AI code review

Kernel developer Greg Kroah-Hartman, maintainer of the Linux kernel stable branch, has given a talk examining what large language models mean for software security. The presentation looks at how AI-generated code and AI-assisted development affect vulnerability handling, patching, and trust in open-source infrastructure, drawing on his long experience reviewing kernel patches. Discussion around the talk centers on whether LLMs introduce more security risk or simply new versions of familiar code-review problems.

System76 has announced that its COSMIC desktop projects will no longer accept code submissions containing LLM-generated content. The Linux hardware and software developer says contributions must be written without AI assistance. The move reflects a growing frustration among open source maintainers, who argue that machine-generated code adds review burden and quality problems while contributors submit pull requests that are difficult to verify or maintain.

OpenAI has made its automatic code review feature free for all Codex users. The tool reviews code changes automatically, giving developers feedback without a paid tier. The move is being discussed as a way to pull more developers into OpenAI's coding ecosystem at a time when automated code review and AI coding assistants are a highly competitive market.

Orbi, an AI coding agent, reportedly takes a GitHub issue and returns a reviewed, merged pull request, with one agent writing the fix and another handling review. A follow-up post examining the system's harness asks what its reviewer missed, suggesting developers are scrutinising how reliable the automated pipeline is. The discussion is drawing interest from the open-source and AI engineering communities.

System76, the company behind the Pop!_OS Linux distribution, has banned AI-generated code across many of its COSMIC codebases, the desktop environment underpinning the operating system. The decision bars contributions written by AI tools from large parts of the project, with developers expected to write and review code themselves. The move is drawing attention and debate among open-source developers weighing code quality, licensing and trust issues around AI-assisted programming.

GitHub has introduced ReviewBench, an open benchmark for measuring how well AI models perform code review. The benchmark is intended to give developers and researchers a standard, reproducible way to compare the quality of AI-generated code review feedback, as AI assistants are increasingly used in real software development workflows.

A new tutorial walks developers through creating their first 'agent skill' — a set of house rules that tells an AI coding assistant how the team works, from commit message formatting to what a code review must include. The guide is aimed at developers integrating AI agents into everyday software workflows and is being shared in programming and productivity communities.

Engineer Alexey Indeev has written that he no longer reviews code produced by his AI agents, and describes the alternative workflow he uses instead in a Substack essay. The piece has drawn modest attention on Hacker News, where developers are weighing whether traditional code review still makes sense as more work is delegated to autonomous coding agents.

A new project called oh-my-agent has been presented on the German Ubuntu users forum, describing how existing code agents can be used to carry out automated project reviews. The thread, published under the Linux and open source sections, explains how developers can apply the tooling to check their current codebases. Responses so far appear limited, with the discussion still in an early stage.

Former OpenAI researcher Andrej Karpathy argued on X that as AI writes more of the code, the programmer's job shifts from typing to reviewing and supervising the machine's output. The remark is circulating among developers, many of whom see it as a fair description of how AI coding tools are already changing day-to-day software engineering and what skills will matter next.

A discussion circulating among developers examines what happens when you prompt an AI coding assistant to write a service that processes bulk user telemetry, validates incoming records and handles batch publishing. The code arrives within seconds and looks clean, but the point being raised is that polished syntax and modern structure can mask problems in how the service actually behaves, encouraging engineers to look beyond surface quality when reviewing machine-generated code.

OpenAI's Codex, the company's AI coding agent built on its GPT models, is generating renewed discussion as developers and tech commentators weigh it against ChatGPT. The conversation centres on how the two tools fit together: ChatGPT as the general assistant and Codex as a specialised tool for writing and reviewing code inside developers' workflows.

Researchers at ThreatDown have analyzed the new Carbonato botnet, which compromises poorly secured Docker hosts. The malware targets systems where the Docker API is exposed without authentication on port 2375, taking over containers and using AI-generated code in its operations. Security teams are being urged to lock down exposed Docker APIs and review firewall rules to prevent infections.

Heise is hosting a live webinar on developing, deploying and reviewing software with AI coding agents in Xcode. The session covers Claude Code, GitHub Copilot and OpenAI Codex, with a focus on using the tools without compromising security or data privacy. The announcement is circulating among developers interested in AI-assisted programming workflows.

