The bottleneck moved to review. GitHub shipped a partial fix.

The slow part of shipping is no longer writing the code. It’s getting a human to look at it. In LinearB’s 2026 benchmark of 8.1 million pull requests, PRs written with agentic AI sat idle 5.3x longer before a person picked them up than unassisted PRs — 1,055 minutes against 201 (LinearB). Generation got fast. The queue behind it did not.

On June 18, GitHub shipped an update to Copilot code review that reads your repo’s AGENTS.md file and uses it when it writes review comments (GitHub Changelog). The pitch writes itself: a reviewer that already knows your house rules, standing at the front of that backed-up queue. The question worth answering is narrower than the pitch. Does a reviewer that reads your conventions shorten the verify loop, or does it add one more pass of comments to triage on top of a pile that’s already growing?

Our answer: it’s a real improvement to the mechanical first pass, and it is not a fix for the verification gap. Those are different claims, and the difference is where a head of engineering should spend attention.

The gap is real, and it’s widening

This isn’t vendor framing. DORA’s 2025 report — the industry’s least excitable source — names it directly. Adoption of AI coding tools is past 90%, and over 80% of developers report productivity gains, but only 33% say they trust AI-generated code, and 3% trust it highly (DORA). The time saved writing gets re-spent auditing. DORA calls it a verification tax, and the number that matters is the trust gap between how much code is produced and how much anyone is willing to sign off on.

The telemetry agrees from a different angle. GetDX, across 400+ companies, puts AI-authored code at roughly 52% of all code by Q2 2026, with median PR size up from 44 to 72 lines in a year (GetDX). Faros AI’s cohort shows PR review time growing 441% year-over-year — up from 91% the year before, so the strain is accelerating, not settling (Faros). Treat the exact percentages as vendor-reported; the direction is corroborated across four independent datasets, which is rare enough to trust.

So the premise holds. More code, larger PRs, less trust, longer waits. The choke point is specifically human attention at the review stage. That’s the queue GitHub is aiming at.

What actually shipped

Read the changelog before you read the marketing. It’s two sentences of substance: Copilot code review “reads AGENTS.md from the root of your repository” and “uses relevant instructions from that file when generating review feedback.” Plus two UI changes — a Request button for Copilot on draft PRs, and collapsed timeline events in the Conversation tab. It’s generally available, and GitHub claims no metric: no review-time reduction, no defect-catch rate, no case study. A feature announcement, not an efficacy result.

That restraint is the honest read of what you’re getting. AGENTS.md is the open convention for telling a coding agent how your repo works — build commands, style, patterns — and it’s spread to tens of thousands of repos over the past year (agents.md). What’s new here is that the reviewer now reads the same file the coding agent does. One house rulebook, applied on both sides of the PR.

There’s a distinction inside that, and it’s the whole argument. When a coding agent reads AGENTS.md and sees a test command, it can run the tests and fix what breaks before it finishes. A reviewer reading the same file gets none of that. It reasons over text. It is not running your suite to generate its comments. So the reviewer inherits the style and convention knowledge from AGENTS.md, and inherits none of the execution.

Where it earns its place

The value is concrete and it’s worth having. Convention and style triage is exactly the work a human reviewer currently burns time on for mechanical reasons: naming that drifts from the codebase, error handling that ignores the house pattern, a console.log left in, the “we prefer X over Y” call that a new contributor couldn’t have known. GitHub’s own guidance says instructions work best for precisely this class — clear rules, explicit “prefer X over Y” directives, naming and organization conventions (GitHub). A reviewer that flags those the instant a PR opens, instead of after a human finally gets to it, moves real load off the person and off the clock.

DORA’s framing sets the ceiling on that gain, though. AI is an amplifier: teams with review discipline already in place get more from it, and teams without it get their existing mess reflected back faster (DORA 2025 report). If your conventions are written down and enforced, an AGENTS.md reviewer extends a system that works. If they live in three senior engineers’ heads, this won’t manufacture the discipline for you.

Where it stops

Here’s the counter-evidence, and it’s load-bearing. CodeRabbit studied 470 PRs and found AI-assisted ones generate 1.7x more issues than human-authored PRs — 10.83 findings per 100 against 6.45, with critical issues up 40% and major issues up 70% (CodeRabbit, via Help Net Security). The code arriving in your queue needs more scrutiny, not less. A reviewer that reads your conventions gets faster at flagging a bigger pile — it doesn’t shrink the pile. Point the automation at an elevated defect surface and you can easily net more comments to triage, not fewer PRs waiting.

