Source-linked AI summary
The End of Code Review: Coding Agents Supersede Human Inspection
Martin Monperrus
TL;DR
Code review has costs in developer time, feedback latency, and social friction. The paper synthesizes capability evidence to argue that agents can meet review goals and that mandatory human review is an unstable hybrid. It concludes that agents already review routine changes, with the extension to broader software development still an open question.
Problem
Human code review consumes substantial developer time, can delay actionable feedback for days, and generates social friction.
Source: §I · p. 1Method
The paper synthesizes existing capability evidence and argues that coding agents can satisfy established review goals while examining implications for practice, tooling, and research.
Source: §I · p. 1Results
The paper argues that agents can meet every stated code-review goal at lower cost and higher throughput, and that mandatory human review is an unstable delivery bottleneck.
Source: §I · p. 1Takeaways & Limitations
The transition is underway for routine changes, while extending agent review to the full breadth of software development remains an open question.
Source: §VII · p. 6Agent-generated explanations risk reducing informal, bidirectional knowledge-sharing conversations, so organizations will need complementary pair programming and structured mentorship.
Source: A. Implications for Software… · p. 4
Abstract
from arXiv · showhide
Code review has been the primary quality gate in software development since Fagan formalised code inspection in 1976. For five decades, having a human examine and comment on a colleague's changes before merge has been a cornerstone practice at organisations of every size. Coding agents are large language model (LLM)-based autonomous systems capable of reading, writing, testing, and repairing software. We argue that coding agents have crossed a threshold of capability at which traditional human code review is no longer a necessary component of a software quality pipeline. Our argument rests on two claims: every stated goal of code review can be served by agents at lower cost and higher throughput; the naive integration in which agents write code and humans remain the mandatory reviewers is a dead end because it neither provides meaningful assurance nor scales with AI-assisted throughput.
I. INTRODUCTION
Code review serves several quality and team goals, but consumes substantial time, delays feedback, and can create social friction. The paper argues that agents can meet review goals at lower cost and higher throughput, making mandatory human review an unstable bottleneck.
I. INTRODUCTION
- Developers at large organisations spend 10–15% of working hours reviewing others’ code, while actionable feedback often takes more than 24 hours and can take days.The paper also identifies social friction, including tone escalations, seniority bias, and first-time contributors abandoning projects after critical feedback,.Source: §I · p. 1
- Coding agents can read and modify files, run tests, interpret compiler output, and iteratively repair failures without human direction [6]–.On SWE-bench, the paper reports that state-of-the-art agents resolve more than 80% of tasks [10]; review agents also produce inline defect comments comparable in quality to trained human reviewers,.Source: §I · p. 1
- Coding agents are argued to meet all four review goals—defect detection, style enforcement, knowledge transfer, and team awareness—at lower cost and higher throughput.The paper synthesizes existing capability evidence rather than presenting a new empirical study.Source: §I · p. 1
- The proposed hybrid of AI code generation and mandatory human review is described as unstable because review capacity becomes the next delivery bottleneck.The paper also argues that this arrangement creates an appearance of assurance without meaningful assurance.Source: §I · p. 1
- Mandatory human inspection is said to have a negative cost-benefit balance as agent reviews become instantaneous, consistent, and auditable while human review's marginal defect-detection value shrinks.The authors attribute the shrinking value to growing agent capabilities.Source: §I · p. 1
II. BACKGROUND
Code review developed into a formal, structured inspection practice, but research finds its reliable value is not limited to defect detection. The paper’s argument map connects review goals to its claims, conclusion, and practical implications.
A. Code Review: History and Practice
- Fagan’s 1976 inspection process comprised planning, overview, preparation, inspection, rework, and follow-up, and could require up to 3% of total project effort.Source: A. Code Review: History and Practice · p. 1
- Review comments often focus on style, minor improvements, and questions about intent; studies also identify knowledge transfer and maintainability as key value, rather than deep logic-bug detection,.Knowledge transfer and socialisation recur as valued outcomes,.Source: A. Code Review: History and Practice · pp. 1–2
- The argument map links review goals to three claims, then to the conclusion and four implications for practice and tooling.Source: Figure 1 · p. 2
B. Automated Code Review
Earlier automated review systems handled isolated tasks, while LLM-era systems expanded toward comment generation, repair, and collaborative review. This paper argues for displacing the mandatory human review gate and defines coding agents as tool-using systems that iterate on software tasks.
