What Is AI Code Review? How AI Checks Code Before It Ships

AI code review is software that reads a proposed change to a codebase and leaves comments on it, the way a human teammate would. It points out possible bugs, security problems and broken rules before the change is merged. This guide explains what it does, how the main products work, and where their makers say the limits are, based on their documentation as of November 4, 2026.

The short answer

When a developer wants to change code, they usually open a pull request: a bundle of changes that other people check before it joins the main code. An AI reviewer is added to that step. It reads the change, looks for problems, and posts comments on the lines it is worried about.

GitHub, Anthropic, OpenAI and Cursor all offer a version of this, under the names Copilot code review, Claude Code's Code Review, Codex code review and Bugbot. GitHub's and OpenAI's docs tell people to check the AI's findings.

First, what is a code review?

Google's public code review guide says the company uses it "to maintain the quality of our code and products." The guide lists what reviewers should look at, including:

• Design: "Is the code well-designed and appropriate for your system?"
• Functionality: "Does the code behave as the author likely intended?"
• Complexity: "Could the code be made simpler?"
• Tests: "Does the code have correct and well-designed automated tests?"
• Naming, comments, style and documentation.

On GitHub, this happens inside a pull request. GitHub's pull request reviews page says reviewers can "comment on changes, suggest improvements, and approve or request changes before code is merged." A reviewer picks one of three decisions: Comment, Approve or Request changes. Repository administrators "can require approvals before pull requests are merged."

The AI reviewers in this guide post their feedback inside this same pull request flow.

What AI code review is

An AI reviewer is a program, built on AI models, that is allowed to read a pull request and post feedback. Some makers describe their reviewers as using agents: Anthropic says "several agents" read each change, and GitHub says Copilot code review "utilizes agentic capabilities." For the basic idea behind agents, see our plain guide, What Is an AI Agent?

Here is how four makers describe their reviewers on their own documentation pages:

• GitHub Copilot code review. GitHub's docs say: "Copilot reviews your pull requests, identifies issues, and suggests fixes you can apply in a couple of clicks."
• Claude Code's Code Review. Anthropic's docs say: "Several agents read each change alongside the surrounding code, looking for issues such as logic errors, security vulnerabilities, or broken edge cases."
• Codex code review. OpenAI's docs say Codex "reviews the pull request diff, follows your repository guidance, and posts a standard GitHub code review focused on serious issues."
• Cursor Bugbot. Cursor's docs say: "Bugbot reviews pull requests and identifies bugs, security issues, and code quality problems."

How a review works, step by step

Anthropic's Code Review page gives the clearest public breakdown. It says a review runs in four stages:

1. Find: "several agents examine the diff and the surrounding code in parallel." (A diff is the list of lines added and removed.)
2. Verify: "a verification step checks the candidate findings against the code and filters out false positives." A false positive is a warning about a problem that is not real.
3. Rank: "the findings that remain are deduplicated and ranked by severity."
4. Post: "the review posts its results on the pull request."

The same page says a review "works from reading the diff and the surrounding code, without building or running your code." In other words, it reads the code. It does not test it.

Other products describe a similar idea in their own terms. GitHub says Copilot code review uses "full project context gathering," which "analyzes your entire repository to better understand the context of code changes." Cursor says Bugbot "analyzes PR diffs and leaves comments with explanations and fix suggestions," and that it reads existing comments on the pull request "to avoid duplicate suggestions and build on prior feedback."

Where the comments show up

AI review comments appear in the same places as a person's comments.

• Inline comments. Claude's Code Review posts findings "as inline comments on the lines concerned, ranked by severity, with a summary and a check run on the pull request."
• A check. A check is a status line on the pull request that shows whether an automated job passed. Claude's check is named Claude Code Review. Bugbot's check on GitHub is named Cursor Bugbot.
• A normal review. OpenAI says "Codex posts a review on the pull request, just like a teammate would."

Some products sort their findings by how serious they are. Anthropic's severity guide uses three labels: Important ("A bug that should be fixed before merging"), Nit ("A minor issue, worth fixing but not blocking") and Pre-existing ("A bug that exists in the codebase but wasn't introduced by this PR"). OpenAI says that on GitHub, "Codex flags only P0 and P1 issues so review comments stay focused on high-priority risks."

How a review starts

There are two common ways to start a review.

Automatically. A team can set the reviewer to run on every new pull request, or after every push of new code. Anthropic says each repository can run reviews "once when a pull request opens, after every push, or only on request." Cursor says Bugbot "runs automatically on each PR update or manually when triggered."

By asking. Each product has a comment that calls the reviewer. Per the vendors' docs:

• Claude: comment @claude review.
• Codex: comment @codex review.
• Bugbot: comment cursor review or bugbot run.

On GitHub, Copilot can also be added as a reviewer. GitHub's docs describe the Reviewers section of a pull request "where Copilot appears as a reviewer."

What it looks for

Each vendor sets a default focus.

• Anthropic says Code Review "focuses on correctness: bugs that would break production, not formatting preferences or missing test coverage."
• GitHub says its lightest review level gives "fast, targeted feedback on common issues such as bugs, security vulnerabilities, and style inconsistencies."
• OpenAI says Codex focuses on "serious issues."
• Cursor lists "bugs, security issues, and code quality problems."

Light reviews and deep reviews

Most products let a team choose how thorough the reviewer is. GitHub and Anthropic both say deeper reviews cost more.

