AI pull requests carry 1.7× more defects, and review didn't scale to match

An autonomous agent read a ticket, touched 37 files, updated two database migrations, and opened a pull request in 11 minutes. The diff looked clean, the tests passed, the reviewer approved it. Three days later an SRE tailing canary logs at 2:47 a.m. found a staging secret printed in plaintext and a token-audience mismatch the agent had hardcoded while making a failing test go green. Pre-production traffic had been validating auth against the wrong audience for 72 hours, and nothing had failed loudly enough to notice. That incident opens Parthiban Rajasekaran’s argument in DevOps.com that the constraint in software has moved from writing code to proving it is safe, and the last day produced enough corroborating data to take the claim seriously.

Start with the defect rate, the part that’s easy to wave off until you see it. CodeRabbit analyzed 470 real-world open-source PRs and found AI-generated pull requests carried about 1.7× more issues than human-written ones: logic and correctness problems up 75%, security vulnerabilities 1.5 to 2×, readability defects more than 3×. In raw counts their sample logged 341 critical issues from AI against 240 from humans. The trust data tracks the defect data. Stack Overflow’s 2025 survey has AI accuracy trust dropping from 40% to 29% in a year, with 46% of developers now actively distrusting output and only 3.1% highly trusting it, and 45% saying debugging AI code takes longer than writing it themselves. Generation cost fell to near zero while verification cost stayed fixed, so velocity didn’t appear, it relocated.

CodeRabbit’s read is that the industry optimized the visible thing, generation, and neglected comprehension, so review stopped being a final quality gate and became the place a team reconstructs intent it never held. Rajasekaran’s prescription is structural: treat the spec as a versioned, reviewed artifact, move the gate to before the agent runs, and enforce a “change budget” capping how many files an agent may touch before a human re-authorizes. His example is sharp. The same password-reset feature, given a loose spec, produces working code that no test would catch storing the reset token in plaintext or letting it never expire; the senior version of the spec names the files the agent must not modify, pins the token to single-use with a 15-minute server-side expiry, and adds a negative test that greps the codebase for plaintext tokens. The skill he’s describing is negative-space thinking, reading a spec for the failure modes nobody wrote down.

Tooling is forming around the same gap. Topos, posted to Hacker News in the last couple of days, scores agent-written programs on structural properties instead of test pass/fail, mapping files to ASTs, control-flow and code-property graphs and computing metrics for simplicity, composability, and security that an agent can optimize against as it writes. The framing in the post is blunt: tests passing is no longer sufficient to trust a change.

Measurement of the harnesses themselves is getting more disciplined too. GitHub published a controlled comparison of its Copilot harness against the model vendors’ own (Claude Code for Sonnet 4.6 and Opus 4.7, Codex CLI for GPT-5.4 and 5.5), holding model, task, context window, and reasoning effort fixed. On TerminalBench 2.0 they ran each agent-model pair at least five times across all 89 tasks and plotted resolution rate against dollar cost with ±1σ ellipses, and the result is parity: cross-harness differences sit inside run-to-run variance. What’s worth taking from it is the variance disclosure itself, the ellipse admitting how much a fixed configuration swings between runs, plus a cross-model-family critique mode they call Rubber Duck where one model reviews another’s work. Verification by a second model, baked into the harness.

The last item moves the question from code to memory. Memory Depth, Not Memory Access separates two things usually conflated: retrieval can fetch a past fact at query time, but it doesn’t decide which experiences should keep shaping behavior after the working context unloads. The paper’s loop-drift protocol keeps the retrieval index intact, unloads context, and tests whether goal-conditioned behavior survives long-loop interference. Retrieval wins shallow factual recall (0.956–0.973); a LoRA consolidation mechanism called EVAF wins goal persistence and post-unload recovery (0.812–0.904) on 2–3 parametric writes per 200 events. It’s a small-model probe (GPT-2, TinyLlama, Mistral-7B) and it flags stale-memory invalidation as unsolved, but the distinction is clean: what an agent can look up is not the same as what it has internalized.

The common thread across all five is one inversion. When producing an artifact is cheap, the expensive question becomes whether you can prove anything about it: that the diff matches intent, that the harness number is real and not variance, that what the agent “remembers” actually persists. Worth watching next is whether change budgets and spec-as-gate show up as enforced pre-submit hooks in real repos the way SRE error budgets eventually became real dashboards, or stay templates in blog posts.