Two weeks ago I watched a pull request get merged with an AI-authored review comment that said "LGTM, nice defensive coding here" — attached to a diff that introduced an unguarded array index into a payment reconciliation job. The array could be empty. It has been empty, twice, in production, since. Nobody had tested the reviewer.
That's not a hypothetical. It's the exact failure mode buried in the discourse this week when developers started asking why AI "promoted every developer to reviewer" without anyone stopping to ask what happens when the reviewer itself is wrong. Here's my hot take: AI code review should never be a merge gate. It should be a colleague you consult, not a bouncer you trust with a badge — and if your CI pipeline doesn't already know that, your pipeline is broken, not your reviewer.
The steelman: AI review is genuinely useful
Let's not pretend the tools are bad. Point an LLM at a diff and it will catch things a tired human on their fourth PR of the day will miss: a missing null check, a docstring that no longer matches the function signature, an SQL query concatenated instead of parameterized, an off-by-one in a loop bound. It does this in seconds, for free, on every single PR, without getting bored or defensive. Teams report real velocity gains from using it as a first pass — fewer round-trips, fewer "please add a test for the empty case" comments a human reviewer would've had to type out by hand.
