The PR is too late.

Coding agents made writing code cheap. They did not make reviewing it cheap. Every team now has the same queue, and a better PR reviewer cannot clear it, because by the time a PR exists the expensive part has already started.

Agents now start more than 40% of pull requests on GitHub

In March 2026 it was 17%. Over the year, merged pull requests more than tripled, to 1.3 billion, about 3.5 million a day.

Share of pull requests started by an agent
March 2026
17%
September 2026
40%+110 million PRs that month

Figure 1. Pull requests on GitHub that started with an agent's first draft1. Agent PRs do get merged2.

Writing scaled. Reviewing did not.

“Code review becomes the bottleneck.”

When a company adopts coding agents, pull requests go up by a third, and each one takes more than half as long again to get approved. Finished work rises far less. The extra code is waiting for a person.

+35.7%more PRs opened

+59.9%longer waiting in the queue

+56.1%longer to get approved

Figure 2. More PRs go in. The same human attention comes out3.

What changed in code review after coding agents arrived
After coding agents arriveChange
Pull requests opened4+35.7%
Time from submission to approval4+56.1%
Time waiting in the backlog4+59.9%
Comments on each change4+38.6%
Issues resolved, the finished work4+13.7%
Wait for a first look, agent PRs against unassisted517.6 h vs 3.4 h
Median time in review6+441.5%
PRs merged with no review at all6+31.3%

Figure 3. What three independent datasets measured. The size of the effect varies by study. The direction does not.

Much of what reaches the queue is not ready

Reviewers are not only reading more. They are sending more back: comments on each change rose 38.6%. Independent tests show why.

  • 45%

    of AI code tasks introduced a security flaw7

  • 11.8%

    of agent solutions were secure, though 57% worked8

  • 33%

    of agent runs were working and secure, in our own test9

Figure 4. How often code from AI models and agents held up, in three separate tests with different methods.

AI review at the PR has not removed the bottleneck

The Harvard study found that 79.1% of firms have already adopted AI code review tools, and they still largely keep humans in the loop. A PR agent adds a reviewer. It reads the same finished code, at the same late moment, and the PR still has to wait for a person.

We saw the same in our own data. Commercial AI review bots reviewed 51 of 110 merged PRs that introduced a known bug, and flagged 8 of those bugs. These bugs all reached a merge, so a bug that a bot stopped before the merge is not in this count.

By the time a PR exists, the expensive part has started

  • The agent has moved on

    The session that wrote the code has usually ended, and its context with it. A finding now starts new work.

  • The cost lands on a person

    Every problem found here costs someone's attention: read, comment, wait, read again.

  • The pressure is to merge

    A long queue invites shortcuts. PRs merged with no review at all are up 31.3%.

Caught at the commitNobody waits

  1. The agent commits
  2. Verity finds the bug
  3. The same agent fixes it, in the same session
  4. The PR opens without it

Caught at the PRIf someone catches it at all

  1. The agent finishes
  2. The PR waits in the queue
  3. A reviewer reads it and comments
  4. Someone reopens the work
  5. A reviewer reads it again

Figure 5. The same bug, caught at two moments10.

So check before the PR

Verity reviews each commit and push, while the coding agent can still fix what it finds. We tested what that does, on the same tasks, with and without it.

  • 2×

    the real bugs of your typical PR agent

  • 63%

    of runs working and secure, against 33% alone

  • 45%

    fewer bad PRs

Our own benchmark, from October 2026, with Verity at maximum review effort.

See the benchmarkSee how Verity works
$npm install -g @codacy/verity-cli && verity init