AI code reviewers

The Solus Linux distribution has formally adopted a policy allowing AI- and LLM-assisted code contributions, but only under strict conditions. Contributors must disclose AI use, ensure code passes testing and review, and remain accountable for what they submit. The move makes Solus one of the more explicit open-source projects in setting formal rules for AI-generated contributions.

Greg Kroah-Hartman, the longtime Linux kernel maintainer who oversees stable releases, has given a talk examining how large language models affect software security. He discusses what the rise of AI-generated code means for vulnerabilities, code review practices, and maintaining trust in widely used open-source components. The talk is drawing attention among developers weighing the risks of AI-written code in critical infrastructure.

A discussion among software developers is asking whether anyone is actually producing good code with AI coding agents. The question taps into ongoing debate about whether tools like GitHub Copilot, Cursor and other AI assistants deliver production-quality results or mainly speed up work that still needs heavy review. Replies so far are limited, but the topic reflects wider uncertainty in the industry about how reliable AI-generated code really is.

System76 has announced that its COSMIC desktop projects will no longer accept code submissions containing LLM-generated content. The Linux hardware and software developer says contributions must be written without AI assistance. The move reflects a growing frustration among open source maintainers, who argue that machine-generated code adds review burden and quality problems while contributors submit pull requests that are difficult to verify or maintain.

OpenAI has made its automatic code review feature free for all Codex users. The tool reviews code changes automatically, giving developers feedback without a paid tier. The move is being discussed as a way to pull more developers into OpenAI's coding ecosystem at a time when automated code review and AI coding assistants are a highly competitive market.

Orbi, an AI coding agent, reportedly takes a GitHub issue and returns a reviewed, merged pull request, with one agent writing the fix and another handling review. A follow-up post examining the system's harness asks what its reviewer missed, suggesting developers are scrutinising how reliable the automated pipeline is. The discussion is drawing interest from the open-source and AI engineering communities.

System76, the company behind the Pop!_OS Linux distribution, has banned AI-generated code across many of its COSMIC codebases, the desktop environment underpinning the operating system. The decision bars contributions written by AI tools from large parts of the project, with developers expected to write and review code themselves. The move is drawing attention and debate among open-source developers weighing code quality, licensing and trust issues around AI-assisted programming.

A new project called oh-my-agent has been presented on the German Ubuntu users forum, describing how existing code agents can be used to carry out automated project reviews. The thread, published under the Linux and open source sections, explains how developers can apply the tooling to check their current codebases. Responses so far appear limited, with the discussion still in an early stage.

Engineer Alexey Indeev has written that he no longer reviews code produced by his AI agents, and describes the alternative workflow he uses instead in a Substack essay. The piece has drawn modest attention on Hacker News, where developers are weighing whether traditional code review still makes sense as more work is delegated to autonomous coding agents.

IBM's AI-powered vulnerability clearinghouse has identified hundreds of security flaws in Java software. The finding highlights the growing role of artificial intelligence in scanning open-source code for vulnerabilities at scale, giving developers advance warning of weaknesses that attackers could exploit. Security teams are expected to review the affected Java components.

A developer has published a first-hand review of OpenAI's new Codex desktop application, concluding that the user interface is the real product rather than the underlying coding model. The write-up walks through the reviewer's initial experience using the app and argues OpenAI is putting significant weight on design and workflow. It lands amid heavy developer interest in AI coding tools and OpenAI's expanding product line.

GitHub has introduced ReviewBench, an open benchmark for measuring how well AI models perform code review. The benchmark is intended to give developers and researchers a standard, reproducible way to compare the quality of AI-generated code review feedback, as AI assistants are increasingly used in real software development workflows.

A new tutorial walks developers through creating their first 'agent skill' — a set of house rules that tells an AI coding assistant how the team works, from commit message formatting to what a code review must include. The guide is aimed at developers integrating AI agents into everyday software workflows and is being shared in programming and productivity communities.

Former OpenAI researcher Andrej Karpathy argued on X that as AI writes more of the code, the programmer's job shifts from typing to reviewing and supervising the machine's output. The remark is circulating among developers, many of whom see it as a fair description of how AI coding tools are already changing day-to-day software engineering and what skills will matter next.

OpenAI's Codex, the company's AI coding agent built on its GPT models, is generating renewed discussion as developers and tech commentators weigh it against ChatGPT. The conversation centres on how the two tools fit together: ChatGPT as the general assistant and Codex as a specialised tool for writing and reviewing code inside developers' workflows.

