AI Code Review: JetBrains Proposes Three-Level Trust Framework

Review is now the bottleneck

AI coding agents can now produce code faster than people can check it, and JetBrains' research arm says the industry's main review tool is out of date. On October 6, JetBrains' Human-AI eXperience team published a conceptual framework for reviewing AI-generated code, developed with researchers at Lund University. Its main argument is that the hard part is no longer understanding what an agent changed. The hard part is deciding which parts of the change to trust.1 The paper will be presented at Empirical Software Engineering International Week in October.1 The authors are Katie Fraser, Agnia Sergeyuk and Ilya Zakharov.3

The framework is a design proposal, not a product. It also comes from a company that sells developer tools, a point one summary flagged directly.3 Even so, it arrives as the market for AI code review tools from Anthropic, GitHub, Cursor and a crowd of startups is filling up fast. It offers a useful way to judge what those tools actually do.

What the framework says

The study draws on a participatory design process with 17 practitioners across four workshops, plus a follow-up survey of 43 software professionals.13 The researchers argue that normal review habits break down with machine-written code. With a human colleague, a reviewer knows the author's seniority and weak spots, and can message them to ask why something was done. An LLM offers none of that.1 Worse, a model shows every line with the same apparent confidence. Nothing marks a simple auth change as safer than a risky database migration.1

The sensible response, reading every line, does not scale as agents produce larger and larger change sets.1 So the authors reframe the problem. They say review of multi-file LLM changes is not a diffing problem but a "trust calibration" problem. They define trust calibration as the ability to spend review effort in proportion to the risk of each part of a change when the author can't be questioned.1

Their proposed workflow follows Shneiderman's information-visualization rule: overview first, then zoom and filter, then details on demand.12 It has three levels:

• Overview: a summary that stands in for the background a human author would give.
• File level: files ranked by risk before anyone reads a line of code.
• Snippet level: close reading of small chunks, linked to the model's chain of thought.1

The sharpest warning in the paper is about what to avoid. Tools that make code easier to understand without helping with trust calibration may speed up low-stakes reviews. But they leave the more serious failure untouched: reviewers spending their effort on low-risk code and missing the high-risk parts.13

Why this lands now: the data on review strain

The framework would be academic if review were working well. Across this year's industry telemetry, the evidence points clearly the other way. Faros AI's 2026 report, built on two years of data from about 22,000 developers, found that under heavy AI adoption:

• task throughput per developer rose 33.7%
• median time in review rose 441.5%
• pull requests merged with no review rose 31.3%7

The same data shows PRs about 51% larger, with 54% more bugs per PR.4

LinearB's analysis of 8.1 million pull requests points the same way. At the 75th percentile, AI-assisted PRs ran past 400 lines, against 157 for unassisted work. Agentic PRs waited more than 16 hours on average before a reviewer picked them up.7 Only 32.7% of AI-generated PRs merged within 30 days, compared with 84.5% of unassisted ones.7 CircleCI data cited by Codacy shows feature-branch throughput up 59% year over year, while throughput on the main branch fell for the median team.6 More code is being written, but no more of it is reaching production.

The quality evidence adds to the pressure. CodeRabbit studied 470 open-source pull requests and found AI-co-authored changes averaged 10.83 issues per PR, against 6.45 for human-only PRs. Logic and correctness problems were 75% more common.5 Veracode's 2026 testing found that frontier models produce code that compiles almost every time but is secure on only 15% of cross-site scripting tasks.8 JetBrains' point that AI output "all looks the same" matters most here: code that looks plausible but is wrong is exactly what an evenly confident diff hides.

One caution is worth keeping. The July 2026 studies summarized on daily.dev found that AI-generated PRs get less scrutiny and faster merges, but said raw code quality hadn't measurably dropped. Their concern was weaker review discipline.10 On balance, the evidence supports JetBrains' framing more than any simple story about AI writing worse code. The problem is that review effort is in the wrong places.

