code reviewers

Linux kernel maintainer Greg Kroah-Hartman is featured in a talk about security in the LLM age, examining how large language models affect the security of the software supply chain and open-source development. The discussion touches on risks that AI-generated code poses to kernel-quality standards and how maintainers can respond to an influx of machine-produced patches.

A discussion thread on Hacker News asks whether developers are genuinely producing good code with AI coding agents. The question invites engineers to share real-world experiences with tools that generate code, amid ongoing debate about whether AI-assisted programming delivers maintainable, reliable results or mostly creates extra review work.

A developer has released Perspica, an open-source tool that produces semantic diffs of code, aiming to show what changes mean rather than just which lines were altered. The project, available on GitHub, is being discussed on Hacker News, where early commenters are weighing its usefulness for pull request reviews and how it compares to standard line-based diffing.

System76 has announced that its COSMIC desktop projects will no longer accept code submissions containing LLM-generated content. The Linux hardware and software developer says contributions must be written without AI assistance. The move reflects a growing frustration among open source maintainers, who argue that machine-generated code adds review burden and quality problems while contributors submit pull requests that are difficult to verify or maintain.

OpenAI has made its automatic code review feature free for all Codex users. The tool reviews code changes automatically, giving developers feedback without a paid tier. The move is being discussed as a way to pull more developers into OpenAI's coding ecosystem at a time when automated code review and AI coding assistants are a highly competitive market.

Orbi, an AI coding agent, reportedly takes a GitHub issue and returns a reviewed, merged pull request, with one agent writing the fix and another handling review. A follow-up post examining the system's harness asks what its reviewer missed, suggesting developers are scrutinising how reliable the automated pipeline is. The discussion is drawing interest from the open-source and AI engineering communities.

A developer has released CodeDiff, an open-source code comparison tool that claims to produce syntax-aware diffs in under 100 milliseconds with 99.95 percent robustness. The tool is available on GitHub and is being presented to the Hacker News community for feedback and scrutiny.

Developer Kitallis has released hutch, an Emacs interface for doing local code reviews within Magit, aimed at developers who prefer reviewing code without leaving their editor or relying on hosted platforms. The tool is being shared among open-source communities, where it has drawn modest attention from Emacs and programming enthusiasts interested in lightweight, editor-based review workflows.

Meta moved quickly to fix a virtual machine escape vulnerability in its Muse system before the product launched, according to a report by Gadget Review. A VM escape flaw would let malicious code break out of a sandboxed environment and access the host system, making it a serious security concern. The fix suggests the issue was identified during pre-launch testing, though details on severity or discovery remain limited.

IBM's AI-powered vulnerability clearinghouse has identified hundreds of security flaws in Java software. The finding highlights the growing role of artificial intelligence in scanning open-source code for vulnerabilities at scale, giving developers advance warning of weaknesses that attackers could exploit. Security teams are expected to review the affected Java components.

System76, the company behind the Pop!_OS Linux distribution, has banned AI-generated code across many of its COSMIC codebases, the desktop environment underpinning the operating system. The decision bars contributions written by AI tools from large parts of the project, with developers expected to write and review code themselves. The move is drawing attention and debate among open-source developers weighing code quality, licensing and trust issues around AI-assisted programming.

Engineers are discussing how software systems can fail despite clean code, elegant abstractions, well-designed APIs, automated tests and polished deployment pipelines. The argument is that even code that passes every review can start behaving strangely once user numbers grow, meaning architecture tends to break under real-world load rather than at obvious design flaws. The observation is resonating with developers who have seen theoretically sound systems collapse in production.

GitHub has introduced ReviewBench, an open benchmark for measuring how well AI models perform code review. The benchmark is intended to give developers and researchers a standard, reproducible way to compare the quality of AI-generated code review feedback, as AI assistants are increasingly used in real software development workflows.

A new tutorial walks developers through creating their first 'agent skill' — a set of house rules that tells an AI coding assistant how the team works, from commit message formatting to what a code review must include. The guide is aimed at developers integrating AI agents into everyday software workflows and is being shared in programming and productivity communities.

A developer has kicked off a written series on why open-source and team code contributions are so hard to review, opening with the familiar experience of deciphering vague commit messages like "fix stuff" and digging through git blame for hours. The piece promises to explore the reasons behind poor pull request hygiene, and early readers are sharing their own frustrations with undocumented code changes.

Engineer Alexey Indeev has written that he no longer reviews code produced by his AI agents, and describes the alternative workflow he uses instead in a Substack essay. The piece has drawn modest attention on Hacker News, where developers are weighing whether traditional code review still makes sense as more work is delegated to autonomous coding agents.

