AI tools are already reviewing other AI tools' pull requests on GitHub. New data on 248,641 PRs shows how often, how fast, and how differently.
Across 248,641 GitHub pull requests that received at least one AI-authored code review, 45,269 were reviewed by a different AI product than the one that wrote the code: CodeRabbit checking a pull request Claude Code opened, Copilot checking one OpenAI Codex opened, and pairings like it. That cross-product AI-to-AI review volume grew by more than two orders of magnitude between the first and third quarters of 2025, even though it still accounts for only about 1.6% of all agent-authored pull requests on GitHub the researchers could identify.
These numbers come from a new peer-reviewed study, accepted at ESEM 2026, by researchers Niruthiha Selvanayagam and Taher A. Ghaleb. The paper mined GitHub's public history for pull requests where both the author and at least one reviewer could be attributed to a specific AI coding or review product, then split that population into two groups: same-product review, where the tool that wrote the code also reviewed it, and cross-product review, where a different tool did the reviewing. Nobody designed the pattern the data reveals. It emerged on its own, across tens of thousands of repositories each running whatever review bot happened to be wired in, against whatever AI product had opened the pull request.
Sources: AI-to-AI Code Reviews of GitHub Pull Requests, arXiv:2608.21311
How the Study Identified an AI Reviewer
Attributing a pull request or a comment to a specific AI product is harder than it sounds, so the authors built a two-tier signature framework instead of trusting branch names or titles. A high-confidence body signature, a co-author line like "Co-Authored-By: Claude" or a vendor's own URL pattern inside the PR body, qualified a tool as author or reviewer on its own. A second tier matched exact, vendor-controlled bot account logins, such as coderabbitai[bot], with or without body evidence required. Branch-name prefixes alone did not count. The reviewer-side list ran to twelve products: CodeRabbit, Copilot, Gemini Code Assist, OpenAI Codex, Amazon Q, Devin, Claude Code, Sweep AI, PR-Agent, Kiro, Cursor, and Aider. The author-side list added Google Jules, for thirteen.
How Common Is Cross-Product AI Code Review on GitHub?
Cross-product review is still the exception, not the norm. Of 2,830,284 agent-authored pull requests the study could identify, only 45,269, about 1.6%, picked up a review from an AI product different from the one that wrote the code. The trend line is steep, though. In the first quarter of 2025, the dataset held just 57 cross-product reviews and 40 same-product reviews. By the third quarter, those counts had risen to 25,492 cross-product and 57,080 same-product pull requests, growth the authors describe as "more than two orders of magnitude," and by raw count a roughly 447x jump in cross-product volume in nine months.
- OpenAI Codex authored 31,601 of the cross-product pull requests studied, close to 70% of all cross-product volume.
- Copilot was the single most common cross-product reviewer, appearing in 21,022 reviewer pairings.
- The single most common pairing overall was Codex-authored, Copilot-reviewed: 18,114 pull requests.
Most Tools Still Mostly Review Their Own
Most AI coding tools almost never get checked by a different AI product. Copilot-authored pull requests get a same-product review 95.7% of the time, Amazon Q's rate is 91.8%, and Devin's is 76.5%. OpenAI Codex is the outlier among frequently-authoring tools, splitting almost evenly at 54.1% same-product. At the other end, a few products are reviewed almost exclusively by something else: Cursor-authored pull requests picked up zero same-product reviews in the dataset, Claude Code's same-product rate was 0.5%, and Google Jules's was 0%. Whether a given pull request ends up with a same-product or cross-product review looks less like a deliberate choice by anyone and more like a byproduct of whichever bot a repository happens to have wired into its CI or its default review settings.
When a Different Bot Reviews the Code, It Reviews Differently
The clearest behavioral difference in the study shows up in what CodeRabbit does depending on who wrote the code under review. CodeRabbit tags its own comments into categories, including "refactor suggestion," for working code whose structure could improve, distinct from a "potential issue" (a suspected bug) or a "nitpick" (minor style). On Claude Code-authored pull requests, 35.0% of CodeRabbit's comments were refactor suggestions. On Copilot-authored pull requests, that figure was 10.5%, a 24.5 percentage point gap the authors report as statistically reliable (95% CI: 23.1 to 25.9 points). The same reviewer product, pointed at code from two different sources, focused on structurally different things.
Cross-Product Reviews Arrive Faster, With a Catch
Cross-product reviews also showed up faster: a median of 1.2 minutes after the pull request opened, against 4.7 minutes for same-product reviews. The spread was wide on both sides (cross-product ran from 0.4 to 4.4 minutes at the 25th and 75th percentiles; same-product ran from 2.4 minutes out to 38.2 minutes). The authors flag that this comparison is not clean: only 31.9% of same-product pairs retained complete timestamp data, against 79.2% of cross-product pairs, so part of the gap may reflect which reviews had recoverable timestamps rather than a genuine speed difference between reviewing familiar code and unfamiliar code.
