AI code review bottleneck: Postgres 19's reverts and a 718-firm study, the October 2026 numbers
Tools in this post
Coding agents moved the bottleneck from writing code to reviewing it. Across 718 firms, agent adoption raised pull requests per worker by 23% and lines of code by 30%, while issues resolved did not rise and the time from opening a pull request to merging it grew 49%, from 7.03 to 10.48 days (Chen and Stratton, Harvard, version of 4 August 2026). In October, PostgreSQL 19 moved its release to 19 November 2026 after about 8 to 10 significant features were reverted, with faster LLM-assisted bug finding among the causes its developers named.
Why is AI code review the bottleneck?
The AI code review bottleneck is the review of agent-written code, still done mostly by people: agents raise the volume of draft code faster than teams can check it, and each draft needs more rounds of review. The 718-firm study measured both halves: more pull requests per worker, more review work per pull request, and no gain in resolved work.
| Per worker per month, unless noted | Before agents | Effect of agents | Change |
|---|---|---|---|
| Lines of code added | 5,017 | +1,494 | +30% |
| Commits | 22.58 | +4.57 | +20% |
| Pull requests | 5.34 | +1.22 | +23% |
| Jira issues resolved | 3.67 | +0.12, not significant | +12% at most |
| Days from pull request opened to merged | 7.03 | +3.45 | +49% |
| Review comments per pull request | 1.66 | +0.58 | +35% |
| Pull requests sent back with changes requested | 13% | +12 points | nearly double |
| Lines added per pull request | 1,168 | -68, not significant | no change |
"+12% at most" is the top of the confidence interval: the data rules out a larger rise in resolved issues. The authors read the pattern as two effects at once. Each worker produces more draft code, and either the drafts carry more defects or reviewers hold agent code to a higher bar; both show up as more comments and more requested changes on pull requests of the same size. Autocomplete-style assistants did not slow review (-0.38 days, not significant); the slowdown is an agent effect.
Time to merge rose 49% while pull requests stayed the same size
Review load per pull request grew on every measure the 718-firm study has: 35% more review comments, nearly twice the share sent back with changes requested, and 3.45 more days from opening to merge. Pull request size did not change, so the extra work comes from what is in the diff, not from bigger diffs.
Firms moved people into review to cope: the share of workers who comment on or approve pull requests rose from 29% to 33%, while the share who commit code stayed flat. One engineer interviewed for the paper described a single senior approver who "could only review my code once a week", and new rules after outages that required senior approval for AI-generated code, "which created even more review bottlenecks."
No source I found measures reviewer hours per agent-written pull request; Faros reports average time in code review up 199.6%, but across all pull requests. "Review time" in the paper is elapsed days from opening to merge, which includes waiting and rework.
Postgres 19 reverted 8 to 10 features as LLM-assisted review sped up bug reports
Postgres 19 was due on 29 October 2026. On 10 October, release team member Jonathan Katz moved general availability to 19 November, with an RC2 on 12 November, "Given the volume of fixes that have been added to the back branches". The new date folds those fixes in; the AI review story is about the reverts that came before it.
Core team member Peter Eisentraut wrote on 9 October that "about 8 to 10 significant features, depending on how you count, have been reverted", against "maybe one per cycle" normally: "with LLM-assisted code review, these kinds of things can get found much faster, and then you're staring at a list of like forty defect reports." He names other causes too: some features had design defects, and senior developers spent April to August on security fixes, so beta review started late. DevOps Daily's count from the release branch lists 11 features pulled since beta 1, among them SQL/PGQ, FOR PORTION OF and online data checksums.
The AI review is on the public record of the pgsql-hackers list:
- Robert Haas asked Claude on 25 August to rank the riskiest version 19 patches by bugs fixed after feature freeze. Its tally put REPACK at 28 fixes and online checksums at about 25.
- Andres Freund found a lost-update bug in FOR PORTION OF and wrote that he "needed to force both Opus 5 and Fable 5.1 to get to it, they both swore up and down that this isn't a real issue at first" (thread). Those are Claude Opus and Claude Fable models.
- Zsolt Parragi ran Claude and Fable across pairs and triples of features and reported "22 issues with reproducers" after about 30% of the planned first-round checks.
The Postgres review queue grew faster than its commits
The commitfest app, where Postgres tracks patches waiting for review, shows the same shape. I counted its status summaries on commitfest.postgresql.org on 24 October 2026.
| Commitfest | Entries 2025 | Entries 2026 | Change | Committed 2025 | Committed 2026 | Change |
|---|---|---|---|---|---|---|
| July | 388 | 628 | +62% | 139 | 191 | +37% |
| September | 307 | 539 | +76% | 69 | 116 | +68% |
The November 2026 commitfest held 615 entries before it opened, 51% more than the whole November 2025 one. Entries include patches carried over from the previous commitfest two months earlier, and the app does not say which patches an agent wrote, so this shows a queue outgrowing its throughput, not an AI effect.
AI reviewers wrote 23% of review comments and reached 11% of pull requests
Nearly 80% of the 718 firms had used an AI code review tool by March 2026, yet AI-generated comments were only 23.3% of all review comments, and only 10.8% of pull requests got one. The paper detected CodeRabbit, Greptile, GitHub Copilot's reviewer, Cursor's Bugbot, Graphite and Bito by their bot logins. These shares are descriptive, not an estimate of what the tools change.