How the current AI code review tools measure up

JetBrains is careful to credit existing products with parts of its design:

• CodeRabbit writes prose walkthroughs of pull requests.
• Claude Code sends out several reviewer agents that tag findings by severity.
• Graphite's stacked pull requests split large changes into separately reviewable units, the closest match to the paper's "chunk" idea.
• GitHub now publishes guidance on reviewing AI-generated code and says Copilot-assisted review already accounts for more than a fifth of reviews on the platform.1

Faros reports a similar figure: about 25% of PRs were reviewed by an AI agent in 2026, up from essentially none in 2025.4

The vendors' recent moves show how close they are getting to the framework, and how far they still have to go.

• GitHub Copilot. Copilot's reviewer became agentic in March 2026. It now explores the repository and traces cross-file dependencies before commenting, and can pass findings to the coding agent to open a fix PR.21 Review moved to usage-based billing on June 1, 2026, drawing on AI Credits plus Actions minutes. It is no longer a free extra on a seat.16
• Cursor Bugbot. Bugbot's June 10 update cut average review time from about five minutes to 90 seconds. Cursor says it also finds about 10% more bugs per run. The update added a /review command that runs before code is pushed.21 Cursor dropped Bugbot's seat fee in May and moved to roughly $1.00–$1.50 per run. Because it bills per run and reviews every push by default, costs can climb.21 Some comparison guides still list the older $40-per-user add-on price, which looks out of date.142021 Cursor's December 2025 purchase of Graphite also means Bugbot and Graphite's reviewer are being merged.20
• Claude Code Review. Anthropic's reviewer runs a group of specialized agents over a PR with the full codebase as context. It tags findings by severity and deliberately neither approves nor blocks merges.21 It costs $15–25 per review on top of a plan. Anthropic says 84% of PRs over 1,000 lines get findings, with fewer than 1% marked incorrect.16

Severity tags and risk-aware agents are a step toward the file-level risk ranking JetBrains wants. But JetBrains' own assessment is blunt. No current tool enforces, or even suggests, the order of overview before files, files before lines, and risk ranking before detailed reading.1 Most of these products still post comments on top of a diff, which is the habit the paper says no longer works.

The benchmark problem shows the trust gap

The tool-accuracy figures themselves are hard to trust, which supports JetBrains' case. Cursor Bugbot scored 58% in Greptile's July 2025 test.16 A rescoring by CodePulse found 28.2% defect recall at 84.2% precision.15 DeepSource's own test harness put Bugbot at 87.8% recall.20 Claude Code scored 90.7% precision but only 47.6% recall in that same DeepSource test.20 That sits awkwardly beside Anthropic's own sub-1% incorrect rate.16

These numbers don't necessarily contradict each other. Precision and recall measure different things, and each vendor builds a test that suits its strengths. Still, a team picking a reviewer bot cannot easily tell how much to trust its silence. That is trust calibration again, one level up.

The social side: accountability

An arXiv survey of 239 practitioners, also published in October, adds a point the JetBrains framework only touches on. Reviewers did not reject AI-authored PRs outright. They based their effort on whether the PR came as an accountable contribution: limited scope, a stated rationale, validation beyond CI, and a named owner after merge.9 About 60% said they asked for validation evidence such as tests, logs or local runs.9 Only 9% said they used AI tools to triage reviews.9

This suggests trust signals can come from people as well as tools. A clear human owner and a risk-specific bundle of evidence can supply what an LLM can't.

The takeaway

In our reading, JetBrains has named the right problem. The race among Copilot, Cursor, Claude Code and the startups has mostly been about catching more bugs, more cheaply, in less time. The data on review strain suggests that is not enough. Merges without review are rising, and AI-generated PRs wait days. The next useful step is a reviewer that tells a human where to look, not one that piles more comments onto a large diff.

Until tools do that, the practical advice that follows from this coverage is simple. Before reading any agent-written change line by line, rank its files by risk and spend your close reading on the riskiest ones.3