Anthropic Is Living In The Future
In a Nutshell
Anthropic replaced human line-by-line code review with a five-stage, mostly automated verification pipeline—AI pre-reviews, multi-agent consensus, automated security scans, and risk-tiered human sign-off—allowing daily merges to jump from 2.5 k to 30 k while cutting rollbacks by over 40 %. The scarce resource is no longer code but human attention, so the company codified two rules: an agent’s approval never counts as human approval, and the person who requested the change remains fully accountable. Companies that want the same leverage must first build fast, reversible deployment infrastructure and then automate every repeatable check; otherwise, they will only trade one bottleneck (writing) for another (reading).
These notes were generated by AI and may contain inaccuracies.
On October 15, 2026, Anthropic published an article about how the team responsible for Claude Code reviewed its source code. This team faces an unusual problem, as Claude himself writes about 90% of his programming code. In other words, artificial intelligence mostly writes its own software tools. The article poses an obvious question: "Is anyone still reading the code? And if something goes wrong, who will discover it?"
This article foreshadows the future of every company. In the GPT-3 era, around 2022, many were building custom Discord bots. At that time, the designers of these robots were called "cognitive engineers." Today, they are called "agent engineers." The statement "Very soon, these things will spend more time talking to each other than they spend with us" has become a reality.
When an engineer makes a modification to a part of the software, they create what is called a "pull request," which is a proposed change that is waiting to be incorporated into the main code. Then, a colleague reads this change line by line before merging it. This has been the case for decades.
From June to September, the number of pull requests that were integrated into the Claude software code doubled. During the same period, the percentage of changes that had to be reversed decreased by more than 40%. Therefore, output increased and the percentage of re-operations decreased.
Anthropic keeps most of its source code in a huge central repository, which is a single repository that contains many projects at once. In May, Anthropic was integrating approximately 2,500 software changes into this repository daily. By September, this number had exceeded 30,000 changes, or more than 20 changes per minute.
At this rate, it is impossible for anyone to read every line. The employees could no longer keep up with the work. The Claude Code development team changed the question posed. The question "Has a human read the code?" is an inaccurate question. The real question is: "Which inspection, whether automated or human, is best suited to detecting potential errors?"
This changes the optimization criteria. The scarce resource is no longer the code, but human attention. The team set a new goal: most pull requests should be consolidated with the participation of no more than one person. This person could be the same person who created the software change.
New regulations were put in place. If the number of setbacks or accidents increases, no human time will be saved. You simply moved the task from the review stage to the cleaning stage.
Change adoption goes through several stages of auditing:
-
First stage: The work is checked before anyone else sees it. Claude is given something to run, such as tests, a trial version, or even a screenshot to compare with the design. He is then asked to present the outputs instead of just describing what was accomplished. The engineer who created Claude Code estimates that this type of verification improves the final result by two to three times.
-
Second stage: Every pull request is reviewed by artificial intelligence before anyone reviews it. Several agents search for errors simultaneously. After that, a separate group of agents votes on each discovery, and the discovery is not published unless a sufficient number of them agree on its validity. Every discovery must be addressed, so the author either corrects it or closes it, stating the reason. After Anthropic began applying this to its pull requests, the percentage of requests that received substantive review comments rose from 16% to 54%.
-
Third stage: There is an automated security review, and a pull request cannot be merged as long as any of its findings remain open.
-
Fourth stage: There are the usual automated checks, such as tests and build processes.
-
Fifth stage: The level of human consent is determined based on the level of risk. A low-risk change, such as a documentation overhaul, does not require human approval once it passes automated checks, as long as it is authored by a trusted person. Changing a normal product requires only one person, while more dangerous code requires only two people. Therefore, there are three levels, and the change itself determines the level, not its author.
Above these levels, there are two rules that every company should study:
- The agent's consent is not considered human consent.
- Whoever requested the agent to make this change bears responsibility for it, just as if he had written it himself.
The change is integrated via a queue that restarts each scan. It is usually first sent to Anthropic employees themselves, behind a feature tag, which is a switch that activates or deactivates a new feature. If a malfunction persists, the markings and rollback processes fix most of these errors within minutes.
The automated review system itself is constantly improving. Each previous incident becomes a test case, and the performance of the automated review system is evaluated daily based on all these cases.
The team faced a new type of problem after that. The agent who writes the code and the agent who reviews it can keep each other busy forever. The reviewer posts a comment, and the programming system corrects it. Then the reviewer posts another comment, which the programming system also corrects. One of the pull requests went through more than 50 of these rounds in a single night. Then his scribe stopped it manually.
Now, after three rounds, the reviewer asks the writer to reconsider his style. With this change and some other changes, the percentage of pull requests that passed the first round increased from 65% to 78%. When processing 30,000 pull requests per day, that means thousands of requests that don't overburden the system.
The human element did not disappear. People have moved from reading every change to making decisions that machines cannot make. These decisions are things like whether something should be built from scratch, which code is too risky to be left to machines alone, which designs will set a standard for everyone, and whether the evidence is actually sufficient.
Man remains responsible for every outcome. The person is responsible for every change that is sent, regardless of who wrote it. This is Anthropic's own assessment, and no one has independently reviewed these figures. Therefore, take this information with caution.
Anthropic also spends significantly more on tokens than most companies are willing to spend. Their code review product only works with GitHub.
The principle behind all this is not new at all. Does a human review every transaction in the Oracle database? Of course not. The database records every change in a log, then sends that log to a backup server, which restarts it, and separate processes monitor the log for anything that looks wrong.