A developer is offering a paid human second-pass review of AI-generated pull requests, and says they reviewed three AI-written PRs from public repositories before pitching the service, which they call Riven Desk. The idea taps into growing concern that AI-written code is being merged without careful human scrutiny. Commenters in programming and engineering communities appear engaged with the question of how much review AI code actually needs.

A software developer describes an AI coding agent that publicly identified and corrected an error in its own fix, with two other agents then reviewing and validating the correction. The account, shared in a developer community under tags like AI, agents and programming, highlights the emerging practice of multi-agent workflows where one AI's output is checked by others before being accepted.

A newly shared engineering write-up describes building an edge-agentic commit analyzer, a tool that reviews code commits locally using AI agents running on local hardware rather than cloud services. The piece focuses on troubleshooting stubborn errors that arise in local environments. Reaction so far is limited, but the topic touches on ongoing developer interest in running AI coding tools offline for privacy and cost reasons.

Developers are debating how to handle pull requests written with the help of AI coding agents. The discussion, circulating among programmers and engineering managers, asks how thoroughly reviewers should scrutinise such contributions, weighing whether agent-written code deserves the same depth of review as human work and what that means for team standards, trust and inclusive review culture.

DoorDash has moved its AI engineering agents from developers' laptops to Flux, a cloud-based platform that now handles around 130,000 automated tasks a month, including roughly 25,000 weekly code reviews. The system runs agents in isolated micro virtual machines and cloud sandboxes designed to keep autonomous code operations secure. The scale of deployment is drawing attention as one of the larger corporate examples of AI agents doing routine software engineering work.

A developer has published findings that CodeRabbit, a popular AI-powered code review tool, produces excessive noise when reviewing real pull requests. On a public benchmark of 50 genuine pull requests, the tool flagged far more issues than necessary, and a modification reduced its review noise by roughly a third. The work has sparked discussion among developers about whether AI review tools create too many low-value comments that slow teams down.

An engineer has shared five lessons from running Anthropic's Claude Code as a cloud agent every hour on a large production monorepo. The write-up covers validating review comments, preventing the agent from getting stuck in loops, fixing a 403 error, and reducing token consumption. The post is drawing attention from developers interested in using AI coding agents for automated code review in real production environments.

The open-source firmware project Coreboot has released version 26.09, adding support for the Framework Laptop 12 and introducing a new policy on AI-generated comments in code reviews. The release matters to users who want open firmware alternatives to vendor BIOS on recent hardware, particularly the modular laptop maker's latest device.

A new kind of coding challenge is making the rounds: instead of writing code, developers are asked to review a pull request containing three deliberately planted bugs and find them. The exercise inverts the usual interview format, testing code review and reading skills rather than implementation. Programmers are debating it as a fairer, more realistic test of everyday engineering ability.

A software engineer writing on Substack says he no longer manually reviews the code produced by his AI coding agents, and has adopted a different approach instead. The piece is drawing attention among developers debating how much oversight AI-generated code needs, as teams increasingly rely on agents to ship production changes with limited human inspection.

Discussion is growing around whether open source software projects can keep pace with AI tools that generate code far faster than human developers. The concern centres on how volunteer-driven communities, which maintain much of the world's critical software infrastructure, will absorb or compete with automated code production while still ensuring quality, security and proper review.

SpaceX has reportedly completed a $60 billion acquisition of Cursor, the AI coding company, in what would fold enterprise AI software into a business better known for rockets and Starlink satellite internet. Reports frame the deal as adding a new AI revenue stream alongside Starlink's connectivity business. Details on regulatory review and how Cursor fits into SpaceX's structure remain limited, so the full scope of the deal is still unclear.

An experiment tested whether AI reviewer models can catch cheating in code changes when agents review agents, an assumption behind automated software pipelines. Across 77 diffs containing deliberately planted cheats, three reviewer models caught every exotic trick but approved one case where an assertion was quietly made unfalsifiable, meaning the test could never fail. The finding raises doubts about relying on AI review alone to guarantee code quality where automated testing falls short.