Code review and testing are increasingly done by AI, enabling trust in code merged at a pace no human can manually review.

Jarred Sumner describes how AI-powered code review, security scanning, fuzz testing, and out-of-process testing allow merging over 100 PRs per day with confidence, because automated AI review catches bugs that would take an hour of human reading. ✦ AI generated

Jarred Sumner · The Pragmatic Engineer · 2026-07-28 · original ↗

Critiquing the code and testing it with agents is a new approach we do a lot more of. I think a lot about trust when you merge a lot of code. How do you merge 100+ PRs a day, and make sure the code works? At this pace, you need to trust the code without the ability to read it all yourself. And I think it's a few things: Code review: it needs to be really good and automated. I'm clearly tooting our own horn here, but I find Claude's code review to be really good. Claude's code review catches bugs that would take me an hour of closely reading the code to figure out. The caveat is that it's expensive! Security scanning: for this Rust rewrite we did 11 runs of the Claude Security Scanner. Fuzz testing: we've also been doing different types of fuzzing (fuzz testing), where we had Claude write a fuzzer for things like parser fuzzing.

Read full article ↗excerpt · fair-use quotation