AI Code Review Tools Lag Behind AI-Generated Code Volume

A verification problem hiding in plain sight

AI coding assistants have become routine, but reviewing what they produce has not kept up. That mismatch is the problem JetBrains' Human-AI eXperience (HAX) team and Lund University researchers set out to address with a new conceptual framework for code review tools built around AI-generated code 4. The work rests on a participatory design study with 17 practitioners and a follow-up survey of 43 software professionals. It is due to be presented at the Empirical Software Engineering International Week in October 2026 4.

The central idea is that review tools should surface risk and confidence signals "at the actual granularity where developers put their attention," rather than presenting a generated change as one undifferentiated diff 4. Recent survey and platform data suggest that gap is real and growing.

Distrust without verification

Sonar's 2026 State of Code survey of more than 1,100 developers offers the most direct evidence. AI assistance is close to universal for writing new code: 90% of developers use it for that task. Yet only 55% of those users rated it "extremely or very effective" 1. Sonar describes a pattern of heavy use paired with selective confidence. Developers lean on AI for documentation and tests but trust it less with complex, existing codebases 1.

An analysis of the same survey by Hyrax pulls out the starkest contrast. About 42% of committed code is now AI-generated or AI-assisted, and 96% of developers don't fully trust it. Even so, only 48% say they always verify that code before committing 2. In addition, 38% report that reviewing AI-generated code takes more effort than reviewing a colleague's work 2. Hyrax argues the numbers describe a quality-control system that "has already broken down" 2. That framing is sharper than Sonar's own, which presents the issue as a question of trust rather than a failure 1.

The consequences of skipped review show up in security testing. Hyrax cites a Veracode Spring 2026 study of 80 coding tasks across four languages. Roughly 45% of AI-generated samples introduced an OWASP Top 10 flaw when the model received no explicit security guidance. Cross-site scripting was handled securely only 15% of the time, and log injection just 13% 2.

GitHub's numbers: scale, with caveats

GitHub's own figures show how quickly automated review has spread. As of March 5, 2026, Copilot code review accounted for more than one in five code reviews on GitHub. More than 12,000 organizations ran it automatically on every pull request 3. GitHub also says Copilot surfaced actionable feedback in 71% of reviews 3.

Quash, which compiled these statistics, adds caveats worth repeating. The one-in-five figure measures activity on GitHub, not a global adoption rate. The 71% figure is a product metric, not an independently audited measure of precision, recall, or defects prevented 3. Quash also notes that other adoption estimates diverge widely depending on who is measured. Jellyfish reports 51.4% within its platform population, and Techreviewer found 70.1% in a survey covering a broader "code review and optimization" category 3. No single market rate exists.

Read together, these numbers point to a recursive loop. AI writes a growing share of code, and AI increasingly reviews it, yet the people accountable for that code report low trust and inconsistent checking. Frequent flagging of actionable items does not show that the riskiest parts of a change are reaching human attention.

Where the HAX framework fits

The JetBrains researchers place their proposal against tools that already cover parts of the problem [4]:

• CodeRabbit writes prose walkthrough summaries of pull requests.
• Claude Code runs multiple reviewer agents that tag findings by severity.
• Graphite's stacked pull requests split large changes into independently reviewable units. The team calls this the closest analogue to its "chunk" concept, though Graphite works across multiple PRs rather than breaking down a single generated proposal.

The gap the framework targets is in how review is structured, not in how much it detects. Breaking an AI-generated change into reviewable chunks and attaching confidence signals to each could help with the extra effort 38% of developers report 2. It could also direct scrutiny toward the classes of flaws Veracode found models routinely miss 2.

The takeaway

In my reading, the evidence points to an interface problem more than a model problem. Developers already distrust AI output, so persuading them to be skeptical is not the hard part. The hard part is making skepticism cheap enough to apply consistently. GitHub's scale shows automated review is now embedded in everyday workflows 3. Sonar's data shows that developers' confidence has not followed 1.

The HAX framework is still a conceptual proposal from a modest study sample, and its practical value will depend on whether tool-builders adopt it 4. Its premise is the right one, though. As AI-generated code grows, review tools need to show developers where to look, not just what a model found.