codex also supports reviewing local changes before a PR exists. You can be more descriptive about what you want checked: a diff, a PR, security concerns, or compliance with the specification. If the review finds a problem, you can ask Codex to prepare a fix, inspect the resulting change, and repeat the review. That gives you a useful review-and-repair loop, although review and implementation still need independent verification. GitHub Copilot Code Review GitHub has one of the simplest, most hands-free approaches. You can configure Copilot Code Review to automatically review PRs, follow repository instructions, and suggest fixes that can be applied or passed to the Copilot coding agent. As seamless as it is, it introduces problems if you start blindly accepting its feedback. Copilot normally leaves comments rather than an approving review, though GitHub supports configuring approvals in some setups. Either way, automated review is not the same as a safe merge decision. A tradeoff is that the review experience is more managed than a DIY agent workflow: you can customize its instructions, but you don’t have the same direct, per-run model configuration you get when invoking your own coding agent.
Cursor Bugbot Cursor Bugbot automatically reviews GitHub PRs, looking for logic bugs and other problems, and lets you act on the findings in Cursor. Its Autofix feature can also propose fixes through cloud agents. Its biggest advantage is convenience for teams already using Cursor. The tradeoff is that much of the model selection and review orchestration is handled by Cursor rather than exposed as a fully customizable workflow. Cursor says it uses a combination of frontier and in-house models. One reviewer isn’t enough I like having a strong coding model write the code and a separate strong model review it.
Different models can bring different perspectives, but model diversity isn’t magic: two agents can agree on the same wrong answer, overlook the same requirement, or confidently flag a bug that doesn’t exist. The practical takeaway is to combine AI review with checks that don’t rely on an LLM’s judgment. And ideally, keep a human accountable for the final decision, especially on high-risk changes.
Okay, so we can review code. But there is much more we can do to increase our confidence that the code meets spec, doesn’t introduce bugs or vulnerabilities, and doesn’t accidentally expose secrets. That’s what we talk about next. The CI/CD pipeline in the age of AI and automated software development Here is a comprehensive verification pipeline, built as a superset of what is possible.
Each step can add confidence that the code works as intended, though not all teams will need every check, and no set of checks can prove software is perfect. The broader philosophy is well established in software engineering and aligns with frameworks such as NIST’s Secure Software Development Framework.
Not a fan of walls of text? There’s a diagram of the whole pipeline at the end of this section. Code quality & build checks Linter checks: Check code for style violations and common mistakes.