B. Automated Code Review
- Earlier automated review systems used pattern matching, rule-based checkers, and classifiers to automate isolated activities such as comment prediction and defect detection.Source: B. Automated Code Review · p. 2
- LLM review systems expanded from comment generation and severity classification to refined-patch production and multi-agent review, but retained human-governed workflows, –[17].The paper describes its proposed displacement of mandatory human review as a departure from these systems.Source: B. Automated Code Review · p. 2
- The paper claims, to its knowledge, to be the first to argue for complete displacement of mandatory human code review by coding agents and discuss its implications.Source: B. Automated Code Review · p. 2
C. Coding Agents
- A coding agent embeds an LLM in a tool-using loop for file operations, commands, tests, and documentation queries, iterating until a goal or stopping condition is reached.The model supplies language understanding, code synthesis, and contextual reasoning; the tool loop grounds it in the software artefact and its execution.Source: C. Coding Agents · p. 2
III. EVIDENCE OF AGENT CAPABILITY
The paper surveys benchmark performance, review-specific capabilities, and developer productivity as evidence relevant to agent capability. Its benchmark account reports a steep rise in issue-resolution rates, alongside evidence that agents can perform review-related tasks and other software-engineering work.
III. EVIDENCE OF AGENT CAPABILITY
- The evidence survey covers software-engineering benchmarks, review-specific capabilities, and developer productivity with deployed tools.SWE-bench tasks involve real, unmodified issues from open-source Python projects and require repository navigation, file changes, and patches that pass existing tests.Source: §III · p. 2, A. Benchmark Performance · p. 2
A. Benchmark Performance
- SWE-bench resolution rose from approximately 1.7% for GPT-4 with retrieval-based context selection to more than 70% for top public-leaderboard agents by late 2025.Intermediate milestones were approximately 12.5% for SWE-agent and over 50% on SWE-bench Verified by late 2024.Source: A. Benchmark Performance · p. 3
- Adjacent evidence reports that LLM-based repair outperforms earlier generate-and-validate systems like GenProg,, while AlphaCode ranked within the top 54% of human Codeforces participants.Source: A. Benchmark Performance · p. 3
B. Review-Specific Capabilities
The paper argues that coding agents can meet code review’s goals while exceeding human reviewers in context, repair capacity, and continuous availability. Review-specific studies report defect findings and inline comments comparable to trained human reviewers.
B. Review-Specific Capabilities
- Review systems identify correctness, security, performance, and style defects, while CodeReviewer produces actionable comments comparable to trained reviewers on a significant fraction of evaluations, [11].Industrial evaluations report that agents detect the same categories of defects targeted by human reviewers.Source: B. Review-Specific Capabilities · p. 3
- Agents can inspect full files, tests, history, and documentation, then fix issues and run tests without human scheduling.Their continuous operation contrasts with reviewers’ finite attention and availability.Source: B. Review-Specific Capabilities · p. 3
A. Claim 1: Every goal of code review can be served by agents at lower cost and higher throughput.
- The paper argues agents meet all four review goals—defect detection, standards enforcement, knowledge transfer, and team awareness—at least as well as human reviewers.It claims several dimensions are markedly better, at lower cost and higher throughput.Source: A. Claim 1: Every goal of code review… · p. 3
- Agents can perform exhaustive dataflow reasoning, cross-reference test suites, and apply patterns learned from open-source repositories to detect defects.LLM-based review systems produce actionable reports comparable in quality to trained human reviewers and can run on every commit,.Source: A. Claim 1: Every goal of code review… · p. 3
- Agents extend automated style checks to semantic conventions, including naming consistency, idiomatic API usage, and documentation practices.The passage argues this can eliminate a category of reviewer comments.Source: A. Claim 1: Every goal of code review… · p. 3
- AI-based security scanners outperform many manual reviewers on standard vulnerability benchmarks, despite code-generation systems introducing CWE violations at non-trivial rates, [26].The passage argues that generation capability can be redirected toward systematic vulnerability detection.Source: A. Claim 1: Every goal of code review… · p. 3
- Agents can generate on-demand explanations, architectural summaries, and updated documentation at merge time to propagate knowledge.The passage presents this as more reliable and scalable than incidental comments from a busy colleague.Source: A. Claim 1: Every goal of code review… · p. 3
B. Claim 2: The naive integration—AI coding with human
The paper argues that agent-written code with mandatory human review is a dead end: human inspection provides no genuine assurance and cannot scale with AI-assisted throughput. It proposes independent agent review, with human involvement reserved for uncertainty or explicit risk thresholds.
