code reviewers

Greg Kroah-Hartman, the longtime Linux kernel maintainer who oversees stable releases, has given a talk examining how large language models affect software security. He discusses what the rise of AI-generated code means for vulnerabilities, code review practices, and maintaining trust in widely used open-source components. The talk is drawing attention among developers weighing the risks of AI-written code in critical infrastructure.

A discussion among software developers is asking whether anyone is actually producing good code with AI coding agents. The question taps into ongoing debate about whether tools like GitHub Copilot, Cursor and other AI assistants deliver production-quality results or mainly speed up work that still needs heavy review. Replies so far are limited, but the topic reflects wider uncertainty in the industry about how reliable AI-generated code really is.

Developer sshah03 has released Perspica, an open-source tool that produces semantic diffs of code, aimed at making code review easier by highlighting meaningful changes rather than raw line-by-line differences. The project is available on GitHub and is being showcased to the Hacker News community, where early reactions and discussion are forming around its usefulness for reviewers.

System76 has announced that its COSMIC desktop projects will no longer accept code submissions containing LLM-generated content. The Linux hardware and software developer says contributions must be written without AI assistance. The move reflects a growing frustration among open source maintainers, who argue that machine-generated code adds review burden and quality problems while contributors submit pull requests that are difficult to verify or maintain.

OpenAI has made its automatic code review feature free for all Codex users. The tool reviews code changes automatically, giving developers feedback without a paid tier. The move is being discussed as a way to pull more developers into OpenAI's coding ecosystem at a time when automated code review and AI coding assistants are a highly competitive market.

A developer has released CodeDiff, an open-source code comparison tool that claims to produce syntax-aware diffs in under 100 milliseconds with 99.95 percent robustness. The tool is available on GitHub and is being presented to the Hacker News community for feedback and scrutiny.

IBM's AI-powered vulnerability clearinghouse has identified hundreds of security flaws in Java software. The finding highlights the growing role of artificial intelligence in scanning open-source code for vulnerabilities at scale, giving developers advance warning of weaknesses that attackers could exploit. Security teams are expected to review the affected Java components.

Meta moved quickly to fix a virtual machine escape vulnerability in its Muse system before the product launched, according to a report by Gadget Review. A VM escape flaw would let malicious code break out of a sandboxed environment and access the host system, making it a serious security concern. The fix suggests the issue was identified during pre-launch testing, though details on severity or discovery remain limited.

Orbi, an AI coding agent, reportedly takes a GitHub issue and returns a reviewed, merged pull request, with one agent writing the fix and another handling review. A follow-up post examining the system's harness asks what its reviewer missed, suggesting developers are scrutinising how reliable the automated pipeline is. The discussion is drawing interest from the open-source and AI engineering communities.

Developer Kitallis has released hutch, an Emacs interface for doing local code reviews within Magit, aimed at developers who prefer reviewing code without leaving their editor or relying on hosted platforms. The tool is being shared among open-source communities, where it has drawn modest attention from Emacs and programming enthusiasts interested in lightweight, editor-based review workflows.

A developer has kicked off a written series on why open-source and team code contributions are so hard to review, opening with the familiar experience of deciphering vague commit messages like "fix stuff" and digging through git blame for hours. The piece promises to explore the reasons behind poor pull request hygiene, and early readers are sharing their own frustrations with undocumented code changes.

Engineers are discussing how software systems can fail despite clean code, elegant abstractions, well-designed APIs, automated tests and polished deployment pipelines. The argument is that even code that passes every review can start behaving strangely once user numbers grow, meaning architecture tends to break under real-world load rather than at obvious design flaws. The observation is resonating with developers who have seen theoretically sound systems collapse in production.

A discussion circulating among developers examines what happens when you prompt an AI coding assistant to write a service that processes bulk user telemetry, validates incoming records and handles batch publishing. The code arrives within seconds and looks clean, but the point being raised is that polished syntax and modern structure can mask problems in how the service actually behaves, encouraging engineers to look beyond surface quality when reviewing machine-generated code.

GitHub has introduced ReviewBench, an open benchmark for measuring how well AI models perform code review. The benchmark is intended to give developers and researchers a standard, reproducible way to compare the quality of AI-generated code review feedback, as AI assistants are increasingly used in real software development workflows.

