How the Claude Code team does code review
Confirmed
The takeaway
From June to September merged PRs more than doubled while the share reverted fell by more than 40%.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 3 of 5
- Last verified
- 17 October 2026
Your AI and this story
- GPT-6 Astra168 days after its cutoff
- Claude Opus 5.5107 days after its cutoff
- Gemini 4 Argon198 days after its cutoff
- Grok 4.7137 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 107 days before it.
Key facts
- Scale: ‘Claude writes about 90 percent of Claude Code’s own code’; in Anthropic’s monorepo, changes landing per day went from about 2,500 in May to more than 30,000 in September 2026
- Outcome: from June to September, merged pull requests to Claude Code’s codebase more than doubled while the share that had to be reverted fell by more than 40 percent
- Risk tiers set by a classifier from the change, not the author: low (docs, copy, flagged additive changes) needs no human approval once automated and security reviews are green; medium needs one person; high and some fixed paths (CI workflows, auto-updater, billing) need two. ‘An agent’s approval never counts as a person’s’
- AI review: parallel bug-hunting agents, a separate group votes on each finding, survivors posted by severity; open findings from the bug or security review block the merge. During the research preview the share of internal PRs with substantive review comments rose from 16% to 54%
- Runaway loops: one CLI PR went through ‘more than fifty rounds of review and fixes overnight’; about 59% of what the reviewer kept flagging was pre-existing code. After a three-round cap and diff-only re-review, first-round pass rate rose from 65% to 78%, PRs needing five or more rounds fell from 8.9% to 1.5%, mean reviews to pass from 2.08 to 1.32
- Past incidents and reverts form an expert-checked eval set that the reviewer runs against daily; every change to its prompts, tools or model is scored against it
- Authors: Addy Osmani, Morgan Westlee Lunt and Qing Wang; quotes Boris Cherny that giving Claude a way to verify its work makes results ‘two to three times better’
- Reception: Hacker News front page, 285 points and 52 top-level comments by Oct 17; sceptical comments cite the Claude Code GitHub repo’s issue count and question 30,000 merges a day
What happened
The post, published Oct 15, 2026 on Anthropic’s claude.dev blog, says the team stopped treating “did a human read the code?” as the goal and instead optimises for the least human review time that does not raise revert or incident rates. Most review happens before a pull request exists (Claude runs tests and a fresh-context subagent reviews the diff); every PR then gets required CI, a Claude bug review, a separate security review, risk-based human approval, a merge queue, feature flags, internal use first and a staged release.
Humans keep five kinds of decision: whether to build something at all, risky code, architecture that sets patterns, reading the evidence, and owning the outcome. The authors say Anthropic has no circuit breakers yet that tighten approval when revert or incident numbers move, and that engineers want them before more code moves to zero-human merges.
Why it matters
It is a first-hand account from a frontier lab of what software engineering looks like when agents write most of the code: some production changes now merge with no human approval, and the bottleneck has moved from writing to checking. The numbers on review loops (fifty overnight rounds, a round cap) are a concrete example of agent-to-agent interaction problems.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 1 primary, 1 reaction
Primary
- claude.dev: How the Claude Code team does code review (Oct 15, 2026)claude.dev, official
Reactions
- Hacker News discussion (285 points)news.ycombinator.com, discussion
Changes
- Filed (read the claude.dev post and the HN thread via Algolia)