Then there’s the structural ceiling, and you can read it straight off GitHub’s own docs. Copilot review rejects vague instructions — ask it to “be more accurate” or “identify all issues” and it does nothing with that. It won’t follow external links. And GitHub states plainly it is “not guaranteed to spot all problems or issues in a pull request” (GitHub Docs). The reviewer’s reach is bounded by what’s written in the instructions file — which means two failures are baked in, not incidental.

First, a reviewer that checks code against your conventions cannot tell you your conventions are wrong. If the house pattern is the bug — a retry policy that hammers a failing dependency, an auth check in the wrong layer — an AGENTS.md-bounded reviewer will happily confirm the code follows it. Second, it cannot run the code, so the class of defect that only appears at execution — the race, the N+1 under load, the migration that locks a table in production — is out of scope by construction. That is the expensive half of verification, and it’s exactly the half instruction-following can’t touch.

What to do Monday morning

Adopt it as a first-pass linter with judgment, not as a reviewer. Concretely:

• Turn it on for the mechanical pass. Let it clear convention and style findings the moment a PR opens, so the human who picks it up spends their time on correctness and design, not naming.
• Keep the human gate on the two things it can’t do: is this actually correct, and is the convention it’s enforcing still the right convention. Don’t let a green Copilot review stand in for a sign-off on logic.
• Watch your comment-to-signal ratio. If it’s adding volume to an already-elevated defect surface without clearing PRs faster, tighten the instructions file — a noisy reviewer gets muted, which is worse than no reviewer.

The verification gap is a people-and-process problem wearing a tooling costume. This tool takes a real slice of the mechanical work off the queue. It does not close the gap, because the hard part of verification — is it correct, is the rule right, does it survive contact with production — is the part no instruction-following reviewer can reach. Buy the slice. Don’t buy the story that it’s the whole thing.

Setup: standing it up in an afternoon

Copilot code review needs a paid Copilot seat (Pro, Business, or Enterprise); each review consumes premium requests and Actions minutes, so confirm current pricing before you roll it org-wide.

Enable automatic review. Repository → Settings → Code & automation → Copilot → Code review. Or, to enforce it across a set of branches, use a ruleset: Settings → Rules → Rulesets → New branch ruleset → enable Automatically request Copilot code review. The ruleset path gives you the useful toggles — review new pushes, review draft PRs, and a review-effort level (Standard by default, Medium for deeper analysis of complex or security-sensitive changes) (GitHub Docs).

Request it manually. On any PR, open the Reviewers sidebar and click Request next to Copilot. As of this update, that Request button now shows up on draft PRs too, so you don’t have to hunt for it.

Add an AGENTS.md at the repo root. That’s where the reviewer reads it. Keep it a short rule list, not prose — Copilot acts on explicit directives and ignores vague ones. A review-relevant starting point:

# AGENTS.md

## Review conventions
- Prefer early returns over nested conditionals; max nesting depth 3.
- All exported functions have explicit return types. No implicit `any`.
- Errors are handled at the call site; never swallow a caught error silently.
- No `console.log` in committed code — use the `logger` from `@/lib/log`.
- Data access goes through the repository layer, never a raw query in a handler.
- Naming: `camelCase` for functions/vars, `PascalCase` for types, `SCREAMING_SNAKE` for constants.

## Do not flag
- Generated files under `src/generated/`.
- Snapshot test files (`*.snap`).

Rules it can act on are specific and testable. Things that silently don’t work, per GitHub’s own guidance on instructions files: vague asks like “identify all issues,” external links (it won’t follow them), and instructions to reformat its own comments or do non-review tasks.

One caveat worth knowing: .github/copilot-instructions.md and path-scoped .github/instructions/*.instructions.md files still work, and GitHub’s docs don’t state a precedence order when a repo has both those and an AGENTS.md. Pick one primary file rather than betting on an undocumented resolution rule.

Then treat the first two weeks as a test, not a rollout. The feature is new enough that no one has published outcome data on it. Measure your own: pickup time, comment-to-merge ratio, and whether your senior reviewers are spending less time on naming and more on logic. That last number is the one that tells you whether the gap actually moved.

References

• GitHub Changelog — Copilot code review: AGENTS.md support and UI improvements (2026-06-18)
• GitHub Docs — About GitHub Copilot code review
• GitHub Docs — Configuring automatic code review
• GitHub Blog — Master your instructions files
• DORA — Balancing AI tensions and the 2025 report
• LinearB — 2026 benchmarks: AI-assisted PR merge rate
• CodeRabbit study, via Help Net Security — AI code looks fine until the review starts
• GetDX — AI-authored code has nearly doubled
• Faros AI — Key takeaways from the DORA Report 2025
• agents.md — the AGENTS.md open format