AI code has reached enterprise parity; review workflows are the bottleneck

The data. Greptile, which reviews over a million pull requests a month for companies like Nvidia, Coinbase, and Datadog, looked for signs that a PR was fully or largely generated by AI. After filtering by author fields, co-authored footers, and branch naming, it found that about 25% of enterprise PRs now carry those signals. A year earlier the number was under 1%. The growth looks continuous, with no visible jumps tied to new model releases.

The quality claim. Revert rates were the first test. Codex PRs were reverted at 1 per 1,000, Devin at 3.5 per 1,000, and humans at 2.5 per 1,000. Bug findings from Greptile's review agents showed no consistent human advantage: three of the four agents produced fewer P0 issues than humans, and review iterations before merge were nearly identical. The speaker expected humans to win; the data did not show it.

The failure pattern. The more useful signal is that agents fail differently, not more often. Claude-generated code was about 1.5x more likely to contain SQL injection issues in Greptile's comments, while Devin was roughly half as likely as humans to produce auth bypass problems. For engineering teams, that means one generic review checklist is the wrong response. Review guides should be tuned to the specific agent models in use.

The volume problem. Median Greptile users open about 50 PRs a month, the 90th percentile opens 500, and the 99th percentile is in the thousands. Manual review, plus traditional QA, cannot scale to that without becoming the bottleneck. Greptile says almost a fifth of the PRs it reviews are merged without any human review or testing. That number should be read carefully, because Greptile sells automated validation and has an incentive to make it look safe.

The caveats. The evidence is real but self-reported from Greptile's own platform, and the attribution method is indirect. 'Largely AI-generated' is not the same as 'fully autonomous,' and the sample skews toward companies that already use AI-assisted workflows and Greptile. Revert rate is a crude quality proxy; a PR can be bad and never get reverted. The data is a useful directional signal, not an independent benchmark.

The consequence. Engineering leaders should not spend the next quarter debating whether agents are 'good enough.' They are already in the enterprise pipeline at meaningful volume. The operational question is how to redesign review, testing, and merge governance for 500 PRs a month from a single developer. That is an organizational and process problem, not a model capability problem.