Agentic Code Review: When AI Checks AI and the Human Decides

When an AI agent writes most of the code, the obvious next question is who reviews it — and increasingly the answer is another AI agent. Agentic code review has moved from experiment to default tooling in barely a year, with GitHub, Cursor, CodeRabbit, Greptile and Qodo all shipping reviewers that read a pull request, gather context across the repository, and post findings. But every serious implementation keeps one rule fixed: the AI surfaces, the human decides.

This piece looks at what agentic review actually does, why "AI checking AI" works at all, and where it still fails.

What makes a reviewer "agentic"

Traditional automated review was deterministic and diff-local: a linter or static analyzer pattern-matches a changeset and reports. An agentic reviewer is an LLM that actively gathers context — calling tools to read surrounding files, directory structure, git history and the dependency graph — then reasons about the diff and, increasingly, proposes or applies fixes.

The leading tools pair LLM reasoning with deterministic engines to stay grounded. GitHub's Copilot code review, which reached general availability in April 2025, was rearchitected to combine LLM reasoning with engines like ESLint and CodeQL plus agentic tool-calling for full project context. Cursor's Bugbot rebuilt itself from a fixed pipeline into a fully agentic architecture in late 2025 and added "Autofix" in February 2026, which spins up an autonomous cloud agent in an isolated VM to test and patch. CodeRabbit runs over 40 linters and security scanners alongside its LLM. Greptile takes the context problem head-on by indexing the entire codebase into a semantic graph before review, tracing cross-file dependencies rather than reading the diff alone.

Why AI can usefully check AI

The mechanism is context independence. Anthropic's Claude Code guidance recommends running review in a separate session or subagent, with the explicit rationale that "a fresh context improves code review since Claude won't be biased toward code it just wrote." A reviewer that sees only the diff and the acceptance criteria is not anchored to the reasoning that produced the code, so it evaluates the result on its own terms.

There is also a workload argument. Anthropic has stated publicly that code review became a bottleneck as AI authorship surged — the company reports Claude now writes around 80% of its own production code (an Anthropic claim about its internal practice, not an industry metric). When generation accelerates, review becomes the constraint, and an AI reviewer layer is the natural relief valve. CodeRabbit's December 2025 study of 470 pull requests, finding AI-authored PRs carried about 10.83 issues each versus 6.45 for human PRs, is the empirical case for putting a reviewer in front of AI-written code specifically.

The accuracy-versus-noise tradeoff

The hard truth of agentic review is that catching more bugs means surfacing more false alarms. In a comparative benchmark published by Graphite, Greptile caught around 82% of seeded bugs but generated about 11 false positives per run, while CodeRabbit caught around 44% with only about 2 false positives. Graphite positions its own Diamond reviewer at the low-noise end, claiming a sub-3% false-positive rate and a 96% positive-feedback rate on comments — figures worth reading as vendor self-reports rather than independent results.

The point stands regardless of which numbers you trust: a reviewer tuned to miss nothing will cry wolf, and a reviewer tuned for quiet will let bugs through. Teams choose where on that curve they want to sit.

Where it still fails — and why humans decide

Anthropic names the subtlest failure directly: a reviewer "prompted to find gaps will usually report some, even when the work is sound," and "chasing every finding leads to over-engineering." This is the sycophancy problem — an agent asked to criticize will manufacture criticism. Add context-window limits, which is exactly why Greptile and Qodo pre-index whole repositories, and the deepest gap of all: AI reviewers struggle with architectural and business-logic bugs, because those require knowing what the software is supposed to do, not just what it does.

That is why the human gate is universal and explicit. Anthropic's review agents "will not approve any pull requests — that's still the human engineer's call." The model is a tireless first-pass reader; merge authority stays with a person who can weigh a finding against intent.

FAQ

Does agentic review replace human reviewers? No. It replaces the first pass — the mechanical scan for known issue patterns and obvious defects — freeing humans to judge architecture, intent, and tradeoffs. The merge decision remains human.

Why not just trust the AI reviewer if it catches more bugs? Because catch rate buys false positives, and because AI reviewers reliably miss business-logic and architectural problems. A human is needed both to triage the noise and to catch what the model cannot see.

What is the "fresh context" principle? The idea that a reviewer in a separate session, unbiased by the reasoning that wrote the code, evaluates it more objectively. It is Anthropic's stated reason that AI can usefully review AI at all.

Are the vendor accuracy numbers reliable? Treat resolution-rate and false-positive claims from vendors as marketing until verified independently. The one cross-tool comparison cited here was itself published by a competitor, so read even that as directional.

Bottom line

Agentic code review works because a fresh-context agent judges code without authorship bias, and it earns its place as AI writes more of the codebase. But it lives on an accuracy-versus-noise curve, manufactures findings when over-prompted, and misses the architectural and business-logic bugs that matter most. The durable pattern is AI as the relentless first reader and a human as the one who approves the merge.

Sources and further reading