A new project called oh-my-agent has been presented on the German Ubuntu users forum, describing how existing code agents can be used to carry out automated project reviews. The thread, published under the Linux and open source sections, explains how developers can apply the tooling to check their current codebases. Responses so far appear limited, with the discussion still in an early stage.

Former OpenAI researcher Andrej Karpathy argued on X that as AI writes more of the code, the programmer's job shifts from typing to reviewing and supervising the machine's output. The remark is circulating among developers, many of whom see it as a fair description of how AI coding tools are already changing day-to-day software engineering and what skills will matter next.

A discussion circulating among developers examines what happens when you prompt an AI coding assistant to write a service that processes bulk user telemetry, validates incoming records and handles batch publishing. The code arrives within seconds and looks clean, but the point being raised is that polished syntax and modern structure can mask problems in how the service actually behaves, encouraging engineers to look beyond surface quality when reviewing machine-generated code.

A newly disclosed vulnerability in Microsoft Exchange Server, tracked as CVE-2026-96940, carries a high severity score of 8.8. Security researchers say an authenticated attacker could bypass authorization checks and read other users' mailboxes and attachments within the same on-premises Exchange organisation. The flaw does not allow pre-authentication remote code execution, but experts are warning administrators to review exposure and patch promptly.

OpenAI's Codex, the company's AI coding agent built on its GPT models, is generating renewed discussion as developers and tech commentators weigh it against ChatGPT. The conversation centres on how the two tools fit together: ChatGPT as the general assistant and Codex as a specialised tool for writing and reviewing code inside developers' workflows.

Researchers at ThreatDown have analyzed the new Carbonato botnet, which compromises poorly secured Docker hosts. The malware targets systems where the Docker API is exposed without authentication on port 2375, taking over containers and using AI-generated code in its operations. Security teams are being urged to lock down exposed Docker APIs and review firewall rules to prevent infections.

Heise is hosting a live webinar on developing, deploying and reviewing software with AI coding agents in Xcode. The session covers Claude Code, GitHub Copilot and OpenAI Codex, with a focus on using the tools without compromising security or data privacy. The announcement is circulating among developers interested in AI-assisted programming workflows.

A developer is offering a paid human second-pass review of AI-generated pull requests, and says they reviewed three AI-written PRs from public repositories before pitching the service, which they call Riven Desk. The idea taps into growing concern that AI-written code is being merged without careful human scrutiny. Commenters in programming and engineering communities appear engaged with the question of how much review AI code actually needs.

A software developer describes an AI coding agent that publicly identified and corrected an error in its own fix, with two other agents then reviewing and validating the correction. The account, shared in a developer community under tags like AI, agents and programming, highlights the emerging practice of multi-agent workflows where one AI's output is checked by others before being accepted.

A newly shared engineering write-up describes building an edge-agentic commit analyzer, a tool that reviews code commits locally using AI agents running on local hardware rather than cloud services. The piece focuses on troubleshooting stubborn errors that arise in local environments. Reaction so far is limited, but the topic touches on ongoing developer interest in running AI coding tools offline for privacy and cost reasons.

Developers are debating how to handle pull requests written with the help of AI coding agents. The discussion, circulating among programmers and engineering managers, asks how thoroughly reviewers should scrutinise such contributions, weighing whether agent-written code deserves the same depth of review as human work and what that means for team standards, trust and inclusive review culture.

DoorDash has moved its AI engineering agents from developers' laptops to Flux, a cloud-based platform that now handles around 130,000 automated tasks a month, including roughly 25,000 weekly code reviews. The system runs agents in isolated micro virtual machines and cloud sandboxes designed to keep autonomous code operations secure. The scale of deployment is drawing attention as one of the larger corporate examples of AI agents doing routine software engineering work.

A developer has published findings that CodeRabbit, a popular AI-powered code review tool, produces excessive noise when reviewing real pull requests. On a public benchmark of 50 genuine pull requests, the tool flagged far more issues than necessary, and a modification reduced its review noise by roughly a third. The work has sparked discussion among developers about whether AI review tools create too many low-value comments that slow teams down.

An engineer has shared five lessons from running Anthropic's Claude Code as a cloud agent every hour on a large production monorepo. The write-up covers validating review comments, preventing the agent from getting stuck in loops, fixing a 403 error, and reducing token consumption. The post is drawing attention from developers interested in using AI coding agents for automated code review in real production environments.