Nobody manually checks every packet of data on the internet either. The TCP protocol, one of the basic protocols of the Internet, places a checksum on each packet and resends any packet that arrives corrupted or does not arrive at all. The server memory uses a code for error correction, which automatically corrects the reversed bit.
In each of these cases, the device checks its operation twice. Companies have followed the same approach for centuries. Double-entry bookkeeping, which is over 500 years old, records every transaction twice, as a debit entry and a credit entry, to ensure that the books are always balanced.
Some have even suggested three-entry bookkeeping, where a receipt signed with encryption becomes a third party that both parties can verify. The mathematics behind this was based on Claude Shannon, the inventor of Shannon entropy, who is considered the father of information theory. In 1948, it was proven that a message could be reliably transmitted over a jammed channel as long as the appropriate redundancy was added.
We never made systems reliable by manually checking every step, but rather by machines checking each other, and by humans designing those checks.
There will be agents who do the work, agents who supervise those agents, agents who run everything, and agents who coordinate everything. On top of all that, there will be agents whose sole job is to check safety and security. In other words, each agent will have its own organizational structure.
We already see these auditors. Security agents now monitor corporate networks around the clock, and some of them categorize alerts entirely on their own. Other agents also audit code repositories for security vulnerabilities around the clock.
In 2025, Google's "BigSleep" agent discovered a vulnerability in SQLite, one of the most widely used databases in the world. According to Google, only the attackers knew about this vulnerability, and "BigSleep" helped Google cut off their connection before they could exploit it.
Many companies also use artificial intelligence to verify the work of humans. Auditing firms, for example, already use artificial intelligence to check every transaction in the company's general ledger rather than just a small sample.
From verifying human work using artificial intelligence, we are only a small step away from verifying the work of artificial intelligence itself.
Writing code is no longer a rare skill, and it is no longer possible to read every line of it. Therefore, the valuable work moves to the initial stages of identifying what needs to be built and defining it precisely enough for the device to verify the result. It also moves on to the later stages of designing verification processes and taking risks. This is where your top engineers belong.
When you call someone out of their deep work to uncover a routine error, you waste the "attention" of your most valuable employee. When the same assessment is repeated a hundred times, it should no longer be considered an assessment. Rather, it should be a rule, a test, or a tool.
Start with your company's history. Think about the worst service outage your company has ever experienced, and test your automated review system based on that outage daily. No one but you has the accident records, so no one but you can build the test.
Any task that had to be done manually more than once should be automated.
Artificial intelligence is a machine for moving the bottleneck. When the writing process is sped up, the bottleneck shifts to reading. Pharos AI, a company specializing in measuring the performance of engineering teams, conducted a study on more than 10,000 developers in 2025. Developers in teams that used AI extensively merged pull requests 98% more often, but the time taken to review them increased by 91%.
The Claude Code team built to address the new bottleneck instead. Its production has more than doubled, and the rate of decline has been cut by almost half. But this only works if you build the foundation before you unleash the changes.
Human-like artificial intelligence can alleviate human review because almost everything in it is reversible through agent-run tests, feature tags, phased releases, and rapid rollback. Most companies still lack this level.
In Google's 2025 Dora study, it was found that only 21% of teams were able to recover from a deployment failure in less than an hour. If you cannot correct the mistake quickly, you cannot afford to reduce the review, and you will not be prepared.
Start with strictness, and only loosen it when supported by evidence.
Currently, most companies are integrating artificial intelligence into the old structure where someone oversees a set of programs and reads what they produce. This is just the first step towards the ultimate goal. If this person spends their day reviewing program outputs line by line, the organization has simply moved its output list from writing to reading.
The final state looks more like the verification system described. The machines perform the work, supervision, coordination, and most of the auditing processes. Humans take on what machines cannot: purpose, trust, and accountability.
The executive leadership has three tasks:
-
To determine the amount of human attention required for each type of decision. Some decisions do not require human intervention at all. Others require someone to monitor the process and intervene when necessary. Some of them require someone to approve every step. Some of them require a licensed signature, such as that of a doctor or engineer. The risk levels in Anthropic are a preliminary version of this map.
-
To automate the coordination process before eliminating coordinators, because coordination is one of the biggest obstacles in any company.
-
To keep the human element in charge. For this reason, Anthropic's two rules are the first to recommend copying: the agent's consent does not count as the consent of a person, and whoever asks the agent remains responsible for the outcome.
Since September, GitHub has allowed companies to count Copilot approval as one of the approvals required for a change. If you are subject to regulations, be extremely careful. None of the major compliance rules require someone to read every line of code, but most require someone to approve every change.
In a company like this, a manager's performance is not measured by the scope of his supervision, i.e., the number of employees under him, but rather by the scope of his responsibility, i.e., the amount of work he can justify.
Most people still do not understand what it means to have a fully automated technological infrastructure. First, all parts of the technical infrastructure are automated, i.e., the software code, the infrastructure, and the security. Then the same thing happens with the business infrastructure, i.e., finance, operations, compliance, and everything that operates on this technology.
This will not be a world without controls, but a world with more controls than ever before, and almost all of them will be done automatically. Automatic double and triple checks will become a specialty in their own right.
Does anyone read the code anymore? Mostly not. The machines write it, check it, and then the machines check it themselves. This is not necessarily recklessness, but this is how the most reliable systems we have ever built work.
Everyone can purchase access to the same models. What will distinguish companies is whether they intentionally rebuild the process around this model. Technology doesn't wait. The question is: Will you fall behind?
Keep David Shapiro in your library
Save the videos and channels worth coming back to, and find them again in one place.
