Research Shows AI Is Writing More Code, but Teams Still Lack Adequate Review Standards

Somewhere around late 2025, the research community quietly stopped asking whether AI can write code and started asking something harder: how does AI-authored code actually perform in real engineering workflows? Not in benchmarks. Not in demos. In pull requests, code reviews, CI pipelines, and production codebases the same places we have been measuring human developers for decades. The findings are specific enough to be useful and uncomfortable enough that most teams are not acting on them yet. The Numbers That Reframe the Conversation 22% of merged code is now AI-authored, according to DX's Q4 2025 impact report covering 135,000 developers. That is not a future projection. That is the current baseline. One in five lines of code hitting your main branch today was written by an AI tool. Daily users of AI coding assistants merge roughly 60% more PRs than non-users. That productivity gain is real and well-documented across multiple studies. But the same data also shows code churn rising from a 3.3% baseline in 2021 to 5.7% in 2024 and 2025. More code, merged faster, is not the same as more value, faster. The churn rate is the tell. CodeRabbit's December 2025 analysis found roughly 1.7x more issues in AI-coauthored PRs compared to human-only PRs. Not caught at the time of review found afterward. The review was happening. The issues were getting through anyway. What the Research Actually Found MSR 2026 published the most rigorous study to date: 33,000 agent-authored PRs across GitHub, five coding agents, measured across merge outcomes, CI results, code change size, and reviewer dynamics. The findings are specific: Documentation, CI, and build update tasks achieve the highest merge success rates. Performance and bug-fix tasks perform the worst. Not-merged PRs consistently touch more files, involve larger diffs, and fail CI at higher rates than merged ones. The qualitative analysis of 600 rejected PRs found four recurring rejection patterns: lack of meaningful reviewer engagement, duplicate PRs, unwanted feature implementations, and agent misalignment the agent solving something adjacent to what was asked but not quite what was needed. That last one is the interesting one. An agent that writes code for the wrong interpretation of the ticket is not making a technical error. It is making a communication error. And communication errors are significantly harder to catch in an automated review than null pointer exceptions. A separate MSR 2026 paper on post-merge code quality found that even when agent PRs get merged, they introduce code smells and maintainability issues at rates that human-authored PRs in the same repositories do not. The merge happened. The quality problem came later. 61.4% of agent-authored PRs in one study were merged immediately after automated checks passed, with minimal human review. Reviewers often approved with a simple "LGTM" or praised the change without examining it carefully. That is not a reviewer failure. That is a governance gap: no clear standard for what "reviewing an agent PR" actually requires. The Governance Gap Nobody Has Closed Yet Human developers have decades of established governance norms. Code review expectations, definition of done, ownership conventions, on-call accountability. When a human developer's code causes an outage, there is a clear path to accountability and learning. When an agent's code causes an outage, that path is murky. The agent does not get paged. The agent does not write the post-mortem. The agent does not carry the institutional knowledge of what broke and why. UC San Diego and Cornell published a December 2025 study on how experienced developers actually use coding agents. The finding: professionals retain agency in software design, insist on fundamental quality attributes, and deploy explicit control strategies to manage agent behavior. They do not vibe-code. They control. The gap is not between experienced developers and AI agents. The gap is between teams that have established control strategies for agent-authored code and teams that have not. The second group is significantly larger. What control strategies look like in practice: A separate review checklist for agent-authored PRs that explicitly checks for file scope, CI passage, and alignment with the original ticket before LGTM. Tagging agent-authored commits in your repository so you can measure their post-merge performance independently. If 22% of your merged code is AI-authored, you should be able to tell whether that 22% has a different defect rate, churn rate, or incident rate than the other 78%. Pre-commit checks tuned for the specific failure patterns research has identified: large diffs touching many files, missing tests, CI skips. These are not generic code quality checks. They are the specific patterns that predict agent PR rejection. Clear ownership rules: who is accountable for an agent-authored change after it merges? The engineer who approved the PR. Not "whoever owns the agent." The human who clicked merge owns the outcome. The Question That Actually Matters Now The research has moved past "can AI write code?" to a harder cluster of questions: can you measure it, audit it, and govern it with the same rigor you apply to human contributors? Right now, most teams cannot. Not because the tools are missing the tools exist but because the norms have not caught up with the adoption rate. 22% of merged code is AI-authored. The governance frameworks covering that 22% are nowhere near as mature as the ones covering the other 78%. That gap compounds. Every month of ungoverned AI contribution is a month of technical debt, churn risk, and accountability ambiguity accumulating in your codebase. The teams that close the gap now will not be cleaning it up in 2027. The question has shifted. The practices need to shift with it. References MSR 2026 Where Do AI Coding Agents Fail? An Empirical Study of Failed Agentic Pull Requests in GitHub (April 2026) https://2026.msrconf.org/details/msr-2026-mining-challenge/19/Where-Do-AI-Coding-Agents-Fail-An-Empirical-Study-of-Failed-Agentic-Pull-Requests-in arxiv.org Beyond Bug Fixes: An Empirical Investigation of Post-Merge Code Quality Issues in Agent-Generated Pull Requests (MSR 2026) https://arxiv.org/pdf/2601.20109 arxiv.org How AI Coding Agents Communicate: A Study of Pull Request Description Characteristics and Human Review Responses (February 2026) https://arxiv.org/html/2602.17084v1 arxiv.org AI Builds, We Analyze: An Empirical Study of AI-Generated Build Code Quality https://arxiv.org/pdf/2601.16839 Panto.ai AI Coding Assistant Statistics: Adoption, Productivity and Market Metrics https://www.getpanto.ai/blog/ai-coding-assistant-statistics Larridin Developer Productivity Benchmarks 2026: AI-Native Engineering Data (March 2026) https://larridin.com/developer-productivity-hub/developer-productivity-benchmarks-2026 Mike Mason AI Coding Agents in 2026: Coherence Through Orchestration, Not Autonomy https://mikemason.ca/writing/ai-coding-agents-jan-2026/ GitClear Coding on Copilot: 2025 Data Shows AI-Assisted Code Increasing Churn https://www.gitclear.com/coding_on_copilot_data_shows_ais_downward_pressure_on_code_quality