Here's what most people get wrong about AI code generation: they read the throughput numbers and stop. Faros AI's 2026 telemetry, spanning 22,000 developers across roughly 4,000 teams, shows epics completed per developer up 66% and task throughput up almost 34%. The share of AI-generated code developers accept without editing climbed from 20% to 60% in a single year.
The same dataset puts median time spent in code review up 441.5%.
Those two numbers live in the same report. Teams are not shipping faster in any way their users would notice — they are generating more code and then queuing it. Faros also found median time to first review up 156.6%, bugs per developer up 54%, production incidents relative to pull requests up 242.7%, and code churn — code rewritten within two weeks of being written — up 861%. Pull requests merged with no review at all rose 31.3%, not because any team changed its policy, but because reviewers couldn't keep pace.
Teams are not shipping faster in any way their users would notice — they are generating more code and then queuing it.
CloudBees' 2026 State of Code Abundance report captures the confidence problem underneath all of it: 92% of enterprise technology leaders said they were confident AI-generated code was production-ready before it shipped, while 81% reported a rise in production issues tied to that code. Stack Overflow's 2025 survey found developer trust in AI output had dropped from 40% to 29%, with 66% describing it as "almost right, but not quite."
Almost right is the dangerous category. A junior engineer's mistake looks like a mistake. An agent's mistake looks like senior work — clean naming, idiomatic structure, tests that pass, wrapped around a missing authorization check.
The volume explains the rest. GitHub's Octoverse 2025 put merged pull requests at 43.2 million per month, up 23% year over year, and the platform has seen the number of PRs opened grow fivefold over three years, with growth accelerating sharply from the end of 2025, when PRs and commits nearly doubled in that period alone.
LinearB's 2026 benchmarks, built from 8.1 million pull requests across 4,800 teams in 42 countries, show what that traffic does to reviewers. AI-assisted PRs at the 75th percentile run 400+ lines against 157 for unassisted ones. They wait 16+ hours for a reviewer to even open them, versus about 200 minutes. Only 32.7% merge within 30 days, against 84.5%. And refactoring on AI-assisted PRs sits near zero where unassisted work runs about 37%, meaning what does merge is going in close to first draft.
LinearB's own read on that: "Faster review completion on larger, less familiar code isn't a sign review got more efficient. It's what review looks like once capacity gets outpaced and shortens itself to cope."
So what are teams actually doing? The most popular answer is a layer of indirection. AI review tools — CodeRabbit, Greptile, Gitar, Qodo, Copilot code review, Claude Code Review, Ellipsis, and dozens more — comment on the PR, and engineers review the review instead of the code. The Bun project runs CodeRabbit, GitHub Code Review, and Claude Code Review simultaneously.
Weaviate CTO Etienne Dilocker describes a four-step loop: an adversarial agent reviews, a human makes a scope decision, an agent implements the feedback, then either repeat or break — likely a human decision. His framing: "90% is left to agents, with humans in the loop for critical scope decisions and exit criteria."
Others triage by blast radius. Low-risk changes ship once AI agents are satisfied; high-risk changes require human review. OpenAI and Anthropic both confirmed this approach. At Anthropic, Jarred Sumner says a human still merges even low-risk changes, though the stated goal is eventually to have another Claude instance merge them.
Duckbill Group, a five-person company, hit 60 open PRs and realized it was staring at two days of nothing but code review. They mostly ditched it.
Noise is the recurring complaint. WeTravel evaluated AI code review, found it too noisy, re-evaluated in June, saw improvement, and still decided it wasn't enough to justify adopting. Uber built an internal pipeline called uReview that grades incoming bot comments, strips low-confidence ones, merges and categorizes the rest, and surfaces only what survives.
The more interesting shift is splitting the job rather than automating it. Writing in CIO, Vittesh Sahni describes a pull request that builds a discount endpoint, validates input, returns clean JSON, and passes the unit tests the agent wrote — while applying the discount before the eligibility check, reversing the rule in the ticket. The tests were green. The system was giving money away.
His fix: one agent checks requirements against the ticket's acceptance criteria, a second checks quality per PR in parallel, and findings merge into a single consolidated comment sorted by category. Humans still own the merge decision on high-blast-radius paths. In his pilots, agent findings start around a 35–40% acceptance rate and climb past 60% as context improves.
That context requirement is the part teams underestimate. The agent needs to know what kind of service it's looking at and what the ticket actually asked for. It also needs to be scoped to lines the change touched — early pilots flagged real problems in untouched code, which is technically correct and completely useless.
LeadDev's 2026 survey adds a note of realism to the "AI makes review faster" story: 68% of engineers say AI has changed how they run review, and 86% of those use it to pre-screen before a human opens the diff — but the outcomes are split. 29% say reviews now take longer, 24% report time savings, and 47% see no change. Among teams that kept fully manual, line-by-line review, 38% now spend more time on it than before.
Which is why the "software factory" pitch deserves the skepticism Peter Yang aimed at it. Verification and testing aside, he argues AI isn't at a point where it can self-improve a product or build a feature end-to-end without a human in the loop: "Whenever I loop something overnight to build something new = if it makes one wrong assumption the whole thing becomes a waste of tokens." The replies landed on a fair distinction — a software factory is mostly automated with humans retaining control, not a dark factory running unattended.
And despite all the talk of dropping human review, there's more talk than evidence. The furthest anyone has gone is AI startups adding safer production rollout layers. Anthropic still has a human click merge.
The security data makes that caution look less like conservatism and more like arithmetic. CodeRabbit's analysis of 470 open source pull requests found AI-coauthored PRs averaging 10.83 issues against 6.45 for human-only ones, with higher rates specifically in security, null and error handling, and business logic. A separate peer-reviewed study by Cotroneo, Improta, and Liguori, using over 500,000 matched samples across three models and different detectors, found AI-generated code consistently worse on security in both Python and Java — OS command injection findings appeared 2,243 times in human-written Python versus 7,318 to 13,419 across the AI models.
Veracode's 2025 work found 45% of AI-generated code introduced a security flaw, with 86% failing to defend against cross-site scripting. Apiiro reported that 3–4x velocity produced roughly 10x more security findings — over 10,000 new ones per month. And Spracklen et al., in USENIX Security '25, found hallucinated package names in 5.2% of commercial model outputs and up to 21.7% from open-source models across 576,000 samples, with 58% of the fake names recurring — reliable enough that attackers now pre-register them.
The METR randomized controlled trial from 2025 is the quietest damning data point of all. Experienced open source developers working in repositories they knew well expected AI tools to speed them up by 24%. They were measured 19% slower. Afterward, they still believed they'd been 20% faster.
That's the whole problem in one study. The agent makes the diff appear instantly, and the cost lands somewhere the human can't see it. You cannot out-attention a firehose. The teams doing well have stopped measuring how fast code gets written and started measuring how long it waits to be trusted.
Every argument about AI code generation eventually returns to throughput. The actual constraint is what LinearB calls review lead time and revert rate on agent-touched pull requests — the two numbers that tell you whether the extra output is worth having.