AI Code Review Tools: Bugbot Leads One Test as Claude Review Hits GA

The headline result, and why it holds up only partly

Cursor's Bugbot is having a good October. In a hands-on comparison published by Codewalkers this month, Bugbot came first among AI pull-request reviewers and OpenAI's Codex finished a close second. On Codewalkers' own pull requests, Bugbot found more high-severity and security problems and flagged more edge cases than the other tools it was tested against.1 Codex earned second place by catching a different kind of mistake: content errors, such as a wrong price hard-coded into a page, which other reviewers passed over. The cost was that Codex sometimes spent effort on issues too minor to justify blocking a merge.1

Read on its own, that sounds like a clear winner. Read next to the rest of 2026's benchmark coverage, it means something narrower but still useful. Bugbot isn't the clear best AI reviewer. What stands out is how consistently it lands near the top across tests that disagree about almost everything else.

Benchmarks disagree wildly, but Bugbot stays near the top

AI code review benchmarking in 2026 is a mess. One roundup that put every published benchmark side by side found the same tool scoring anywhere from 36% to 82% depending on who ran the test. Bugbot alone ranged from an F1 of 49% to 80.5% across two benchmarks.3 Most of these tests also come from vendors, and almost every vendor ranks its own product first. Propel's benchmark puts Propel on top with a 64% F-score.6 DeepSource's CVE-based test puts DeepSource first at 84.51% F1.8 Macroscope's 2025 tool benchmark gives Macroscope the top detection rate at 48.31%.9 CodePulse's re-scoring of Greptile's benchmark puts CodePulse ahead of everyone.2

The useful signal is who keeps finishing second. Bugbot was runner-up in Propel's report at 49% F-score6, second in DeepSource's test of 165 real CVEs at 80.45% F18, and third in Macroscope's tool-level ranking at 42.37%9. In CodePulse's re-scoring, it was the one rival the authors called disciplined, with 84.2% precision but only 28.2% recall when every real defect was counted.2 An independent three-week test on dev.to ran four reviewers in parallel across 146 pull requests. Bugbot recorded a 4.8% false-positive rate and 22 high-or-critical catches. The team dropped it over pricing, not quality, and said it would turn it back on the same day if the bundling changed.7

Codex's profile is consistent too, and it matches the Codewalkers finding. In Propel's benchmark, Codex Code Review tied for the best precision at 68% but had the lowest recall of the group at 29%. In other words, it is accurate when it speaks but misses a lot.6 DeepSource put Codex at 77.70% F1, a few points behind Bugbot.8 CodePulse said Codex was the only tool that consistently caught backward-compatibility problems and called it strongest on backend Python.2

Our reading: if you are deciding on a reviewer that may block merges, a strong precision-and-severity record across hostile benchmarks matters more than any single first-place finish. On that measure, both Bugbot and Codex do well. Bugbot has the edge on catching more issues, and Codex has the edge on fewer false alarms.

Claude Code Review goes GA and competes on speed and control

The biggest product news this month came from Anthropic, not Cursor. On October 15, Anthropic moved Code Review out of research preview and made it generally available to Claude Team and Enterprise organizations.30 Anthropic says most reviews now finish in 6–10 minutes, down from about 20 during the preview. Admins can also set the review depth (Quick, Standard or Deep) separately for each repository.2129 Eligible Enterprise customers can claim at least $10,000 in review credits by January 15, 2027. The credits expire 30 days after they are claimed.30

The product launched in March with a multi-agent design. Several agents examine a pull request in parallel, and a verification step then tries to disprove each finding before anything is posted.23 Anthropic's launch data said the share of its internal PRs getting substantive comments rose from 16% to 54%, and engineers marked fewer than 1% of findings as wrong.26 Those are Anthropic's own numbers, and one analysis pointed out that a finding nobody disputes may also be a finding nobody acts on.28 Coverage of the GA release also noted that Anthropic gave no numbers to back its claim of better bug detection.21

Independent results for Claude are mixed. DeepSource's CVE benchmark put Claude Code at 62.40% F1, well behind Bugbot and Codex.8 On the Martian online benchmark cited by cubic, the Claude GitHub App ranked sixth at 60.2%, just behind GitHub Copilot at 61.0%.28 Price is the other sticking point. Reviews average $15–25 each in usage credits, on top of the plan.28 One estimate put a 100-developer team at roughly $40,000 a month at the midpoint.26 Anthropic's pitch seems to rest on fitting into existing workflows and the size of its install base, not on topping leaderboards. Claude Code's run rate was reported at over $2.5 billion early this year.24

GitHub Copilot builds review into the platform

GitHub took a different route. Copilot code review moved to an agentic, tool-calling architecture on March 5, 2026. It now pulls in wider repository context before commenting, and it is generally available across Pro, Pro+, Business and Enterprise plans.11 Coverage repeats GitHub's figures: more than 60 million reviews, with 71% producing actionable feedback and an average of 5.1 comments.1718 The feature list has grown steadily since then. AGENTS.md support arrived in June20, and agent skills and read-only MCP server connections became generally available on July 29.13 GitHub's changelog also shows that Copilot review gained the ability to approve pull requests on September 1.11 Cubic describes approvals as being in public preview and off by default.28

The trade-off is noise. CodePulse measured Copilot's precision at 35.3%, meaning it posts many comments to surface relatively few real defects.2 Copilot's real advantage is location. Review, the coding agent and fix generation all happen inside GitHub, so the reviewer can pass a flagged issue to the agent, which drafts a fix PR.12 Some reporting conflicts on details. One guide says code review requires Business or Enterprise plans14, while GitHub's own changelog lists Pro and Pro+ as well.11 The changelog is the more reliable source.

Pricing has become the real battleground

The main shift in 2026 is how these tools charge, more than how they score. One comparison says Bugbot has been billed on usage since May 2026, with a historical estimate of about $1.00–1.50 per run.1 An earlier guide listed it at $40 per user per month.2 Claude bills per review28, and since June 1, Copilot reviews also consume AI credits and Actions minutes.28 Codex reviews count against ChatGPT or Codex plan usage, and a new Code Review view in the ChatGPT desktop app, added September 29, can post a comment, approve, or request changes.1 Flat-rate options have become a selling point. CodeRabbit's predictable per-developer pricing is cited as its main advantage.1

The trend is clear: teams are moving from per-seat pricing to paying per pull request. That rewards reviewers that stay quiet unless something matters, which is why precision figures like Bugbot's 84.2%2 or Codex's 68%6 may matter more than raw catch rates.

The context: AI writes the code, and AI is now asked to check it

All of this comes back to one pressure: coding agents produce pull requests faster than people can review them.25 Cubic's Bug Bench data shows how concentrated code generation has become. In the code it reviewed during the week of October 5, Claude Code wrote 78.1% of the AI-generated code, Codex 18.8% and Cursor's agent just 1.6%.4 Cursor's share has stayed under 4% every week since mid-August.5 That data covers only cubic's customers, but it points to a notable split. Cursor's strongest position right now may be as a reviewer of code written by other companies' agents, not as an author.

For engineering leads, the takeaway is to run your own test. The benchmark spread is too wide to trust any single leaderboard3, and the dev.to team's side-by-side trial on real pull requests7 is a better model than any vendor chart. Right now, Bugbot is the strongest candidate for catching severe bugs, Codex for precision, Copilot for staying inside GitHub, and Claude for teams already paying for Claude Code.