The "AI Skips Code Review" Panic Is Real. It's Just Not About the AI.
Every 2026 engineering report says the same thing: coding agents are flooding repos with bigger pull requests that get less review. The DORA report tied AI adoption to a 154% jump in PR size; Cortex found PRs merged with no review up 31%; CodeRabbit found AI-co-authored code carries 1.7× the issues. The narrative is clean: AI writes more, humans review less, quality rots.
We wanted to check the agent-vs-human half of that directly, because it's testable. Coding agents leave a fingerprint — Claude Code stamps Generated with Claude Code / Co-Authored-By: Claude on its commits — so for any repo you can split merged PRs into "agent" and "human" with no guessing, and compare. We pulled 300 merged PRs across 18 repos that actively use Claude Code and ran the numbers. No model in the loop, just the GitHub API.
The result was not what we expected.
What the data says
agentpr — 300 merged PRs across 18 agent-using repos
agent human
median lines changed 39 50
median files touched 1 2
median review comments 0 0
median minutes to merge 0.1 0.1
rubber-stamped 69% 66%
Three things jump out, and two of them contradict the headline:
Agent PRs are not bigger. Median agent PR: 39 lines. Median human PR: 50. At the 90th percentile the humans are far bigger (898 lines vs 470). In these repos, the agent writes smaller PRs than the people do.
The review gap basically doesn't exist. 69% of agent PRs were "rubber-stamped" — zero review comments and merged in under ten minutes. For human PRs: 66%. Within the noise. And it's worse than "low review": 79% of agent PRs and 67% of human PRs were merged in under thirty seconds. The median time-to-merge for both groups is six seconds. These aren't PRs that got a quick skim — they're PRs the author opened and immediately merged themselves.
So the "AI dodges review" story, in these repos, is a red herring. The agent isn't slipping past a review gate that humans clear. There is no gate. Agent and human PRs get the same near-zero review, because the repo self-merges everything.
The agent didn't lower the bar — the bar was already on the floor
This is the honest finding, and it's more useful than the scary version. The repos where coding agents show up most are, overwhelmingly, solo or very-small-team projects — someone building fast, opening a PR, and clicking merge a few seconds later. That workflow has no review whether a human or an agent wrote the code. When you drop an agent into a repo like that, it doesn't introduce a review gap; it inherits the one that was already there.
The 2026 reports aren't wrong — review really is collapsing under AI-accelerated volume. But our slice says the variable that predicts "merged without review" isn't who wrote the PR, it's what the repo's merge culture already was. Blaming the agent is comfortable and slightly misdirected: a team that reviews human PRs carefully will review agent PRs carefully, and a repo that self-merges everything was doing that before the agent arrived.
The honest caveat, stated plainly: our 18 repos skew small and solo — that's how you find agent-heavy repos by searching public GitHub, so the sample is biased toward exactly the low-ceremony projects where nothing gets reviewed. On a large team repo with required reviews, the agent-vs-human gap could look completely different. That's precisely why we made the measurement as a tool you can run on your repo instead of asking you to trust our 18.
agentpr
agentpr --repo your-org/your-service
It pulls a repo's merged PRs, labels each agent or human by the commit trailer, and prints the comparison: median size, files touched, review comments, time-to-merge, and the rubber-stamp rate (zero review comments and merged in under ten minutes). It's deterministic — the label is self-identified, the stats come straight from the API — and --json feeds a dashboard. The whole thing is one dependency-free file; point it at your own org and you'll learn something specific: whether your team actually reviews agent PRs, or whether you've quietly started trusting them more than you trust each other.
One honesty note baked into the tool: because "agent" is self-identified by the trailer, the human bucket may contain a few unlabeled agent PRs — which only makes the two groups look more alike, so it can't manufacture a gap that isn't there. And agentpr leads with the right headline: when both groups are heavily rubber-stamped, it tells you it's a self-merge-culture problem, not an agent problem.
What to actually do
If you came for "ban big AI PRs," the data says aim elsewhere. The lever isn't the author, it's the gate:
- Require at least one review on merge — for everyone. The agent-vs-human distinction dissolves the moment there's an actual gate, because the gate doesn't care who typed the diff.
- Measure your own repos before importing the panic. Run
agentpr; if your agent and human rubber-stamp rates are both high, your problem is process, not AI. - Cap PR size by policy, not by author. The 90th-percentile monster PRs in our sample were human.
The most repeated AI-engineering worry of 2026 turns out, at least in the repos that adopt agents fastest, to be a mirror: the agents merge code without review because we made repos that merge code without review. Fix the gate and the scary chart fixes itself.
agentpr is a single file, no dependencies. → Talk to us if you're putting review gates around agent-written code.
Corpus: 300 merged PRs across 18 public repos with ≥2 Claude-Code-authored PRs (75 agent / 225 human), collected live via the GitHub API 2026-06-20; the record set is included for reproducibility. The sample skews small/solo by construction (that's where agent PRs are easiest to find) — stated as a limitation, not hidden. "Agent" is self-identified by the commit trailer; counts are exact.
Get the tool → agentpr in agent-ops — open source (MIT), a single dependency-free script, part of our toolkit for running coding agents in production.
Found this useful?
Related posts
The boring part: governance that enforces, not displays
Most "AI governance" is a dashboard. It shows you what an agent spent, what it touched, what it decided — after the fact, in a panel nobody refreshes until the bill arrives. A display is not a control. A control is the t…
Your Launch Deserves a Real Demo Video, Not a Screen Recording With Captions
Most product launches skip the demo video entirely, and the ones that don't ship one usually reach for the fastest option: a raw screen recording, maybe some auto-generated captions, posted as-is. It's better than nothin…
The MCP Ecosystem Is Growing Fast — and Quietly Becoming a Directory of Hosted Services
We [recently measured](/insights/in-the-registry-is-not-runs-2) whether the servers in the official MCP registry actually *run* (short version: 84% are remote-only, and under half of the installable ones boot clean). Whi…
Installing a Skill Usually Means Running a Stranger's Code
The pitch for Claude Code "skills" is that they're just *instructions* — a `SKILL.md` file with some markdown telling the agent how to do a task. That framing makes them feel safe to install. A prompt can't hurt you; wor…