The tools at the review step check different things, and few publish a number:
| Tool | What it checks | Published number |
|---|---|---|
| regression-hunt, Trail of Bits | Whether a merged change breaks behaviour that used to work, reproducing each candidate on a live build and replaying it with a fresh agent | 25% fewer false positives than a prompted Codex agent on 21 known regressions (95% CI 14-38%) |
| patching-bugs, Trail of Bits | A fix proven three ways: the original fails, the patch passes, reverting the patch fails again | none yet |
| Codex code review, OpenAI | Only P0 and P1 issues, following ## Code Review Rules in the nearest AGENTS.md |
none |
| Parsimony | How much code a passing patch adds, against other models on the same tasks | 0.83x to 1.11x the peer average among high solvers |
| SWE-bench Verified | Whether a patch passes hidden tests on 500 Python tasks | pass rates only |
Trail of Bits published both plugins on 21 October 2026, built them inside Patch the Planet, a program it runs with OpenAI, and measured regression-hunt against a Codex baseline on its own set of 21 known regressions (post). Its numbers are preliminary and self-reported.
Parsimony counts the code an agent adds, not whether it passes
Parsimony measures how much code an agent's patch adds once the patch has passed the benchmark's tests. It counts net syntax units (statements, calls, names, literals; not comments or formatting) and divides each model's count by the average of other models on the same solved tasks. On its DeepSWE board, read on 24 October 2026, models solving 65% or more of tasks range from 0.83x the peer average (Claude Fable 5) to 1.11x (GPT-5.6 Luna). On the older SWE-bench Verified board, most models add 1.3x to 3.3x the net code of the human fix.
Its author notes that models writing more code also solve more tasks (Spearman 0.33 to 0.60) and that "units measure size, not readability or design". I found no measurement of whether fewer units mean less review time.
No public Stackness stack lists an AI reviewer
Public stacks on Stackness put tools at the writing step, not the review step. As of 24 October 2026, with bot accounts removed, 10 public profiles list GitHub, 8 list Claude Code and 7 list Cursor, but none lists CodeRabbit, Greptile, Graphite or Qodo, and one lists GitHub Copilot (how these numbers are collected). The sample is small, and it fits the paper's 10.8%: in most stacks the reviewer is still a person.
The AI tools developers add to their stacks are mostly agents and editors. The move for reworking CI pipelines around AI-generated code volume covers the step before review, and I wrote up the layers teams use in place of reading every line in six verification layers for agent-written pull requests.
How the numbers compare with larger sources
An independent study points the same way, and vendor reports put the review slowdown far higher. Demirer, Musolff and Yang (NBER w35275, revised September 2026) followed more than 500,000 GitHub developers: autonomous agents raised commits 240%, but that "falls to 80% for the number of projects, and to 30% for actual releases".
- Faros AI, which sells engineering analytics, reports median time in review up 441.5% between each organisation's lowest and highest AI adoption periods, across 22,000 developers (April 2026). The data is correlational.
- Open source maintainers in a Linux Foundation survey judged 25% of incoming pull requests "AI slop" (20 October 2026).
- Anthropic found over 29,000 candidate vulnerabilities in six months and triaged about 6,000, writing that it remains "bottlenecked on our human capacity to validate these findings" (8 October 2026).
Five changes the sources back for this week
The Postgres committers, Trail of Bits and OpenAI each name steps that unblock review rather than generation. The 718-firm study tested none of them, so treat these as practitioner advice backed by the incidents above.
- Land large changes early. Haas: "all of the features that have had all of these fixups were committed quite close to feature freeze."
- Ship the limited version first. Freund: "Incremental development is a virtue."
- Write down what counts as a regression and what proof it needs. Trail of Bits asks for a
THREAT_MODEL.mdand patching guidelines in the repository, and treats an agent's claim without a before-and-after reproduction as inconclusive. - Put review rules where the review agent reads them. OpenAI's docs say to keep two or three rules under
## Code Review Rulesin AGENTS.md and to "Leave mechanical checks in CI". - Measure merged work, not lines. Track time to merge, changes requested and issues resolved. The paper warns that lines of code and commits "may not accurately capture the true gains from AI adoption."
Method and sample
The 718-firm paper is a job market paper, not peer reviewed. It uses telemetry from Jellyfish, an engineering analytics vendor, from January 2021 to March 2026: about 340 million commits, pull requests, issues and calendar events from 725,938 workers (its introduction says approximately 700 firms and 300 million events). The method is a staggered difference-in-differences on each firm's adoption month; in the median firm only about 20% of engineers used agents a year after adoption, so per-user effects are larger. Jellyfish reviewed the manuscript only for proprietary information, and its January blog on an earlier draft said "code quality doesn't seem to be suffering", which the August version no longer supports.
Commitfest counts are mine, from the app's status lines on 24 October 2026. Stackness counts exclude accounts whose bio marks them as bots. Faros, Trail of Bits and Anthropic describe their own products or customers.
Key numbers
- +23% pull requests per worker after agent adoption, 718 firms (Chen and Stratton, 4 August 2026)
- +49% days from pull request opened to merged, 7.03 to 10.48 (same paper)
- +35% review comments per pull request, and the share sent back with changes requested nearly doubles from 13% (same paper)
- +12% at most rise in resolved issues the data allows (same paper)
- 23.3% of review comments AI-generated, and 10.8% of pull requests with at least one (same paper)
- 8 to 10 Postgres 19 features reverted, against about one per cycle (Eisentraut, 9 October 2026)
- 19 November 2026 new Postgres 19 release date, moved from 29 October (release team, 10 October 2026)
- +76% Postgres September commitfest entries year on year, against +68% commits (my count, 24 October 2026)
- 0 public Stackness profiles listing CodeRabbit, Greptile, Graphite or Qodo, bots removed (24 October 2026)
New posts by email
About one email a week with what we published. No account needed.
One email to confirm first. Every email has a one-click unsubscribe.
Which of these do you use?
Nobody on Stackness runs CodeRabbit yet. Tick what you use and be the first.
