Late last month a PR opened on our repo: propagating secret taint across workflow steps, a security feature. The numbers: 83 files, 21,962 lines added, 36 commits. And on the way to merge, 209 review conversations across two days. The code was written by Codex. The review was also Codex.
What those 209 conversations left behind is what this post is about.
Ninety percent of the reviews were accurate
Let me be clear about one thing first. Codex reviews PRs well. By my feel, about 90% of its comments are accurate. It catches missed edge cases, drifted semantics, the spots a tired human reviewer would wave through. Before Codex I tried plenty of alternatives: having the main agent review its own work, attaching a different model as a subagent reviewer, running two-stage reviews. Even on code filtered that way, Codex still hooks one or two more.
But this isn't a Codex commercial. It's about what happens when accurate reviews arrive in unlimited supply. Accurate and necessary are different things.