Researchers at ThreatDown have analyzed the new Carbonato botnet, which compromises poorly secured Docker hosts. The malware targets systems where the Docker API is exposed without authentication on port 2375, taking over containers and using AI-generated code in its operations. Security teams are being urged to lock down exposed Docker APIs and review firewall rules to prevent infections.

A new tutorial walks developers through creating their first 'agent skill' — a set of house rules that tells an AI coding assistant how the team works, from commit message formatting to what a code review must include. The guide is aimed at developers integrating AI agents into everyday software workflows and is being shared in programming and productivity communities.

A newly disclosed vulnerability in Microsoft Exchange Server, tracked as CVE-2026-96940, carries a high severity score of 8.8. Security researchers say an authenticated attacker could bypass authorization checks and read other users' mailboxes and attachments within the same on-premises Exchange organisation. The flaw does not allow pre-authentication remote code execution, but experts are warning administrators to review exposure and patch promptly.

Heise is hosting a live webinar on developing, deploying and reviewing software with AI coding agents in Xcode. The session covers Claude Code, GitHub Copilot and OpenAI Codex, with a focus on using the tools without compromising security or data privacy. The announcement is circulating among developers interested in AI-assisted programming workflows.

OpenAI's Codex, the company's AI coding agent built on its GPT models, is generating renewed discussion as developers and tech commentators weigh it against ChatGPT. The conversation centres on how the two tools fit together: ChatGPT as the general assistant and Codex as a specialised tool for writing and reviewing code inside developers' workflows.

Former OpenAI researcher Andrej Karpathy argued on X that as AI writes more of the code, the programmer's job shifts from typing to reviewing and supervising the machine's output. The remark is circulating among developers, many of whom see it as a fair description of how AI coding tools are already changing day-to-day software engineering and what skills will matter next.

A developer is offering a paid human second-pass review of AI-generated pull requests, and says they reviewed three AI-written PRs from public repositories before pitching the service, which they call Riven Desk. The idea taps into growing concern that AI-written code is being merged without careful human scrutiny. Commenters in programming and engineering communities appear engaged with the question of how much review AI code actually needs.

A newly shared engineering write-up describes building an edge-agentic commit analyzer, a tool that reviews code commits locally using AI agents running on local hardware rather than cloud services. The piece focuses on troubleshooting stubborn errors that arise in local environments. Reaction so far is limited, but the topic touches on ongoing developer interest in running AI coding tools offline for privacy and cost reasons.

Engineer Alexey Indeev has written that he no longer reviews code produced by his AI agents, and describes the alternative workflow he uses instead in a Substack essay. The piece has drawn modest attention on Hacker News, where developers are weighing whether traditional code review still makes sense as more work is delegated to autonomous coding agents.

Developers are debating how to handle pull requests written with the help of AI coding agents. The discussion, circulating among programmers and engineering managers, asks how thoroughly reviewers should scrutinise such contributions, weighing whether agent-written code deserves the same depth of review as human work and what that means for team standards, trust and inclusive review culture.

A software developer describes an AI coding agent that publicly identified and corrected an error in its own fix, with two other agents then reviewing and validating the correction. The account, shared in a developer community under tags like AI, agents and programming, highlights the emerging practice of multi-agent workflows where one AI's output is checked by others before being accepted.

DoorDash has moved its AI engineering agents from developers' laptops to Flux, a cloud-based platform that now handles around 130,000 automated tasks a month, including roughly 25,000 weekly code reviews. The system runs agents in isolated micro virtual machines and cloud sandboxes designed to keep autonomous code operations secure. The scale of deployment is drawing attention as one of the larger corporate examples of AI agents doing routine software engineering work.

SpaceX has reportedly completed a $60 billion acquisition of Cursor, the AI coding company, in what would fold enterprise AI software into a business better known for rockets and Starlink satellite internet. Reports frame the deal as adding a new AI revenue stream alongside Starlink's connectivity business. Details on regulatory review and how Cursor fits into SpaceX's structure remain limited, so the full scope of the deal is still unclear.