Code review on public GitHub no longer needs a person at either end. Two researchers went hunting for pull requests written by one AI coding agent and reviewed by another, identifying each side from the fingerprints the tools leave behind, such as the Co-Authored-By: Claude trailer and the coderabbitai[bot] account. They found about 45,000 pull requests where one vendor's agent wrote the code and a rival vendor's agent reviewed it, up more than a hundredfold between the first and third quarters of 2025.
"We find this phenomenon already substantial in absolute terms, if still a minority of all agent activity: in 2025, tens of thousands of PRs authored by AI coding agents are reviewed by other AI coding agents across multiple products."
Most of it moves faster than a person could read the diff. The typical cross-vendor review landed just over a minute after the pull request opened.
The pairings are not random. Where an agent's vendor also sells a reviewer, the code overwhelmingly gets reviewed by that same product. Of Copilot-written pull requests that drew an AI review, 96% drew it from Copilot. Agents whose vendors don't ship a reviewer, like Cursor and Claude Code, get looked at by something else almost by default. So whether your agent's work gets a second opinion from an unrelated system is not a policy anyone chose. It fell out of which suite you bought.
That matters more than the growth curve. The whole case for automated review is that it's a check, and a check run by the same product that made the thing is a weaker one. The authors name the mechanism they suspect, and say plainly that their data can't test it.
"AI authors and reviewers may share failure modes when they rely on related models, training sources, prompts, or tools, which the current dataset cannot assess because model identity and ground-truth defects are unavailable."
Take that seriously, but keep it in its box. The study measured how much AI review is happening and what shape it takes; it measured nothing about whether any of it caught a real bug. It also can't tell whether a human reviewed these pull requests as well, since it only sees events an agent signed. "Closed loop" describes the machines present, not the humans absent.
"These findings describe observable reviewer behavior, not review correctness or software quality."
One finding travels further than it looks. Holding the reviewer fixed, the mix of comments it produced shifted depending on which agent wrote the code, with far more structural-rework suggestions on some authors' pull requests than others'. The authors are explicit that they can't separate the reviewer's behaviour from the pull requests themselves. Either way, the counts your review tooling reports aren't comparable across the agents your teams use, which suggests any dashboard rolling "review comments" into one figure is measuring the vendor mix as much as the code.
On this evidence, "was this reviewed?" has stopped being a useful question, and the honest replacement is whether anything downstream changed because of the review, measured in comments acted on, follow-up commits and defects caught before shipping rather than after. That's harder to instrument than a green check, and it's the number to build before agent-authored pull requests stop being a minority. Two things to do sooner. Find out which reviewer is actually looking at your agents' output, and whether it ships from the same vendor. And treat any product pitch built on review volume or response time as describing throughput, not scrutiny. This study shows both can be very high while saying nothing about quality.
Sources
- Selvanayagam, N., Ghaleb, T. A., "AI-to-AI Code Reviews of GitHub Pull Requests" — https://arxiv.org/abs/2608.21311