AI Can Write Code Faster Than We Can Review It — And That’s Becoming the Real Bottleneck

For much of software development's history, creating code has been a time-consuming process. Developers spent hours implementing features, handling edge cases, writing tests, and preparing pull requests. However, the advent of AI coding agents has changed the equation. Tools like Claude Code, GitHub Copilot, Cursor, Codex, and others can generate large code changes within minutes.

While this may seem like a considerable productivity boost, it presents a new challenge: generating code faster than we can understand, review, and verify it. Writing code is becoming cheaper, but the bottleneck now lies in reviewing and verifying the generated code. Imagine a developer tasked with adding role-based access control to an admin dashboard.

Without AI, the process would involve understanding requirements, exploring the codebase, designing a solution, writing code, writing tests, debugging, and opening a pull request, which could take hours or days. With AI, the agent can potentially generate database changes, middleware, API updates, UI changes, tests, and documentation within a short time.

While this is impressive, the review process might still take an hour, leading to a new problem: fast code generation and slow code verification. This shift has already prompted GitHub to expand its Copilot Code Review, allowing AI to participate more deeply in the review process. The updated AI system can run builds, tests, and targeted checks, and even experiments with an ensemble of specialized agents have shown a 47% increase in the rate at which developers address high-severity review comments.

However, this raises an important question: what happens when AI writes the code and AI reviews it? In such a workflow, the human developer could become the least informed person, approving a pull request containing code they didn't write, tests they didn't design, and a review generated by another AI system. Even if everything appears green, it doesn't guarantee correctness.

Passing tests doesn't necessarily mean the feature is right. For instance, if the requirement is that only account owners can delete a workspace, the AI-generated code might pass the test, but it could still be incorrect if the real business rule is that an admin cannot delete a workspace. This highlights that AI can verify code but cannot prove that its interpretation matches reality.

This is where human judgment remains crucial. Moreover, traditional technical debt resulting from developers' shortcuts is being joined by a new type of debt: AI-generated code that works now but is not fully understood by the team. After one year of aggressive agent usage, a codebase might consist of various AI-generated features, refactors, migrations, tests, and documentation.

If production breaks, who will understand the system deeply enough to debug the interactions between these pieces? This is why the conversation around AI technical debt is becoming increasingly important. Sonar describes it as the rework and risk created when AI-generated code arrives faster than teams can properly verify, understand, and maintain it.

While generating more code may seem to increase productivity, it can also generate future work faster, potentially decreasing actual productivity. Developers traditionally measured productivity through metrics like tickets completed, pull requests merged, features shipped, lines changed, and deployment frequency. AI can boost many of these numbers, but the question is whether this translates to improved productivity.

Consider a team where productivity before AI was 10 pull requests per week and 2 bugs, and now with AI, it's 35 pull requests per week and 11 bugs. While the number of pull requests has increased, it's unclear if the quality of the code has improved. Perhaps a better metric to consider is the amount of verified, maintainable value shipped.

This is harder to measure than lines of code but much closer to what actually matters. Reviewing AI-generated code has also become more complex. Traditional code review often focuses on individual lines of code, but when AI agents can generate large changes quickly, reviewing becomes increasingly difficult. Instead of merely asking if a line of code is correct, developers need to review at multiple levels.

At Level 1, they should ask what the requirement is before reviewing the code. This shift in the review process is crucial to ensure that AI-generated code is truly valuable and maintainable.