Discussion is growing around whether open source software projects can keep pace with AI tools that generate code far faster than human developers. The concern centres on how volunteer-driven communities, which maintain much of the world's critical software infrastructure, will absorb or compete with automated code production while still ensuring quality, security and proper review.

A developer is offering a paid human second-pass review of AI-generated pull requests, and says they reviewed three AI-written PRs from public repositories before pitching the service, which they call Riven Desk. The idea taps into growing concern that AI-written code is being merged without careful human scrutiny. Commenters in programming and engineering communities appear engaged with the question of how much review AI code actually needs.

A software developer describes an AI coding agent that publicly identified and corrected an error in its own fix, with two other agents then reviewing and validating the correction. The account, shared in a developer community under tags like AI, agents and programming, highlights the emerging practice of multi-agent workflows where one AI's output is checked by others before being accepted.

A developer has published findings that CodeRabbit, a popular AI-powered code review tool, produces excessive noise when reviewing real pull requests. On a public benchmark of 50 genuine pull requests, the tool flagged far more issues than necessary, and a modification reduced its review noise by roughly a third. The work has sparked discussion among developers about whether AI review tools create too many low-value comments that slow teams down.

A discussion circulating among developers examines what happens when you prompt an AI coding assistant to write a service that processes bulk user telemetry, validates incoming records and handles batch publishing. The code arrives within seconds and looks clean, but the point being raised is that polished syntax and modern structure can mask problems in how the service actually behaves, encouraging engineers to look beyond surface quality when reviewing machine-generated code.

An engineer has shared five lessons from running Anthropic's Claude Code as a cloud agent every hour on a large production monorepo. The write-up covers validating review comments, preventing the agent from getting stuck in loops, fixing a 403 error, and reducing token consumption. The post is drawing attention from developers interested in using AI coding agents for automated code review in real production environments.

The open-source firmware project Coreboot has released version 26.09, adding support for the Framework Laptop 12 and introducing a new policy on AI-generated comments in code reviews. The release matters to users who want open firmware alternatives to vendor BIOS on recent hardware, particularly the modular laptop maker's latest device.

Heise is hosting a live webinar on developing, deploying and reviewing software with AI coding agents in Xcode. The session covers Claude Code, GitHub Copilot and OpenAI Codex, with a focus on using the tools without compromising security or data privacy. The announcement is circulating among developers interested in AI-assisted programming workflows.

Researchers at ThreatDown have analyzed the new Carbonato botnet, which compromises poorly secured Docker hosts. The malware targets systems where the Docker API is exposed without authentication on port 2375, taking over containers and using AI-generated code in its operations. Security teams are being urged to lock down exposed Docker APIs and review firewall rules to prevent infections.

DoorDash has moved its AI engineering agents from developers' laptops to Flux, a cloud-based platform that now handles around 130,000 automated tasks a month, including roughly 25,000 weekly code reviews. The system runs agents in isolated micro virtual machines and cloud sandboxes designed to keep autonomous code operations secure. The scale of deployment is drawing attention as one of the larger corporate examples of AI agents doing routine software engineering work.

A newly shared engineering write-up describes building an edge-agentic commit analyzer, a tool that reviews code commits locally using AI agents running on local hardware rather than cloud services. The piece focuses on troubleshooting stubborn errors that arise in local environments. Reaction so far is limited, but the topic touches on ongoing developer interest in running AI coding tools offline for privacy and cost reasons.

Software testers are discussing a workflow where an AI agent runs plain-language test cases in a headless browser, using self-healing to keep scripts working as applications change, while only scenarios worth keeping long-term get promoted into maintained code. Supporters say it cuts maintenance burden on QA teams; others caution that AI-run tests still need human review before being trusted in release pipelines.

Developers are debating how to handle pull requests written with the help of AI coding agents. The discussion, circulating among programmers and engineering managers, asks how thoroughly reviewers should scrutinise such contributions, weighing whether agent-written code deserves the same depth of review as human work and what that means for team standards, trust and inclusive review culture.

A new kind of coding challenge is making the rounds: instead of writing code, developers are asked to review a pull request containing three deliberately planted bugs and find them. The exercise inverts the usual interview format, testing code review and reading skills rather than implementation. Programmers are debating it as a fairer, more realistic test of everyday engineering ability.