B. Claim 2: The naive integration—AI coding with human
- Human reviewers are poorly positioned to catch subtle semantic errors in agent-generated code, making approvals based on plausible code or passing tests a potential rubber-stamp.The passage says genuine scrutiny is cognitively costly and that the resulting assurance is illusory.Source: B. Claim 2: The naive integration—AI… · p. 3
- Mandatory human review does not scale with AI-assisted throughput, so review queues grow and scrutiny degrades into a time-pressured formality.The passage argues that retaining this gate discards both the productivity benefit of AI coding and the quality benefit of genuine review.Source: B. Claim 2: The naive integration—AI… · p. 4
- The proposed alternative is an independent agent reviewing agent-generated code, with humans intervening for uncertainty or changes crossing an explicit risk threshold.The paper frames the agent-writes, human-mandatory-review arrangement as an unstable endpoint.Source: B. Claim 2: The naive integration—AI… · p. 4
C. Claim 3: The cost-benefit calculation has flipped.
The paper argues that agent reviews have shifted the cost-benefit calculation by reducing the marginal defects left for human reviewers while human review costs remain. It proposes agent-centered workflows and redirected developer expertise, while noting that informal knowledge exchange needs complementary support.
C. Claim 3: The cost-benefit calculation has flipped.
- 10–15% of developers’ working hours go to code review, while review latency delays continuous delivery,,.The paper argues that the justification for these costs weakens as agent coverage grows.Source: C. Claim 3: The cost-benefit… · p. 4
- As agents scan files, tests, and commits with increasing recall, the defects left for human reviewers shrink while human-review costs remain; the paper says the crossover has already occurred.Agent reviews are described as instantaneous, deterministic, auditable, and rerunnable.Source: C. Claim 3: The cost-benefit… · p. 4
A. Implications for Software Engineering Practices
- Pull-request gates can use structured agent sign-off, reserving human approval for high-risk changes, novel architecture, and regulated code paths.The proposal includes test coverage, security scans, style reports, and reasoning traces; it says agent sign-off suffices for most commits.Source: A. Implications for Software… · p. 4
- As line-by-line review diminishes, developers’ expertise shifts toward specifying requirements, orchestrating agents, and exercising system-level judgment.The passage describes intervention when agent reasoning is uncertain or stakes are high.Source: A. Implications for Software… · p. 4
- Agent-generated merge-time explanations may aid knowledge transfer, but pair programming and structured mentorship are proposed to preserve informal exchanges and team cohesion.The passage identifies reduced bidirectional conversation as a genuine risk.Source: A. Implications for Software… · p. 4
- Agent review could address open-source maintainer bandwidth bottlenecks, where contributions wait weeks and projects are abandoned as maintainers run out of review capacity.The passage says it can compress feedback loops and lower barriers for first-time contributors.Source: A. Implications for Software… · p. 4
B. Implications for Tooling
The paper proposes integrating review agents into CI/CD and developer editors, and adapting version-control platforms so agents can act as auditable reviewers. It favors structured reports and records over human-like comment threads.
B. Implications for Tooling
- Review agents can run automatically in CI/CD on pushes, feature-branch commits, or before merge, producing structured reports for dashboards and analytics.The paper frames review as a first-class engineering check analogous to compilation, with versioned, queryable history.Source: B. Implications for Tooling · p. 4
- Editor-embedded agents can surface issues before commit and reduce feedback latency from hours or days to seconds.The interaction is described as natural-language exchange about explanations, alternative implementations, and tradeoffs.Source: B. Implications for Tooling · pp. 4–5
- Version-control platforms need agent identities, audit-log access, and review permissions, with structured UI components for summaries, confidence, findings, and fixes.The passage proposes machine-readable agent review records for downstream analytics.Source: B. Implications for Tooling · p. 5
VI. DISCUSSION
The discussion acknowledges that agents can silently miss out-of-distribution defects and may share security blind spots with the models that generated code. It proposes ensemble review, calibrated uncertainty, and cyberspecialized reviewers as mitigations.
