David Loker, director of AI at CodeRabbit, argues that AI code review works best as a hybrid of a fixed pipeline and a bounded agent fed carefully chosen context, and that it becomes essential as AI-generated code multiplies the number of pull requests. He reports GPT-5 nearly doubling CodeRabbit's score on its hardest internal reviews, yet still expects LLMs to plateau and need new architectures. He sees AI widening rather than shrinking the population of software builders, and he wants humans kept as the creators wherever AI touches creative work.
The problem and the architecture. Loker frames pull-request review as quality control that senior engineers can no longer keep up with as AI multiplies PRs. He contrasts two patterns from his blog post. Agentic AI is "a glorified while loop" of planning and tool calls, and its error compounds: a 1% error rate across 100 chained actions all but guarantees a mistake. Pipeline AI runs predetermined steps and is easy to debug but brittle. CodeRabbit sits in the middle. It always runs static analysis, then lets an agent explore within limits on tool calls, iterations and context size, fetching library documentation, files from other repos, or the issue behind a PR. The host likened this to Anthropic's split between workflows and agents.
Context engineering. Loker defines the task as deciding what information goes into the LLM's context and what stays out. CodeRabbit pulls linked issues and PRDs, design documents, standards documentation, and a code graph showing where a changed public API is used, plus verification loops that search the codebase. He warns that giant context windows tempt teams to "throw everything in". Attention is U-shaped, he says, and multiple studies show performance falls as material is added even when it is accurate. "Learnings" store a reviewer's corrections for later reviews, and checking each comment against evidence "significantly" prunes hallucinations.
Productivity, privacy and learning. Loker says lines of code, and even PR counts, are meaningless once AI writes the code. He would measure ideas taken from prototype to production, as he measured executed hypotheses at Netflix. Answering the host's question on "bring your own AI", he cites a stat that about 90% of employees use personal ChatGPT accounts. His remedy is to supply sanctioned tools under zero-data-retention agreements, or on the company's own infrastructure where rules demand it. CodeRabbit runs each review once in an isolated sandbox that is then torn down, stores no code, and offers self-hosting. Because it will not train on customer code, it improves its learning features through customer feedback, open-source usage and its own use of the product rather than reinforcement learning.
Security and vibe coding. Loker agrees with the host that machines can be more vigilant than humans, because they do not tire. He argues that RL against security-scanned outputs will remove the flaws critics attribute to copying Stack Overflow. Citing an Andrew Ng talk, he traces how each move from punch cards to COBOL drew complaints that the newcomers were not real coders, and each produced more engineers. The host, citing the CodeRabbit blog's figure that AI coding tools can add up to 41% more bugs and Lovable's nearly $2 billion valuation, asked whether AI reviewing AI is the future. Loker defends vibe coding as a prototyping tool: his sister-in-law built an app in an afternoon, though not a production-ready one. His objection is to the term, which implies prompting without engaging the code. A solo vibe coder, he says, needs a third-party reviewer.
GPT-5 and the limits of LLMs. CodeRabbit's hardest set has 25 PRs. Loker reports 5–6 correct when he joined, about 10 after context-engineering work, about 12 with Claude Opus 4 and Sonnet 4, and 18–21 with GPT-5, varying with non-determinism. The team first assumed something was wrong. On inspection he found reasoning he had not seen before: inferences from something's absence carried several levels deep, and re-deriving consequences under an assumed fix. Hallucination and negative feedback also fell sharply. He agrees with the host that the leap shows only on hours-long tasks. He still expects LLMs to reach a limit, citing data scarcity and the brain's energy efficiency. He calls the investment not wasted, since vertical fine-tuning is far from exhausted.
Creativity. Drawing on Wave AI, which he co-founded with his wife and a former student of hers, Loker accepts a definition of creativity as novelty plus value, which does not exclude machines. He does not want to consume purely AI-generated art, though. He says Wave AI went against VCs who wanted an "AI Spotify" without royalties: the machine should sit in the back seat, and users should leave feeling the work is theirs.