A separate comparison isolated four products, Copilot, OpenAI Codex, Devin, and Amazon Q, that had each authored at least 200 pull requests and also reviewed at least 200, letting the researchers compare a tool's behavior as a same-product reviewer against its own behavior as a cross-product reviewer. In three of the four cases, same-product review produced meaningfully more comments per pull request: Copilot left 58% more (1.49 versus 2.35 mean comments), Devin left 65% more (1.09 versus 1.80), and Amazon Q left 64% more (4.94 versus 8.08). OpenAI Codex was the exception, with a negligible difference (0.91 versus 0.89). The effect sizes were small to negligible by Cliff's delta (0.02 to 0.27), meaning the gap concentrates in a heavier tail of unusually chatty pull requests rather than shifting the whole population.
The same reviewer product produced a 24.5 point swing in what it flagged, and a 58 to 65% swing in how much it said, depending only on which tool wrote the code it was looking at.
Descriptive Data, Not a Design Recommendation
None of this is a case for or against running several AI reviewers on purpose. It is a measurement of what is already happening across GitHub's public repositories, mostly because different teams wire up different bots for different reasons, not because anyone architected a review pipeline around product diversity. That is a separate question from whether deliberately assembling multi-agent code review with distinct, independent lenses catches more defects than a single reviewer, or from what a purpose-built LLM review council looks like when the reviewers are chosen and framed on purpose. An unplanned ecosystem producing more cross-pollinated review than it used to, and a deliberately structured, independently-framed multi-reviewer process, are two different things, and 45,269 pull requests getting the first one says nothing about the second.
What the Authors Say This Does Not Prove
The paper is careful about what its own numbers can and cannot support. The authors describe their findings as "observational associations rather than causal effects," and note that CodeRabbit's differing refactor rates "may stem from the pull requests themselves rather than the reviewer": PR size, programming language, repository conventions, and how deeply a product integrates with a given repo could all be driving a pattern that looks reviewer-level but might not be. They also flag that their counts are lower bounds, since attribution depends on catching a signature in the data, and that rates calculated per identified AI-authored PR describe the attributable population the signatures caught, not every AI-authored PR on GitHub. None of that undercuts the headline numbers: the growth is real, the percentages are real, and the study documents a pattern nobody planned for.
Cross-Product vs. Same-Product Review, Side by Side
| Dimension | Cross-product review | Same-product review |
|---|---|---|
| Share of identified agent-authored PRs | 1.6% (45,269 PRs) | About 7.4% (208,145 PRs) |
| Growth, 2025 Q1 to Q3 | 57 to 25,492 PRs (about 447x) | 40 to 57,080 PRs (about 1,427x) |
| Median review latency | 1.2 minutes | 4.7 minutes |
| Most common pairing | Codex authored, Copilot reviewed (18,114 PRs) | Copilot authored, Copilot reviewed (95.7% of its own PRs) |
What this data actually argues for is not "add more bots," it is "don't mistake an accident of tooling for a review strategy." A repository that happens to route a Claude Code pull request through CodeRabbit gets a 35% refactor-comment rate by chance of configuration, not because anyone decided refactor coverage mattered more for that codebase than for the Copilot-authored PR next to it. TLM Forge takes the opposite approach on purpose: reviewers are assigned distinct roles by design, a threat-modeler at design time and a red-team pass against the finished diff, and a change does not ship because a scored gate returns a critical-issue count of zero, not because whichever bot happened to fire first approved it.
Frequently asked questions
01What is AI-to-AI code review?
It is when one AI coding or review product reviews a pull request a different AI product authored, for example CodeRabbit reviewing a PR that Claude Code opened. A study of 248,641 GitHub PRs found 45,269 fit this cross-product pattern, versus 208,145 reviewed by the same product that wrote the code.
02Is cross-product AI review common on GitHub?
Not yet. It made up about 1.6% of all agent-authored pull requests the study could identify, even though volume grew by more than two orders of magnitude between the first and third quarters of 2025, rising from 57 pull requests to 25,492 in that window.
03Do different AI reviewers focus on different things?
Yes, in at least one measured case. CodeRabbit flagged 35.0% of its comments as refactor suggestions on Claude Code-authored pull requests, versus 10.5% on Copilot-authored ones, a 24.5 percentage point gap the study reports as statistically reliable.
04Does cross-product review happen faster than same-product review?
The study measured a 1.2 minute median latency for cross-product review against 4.7 minutes for same-product review. The authors caution that incomplete timestamp data on same-product pairs may explain part of that gap, not just review speed.
05Does this study prove multi-vendor AI review catches more bugs?
No. The paper reports observational associations, not causal effects, and makes no claim about code quality. It documents that an unplanned ecosystem pattern exists and is growing fast, not that the pattern produces better review outcomes than a single reviewer would.