• GitHub Copilot offers Lite, Balanced and Max. GitHub says Max "uses multiple high-reasoning models for the most intensive review," and "Higher effort levels consume more AI credits."
• Claude Code offers Quick, Standard and Deep. Anthropic says "a more thorough review costs more."
• Bugbot has effort settings in its config file, including low, default, high and smart.

GitHub's advice on picking a level is plain: use the deepest level "for high-risk or release-critical pull requests," and the lightest "for routine changes where fast feedback is more important than exhaustive analysis."

Teaching the reviewer your team's rules

An AI reviewer does not know a team's habits until someone writes them down. Each product reads instruction files kept in the code repository.

• Claude Code reads CLAUDE.md for project rules and REVIEW.md for "instructions for reviews alone," per Anthropic's customize page.
• Codex "searches your repository for AGENTS.md files and follows the applicable code review rules," per OpenAI. Teams add a section titled Code Review Rules.
• GitHub Copilot can use .github/copilot-instructions.md, path-specific instruction files, AGENTS.md and agent skills, per GitHub's docs.
• Bugbot reads .cursor/BUGBOT.md files. Cursor says Bugbot can also learn rules "from your team's activity on GitHub," and that commenting @cursor remember [fact] saves a fact "as a learned rule."

One detail differs between products: which copy of the instructions a review reads. Anthropic says Code Review reads REVIEW.md "from the base or default branch and never from the pull request's own changes." GitHub says Copilot "reads repository custom instructions, agent instructions, and agent skills from the head branch (the branch with your changes)," so a team can "test changes to them in the same pull request without merging them first." Check which rule your tool follows.

Can the AI approve or fix code?

Approving. Anthropic says "A review never approves or blocks the pull request, so the decision to merge stays with your team." GitHub says Copilot's reviews include "an approval assessment," but "By default, Copilot's reviews do not count toward required approvals." If an admin turns on Copilot approvals, "Copilot can submit an approving review that satisfies your repository's required-approval rule the same way a teammate's approval would."

Blocking. Cursor says Bugbot's status is neutral by default when it finds issues, and "Requiring the status alone does not block merges on findings." A team can set it to fail on unresolved issues where that option is available.

Fixing. Some reviewers can hand the fix to a coding agent. Cursor's Bugbot Autofix "automatically spawns a Cloud Agent to fix bugs found during PR reviews," and can push fixes to a new branch or to the existing one, with a limit of "max 3 attempts per PR to prevent loops" on the existing branch. GitHub says Copilot code review can pass suggestions to Copilot cloud agent, which creates "a new pull request against your branch with the suggested fixes applied." Anthropic says that inside a review, Claude's access to the repository "is read-only, and a review doesn't push commits."

Security-focused review

Some tools focus only on security. OpenAI's docs mention a separate Security Review for "a more in-depth review of potential security issues in a pull request." Other companies build security review for code written by AI agents. One example is Corridor, which announced in October 2026 that it is joining Cognition, the maker of the Devin coding agent; see our news post on Cognition and Corridor. Greptile, another AI code review company, is covered in our post on its funding round.

The limits the vendors name

GitHub and Anthropic say their reviewers can miss problems, and OpenAI tells users to check the findings.

• GitHub: "Copilot is not guaranteed to spot all problems or issues in a pull request. Sometimes it will make mistakes. Always validate Copilot's feedback carefully. Supplement Copilot's feedback with a human review."
• Anthropic: "Code Review uses AI to review code and may miss bugs, security vulnerabilities, or other issues. A review with no findings doesn't mean your code is error-free or secure."
• OpenAI: "Check the review findings against the diff."

There are also built-in gaps:

• Skipped files. GitHub says Copilot code review does not review some file types, including "Dependency management files," "Log files" and "SVG files."
• Very large changes. Cursor says "Bugbot skips PRs larger than its default review-size limit" and asks the author to split the change.
• No test run. As noted above, Anthropic's reviewer reads code "without building or running your code." Tests still have to be run some other way.

Google's guide notes the reverse case too. It says problems in parallel code, such as deadlocks or race conditions, are "very hard to detect by just running the code and usually need somebody (both the developer and the reviewer) to think through them carefully."

Questions to ask before your team turns it on

• Who can start a review? Automatic on every pull request, or only on request?
• Can it approve? Is that setting on or off, and does an AI approval count toward your required approvals?
• Can it push code? Is autofix on, and does it push to a new branch or to the author's branch?
• Which rules does it read? Where do your instruction files live, and which branch are they read from?
• What does it skip? Which file types and pull request sizes fall outside its review?
• Who still reviews? Which changes always need a human reviewer, whatever the AI says?

For a technical deep dive on how review systems assemble context and cut noise, see our engineering post on automated AI code review in production.

Quick glossary

• Pull request (PR): a proposed set of code changes that others review before it is merged.
• Diff: the lines added and removed in a change.
• Merge: adding approved changes to the main code.
• Check: an automated status on a pull request that passes, fails or stays neutral.
• False positive: a warning about a problem that is not real.
• Instruction file: a text file in the repository, such as REVIEW.md, AGENTS.md or BUGBOT.md, that tells an AI reviewer the team's rules.
• Autofix: a feature that sends a reviewer's findings to a coding agent to write the fix.

Sources

• Google eng-practices: Code Review Developer Guide
• Google eng-practices: What to look for in a code review
• GitHub Docs: Pull request reviews
• GitHub Docs: GitHub Copilot code review
• Claude Code Docs: Code Review
• Claude Code Docs: Read and request reviews on a pull request
• Claude Code Docs: Customize Code Review
• OpenAI Codex Docs: Review GitHub pull requests with Codex
• OpenAI Codex Docs: Code review
• Cursor Docs: Bugbot