A. Counter-argument: Hallucination and false negatives.
- Out-of-distribution defects may go unflagged, and an LLM may silently approve a change rather than express uncertainty.The proposed mitigations are multiple independent agents requiring consensus and calibrated uncertainty reporting that supports abstention.Source: A. Counter-argument: Hallucination and… · p. 5
- Ensemble review would run independent agents, potentially across models and prompting strategies, and require consensus before sign-off.This is offered as a mitigation for defects outside an LLM’s training distribution.Source: A. Counter-argument: Hallucination and… · p. 5
B. Counter-argument: Security vulnerabilities in agent-generated code.
- Using the same model family to generate and review code risks correlated blind spots, including failure to flag vulnerabilities it tends to produce.The passage proposes cyberspecialized frontier reviewers for security sign-off.Source: B. Counter-argument: Security… · p. 5
- For security sign-off, the proposed mitigation is cyberspecialized frontier reviewers, whose reported vulnerability-identification performance can exceed static analyzers and strong baselines.The passage also recommends reviewers that report calibrated confidence and can abstain rather than always issue binary approval.Source: B. Counter-argument: Security… · p. 5, A. Counter-argument: Hallucination and… · p. 5
C. Counter-argument: Adversarial inputs and prompt injection.
The discussion identifies prompt injection, architectural coherence, and ethical accountability as boundaries or threats for agent review. It distinguishes PR-diff inspection from dedicated architecture and ethics processes, with escalation for uncertain or high-risk changes.
C. Counter-argument: Adversarial inputs and prompt injection.
- A pull request can embed natural-language instructions in comments, identifiers, or string literals to manipulate a reviewing agent.The passage says this attack surface has no fully solved defences and should be treated as a first-class threat.Source: C. Counter-argument: Adversarial… · p. 5
- Agent reviewer prompt injection remains an active threat with no fully solved defences, so organisations must include it in their threat model.Source: C. Counter-argument: Adversarial… · p. 5
D. Counter-argument: Architectural coherence requires human judgment.
- Architectural judgments concern long-term consistency, including duplicate abstractions, accumulated technical debt, and interfaces that constrain future extension.The passage says these judgments depend on an architectural mental model that AI may not yet hold with sufficient fidelity.Source: D. Counter-argument: Architectural… · p. 5
- Design documents, architecture decision records, and dedicated architecture reviews—not per-commit diff inspection—are presented as the appropriate means to enforce architectural coherence.Source: D. Counter-argument: Architectural… · p. 5
- The discussion says human PR reviewers overwhelmingly focus on surface defects and style rather than strategic architectural validity.It uses this distinction to argue that relying on PR review for architectural coherence overstates what human review reliably delivers.Source: D. Counter-argument: Architectural… · p. 5
E. Counter-argument: Ethical accountability requires human judgment.
- Code changes can affect privacy, fairness, and environmental footprint, requiring values-based judgment beyond technical correctness verification.The passage says agents are not reliably equipped to detect such consequences and automated approval can leave an accountability gap.Source: E. Counter-argument: Ethical… · p. 5
- The discussion places ethical scrutiny in requirements engineering and post-deployment monitoring, with human escalation for agent-flagged uncertainty or high risk.Source: E. Counter-argument: Ethical… · p. 5
VII. CONCLUSION
The conclusion argues that agents can meet code review’s stated goals faster and at a scale humans cannot match, while reserving human review for high-stakes oversight. It presents the shift as underway for routine changes, not as an overnight disappearance of review.
VII. CONCLUSION
- The conclusion challenges the long-standing assumption that humans must read colleagues’ code before merge and frames the change as a more productive way to build software.It says code review will not disappear overnight.Source: §VII · p. 6
- Agents can meet every stated goal of code review automatically, faster, and at a scale human review cannot match.The conclusion says this transition is already underway for routine changes, with human oversight at the margins.Source: §VII · p. 6
- Human review is to refocus on high-stakes oversight, including consequential architecture decisions, regulated security-critical paths, and changes whose requirements are unavailable to agents.The passage says the case for mandatory human review has weakened for other changes.Source: §VII · p. 6