Agent PRs Are Everywhere. Here's How to Review Them

A January 2026 research paper, More Code, Less Reuse, points out that agent-generated code accumulates more duplication and technical debt per change than human-written code. Even when it looks clean, reviewers tend to approve it more easily, which means deliberate review is needed over speed.

GitHub's Copilot code review has already processed more than 60 million reviews, and more than 1 in 5 of GitHub's code reviews now involve an agent. The number of PRs is growing faster than human review capacity, so review focus should shift from visible quality to finding hidden risk.

In particular, the following signals should be blocked immediately.

• CI weakening: lowered coverage, deleted or skipped tests, || true, blocking forks/PRs, expanded conditional execution
• Duplicate code: search the entire repository to check whether a new helper or utility re-implements an existing one
• Logic that's wrong but passes: pagination boundary values, missing permission checks, race conditions, failure to validate external input
• Large PRs without a plan: if there's no response history or structural plan, and you see 5+ unrelated file changes or an empty body, ask for it to be broken down first
• Workflow security: when putting untrusted input like PR bodies, issues, or commit messages into a prompt, ensure sanitization, minimal GITHUB_TOKEN permissions, and no shell execution of model output

In practice, it's recommended to classify scope within 10 minutes, look at .github/workflows and test configuration first, search for duplication in new utilities, and trace the core path as input→transform→output. For non-trivial changes, require a pre-change failing test, run automated review like Copilot first, and then focus on the parts that need human judgment. Team-specific custom instructions can surface CI threshold changes, new utilities, and external input validation, and personal checklists can also be automated with the Copilot SDK.