TL;DR: AI code review points a language model at a code change and asks it to find problems: bugs, security holes, missed edge cases, convention violations. It reviews every line of every diff without fatigue, which makes it a strong first pass - and a poor last word, because design judgment and product context still belong to humans.
How it works
When a pull request opens, the reviewer receives the diff plus enough surrounding context - related files, project conventions, sometimes the linked issue - and produces findings, usually as inline comments with an explanation and a suggested fix. The same pattern runs earlier in the cycle too: a developer can ask an AI coding agent to review uncommitted changes locally, catching problems before anyone else sees them.
A concrete example: a PR renames a config key in twelve files but misses the thirteenth, and adds a database query inside a loop. A human skimming 400 changed lines at 4pm misses both; an AI reviewer flags both in seconds, because exhaustive line-by-line attention is exactly what machines are good at. Where it stumbles is the opposite kind of question - "should this feature exist in this service at all?" - which requires context that is not in the diff.
The economics explain the adoption curve. As agents write more of the code, review - not writing - becomes the bottleneck, and unreviewed AI code is how subtle bugs ship at scale. AI review absorbs the mechanical layer (correctness checks, style drift, obvious security issues) so the human reviewer spends attention on architecture and intent. This works best when there is something objective to review against, which is one of the quiet arguments for spec-driven development.
Two caveats keep it honest. First, false positives: a reviewer that flags twenty nitpicks per PR trains developers to ignore it, so teams tune severity thresholds and suppress rule classes. Second, judging code with a model is a special case of using an LLM as judge, and inherits its biases - verbose findings are not necessarily important ones. The mature setup keeps a human in the loop for the merge decision itself.
Where it sits in the AI stack
AI review sits between the code change and the human decision to merge - a filter, not a gate of its own:
Key tools and implementations
-
CodeRabbit
A review service that comments on pull requests automatically with summaries and line-level findings.
-
GitHub Copilot code review
Review built into the GitHub PR flow, requestable like any other reviewer on a pull request.
-
Agent review commands
Local review of a diff or branch by a coding agent such as Claude Code, run before the PR ever opens.
-
AI security scanners
Static-analysis tools that add model-driven reasoning to find injection, auth, and data-exposure flaws.
Related entries
- AI coding agent Software that plans and executes multi-step coding tasks - reading files, editing code, and running tests with minimal supervision.
- Spec-driven development Writing a detailed specification first so AI coding agents implement, and get reviewed, against an agreed plan.
- Human in the loop A design pattern where a person reviews, approves, or corrects an AI system's actions at defined checkpoints.
- LLM-as-judge Using a language model to score another model's outputs against a rubric instead of human review.