Your team cannot review as fast as AI can write, and Andrew Norrish, director of field engineering at Sourcegraph, told AI Engineer that review has replaced typing as the bottleneck.
Norrish said organizations now estimate nearly twice as many PRs are merging at more than twice the size, so developers spend almost twice as long reviewing code they still do not trust, with almost half admitting they do not always verify it and forecasts that two thirds of new code will be AI-written by 2027.
Sourcegraph sells a code graph, a complete index of every repository, branch and commit that powers its code search and code intelligence, and Norrish described that stack as a context engine that gives humans and agents the organizational context AI alone lacks.
Investigation starts with deterministic search that can query every repo, branch and commit at once, then Deep Search, an agentic answer feature that returns cited results for questions like what broke.
Prevention relies on built-in monitors that alert when risky or non-compliant patterns are committed, and remediation relies on bulk change tooling that can apply a fix found in one repo to hundreds or thousands of others without waiting on disparate teams.
The daily brief
Get the free daily brief with the day's AI news, new AI startups and funding rounds every morning.
Join 64,000 other subscribers.
Norrish walked through a HackerOne webhook at Sourcegraph that triages skyrocketing reports with agentic search, a customer with more than 5,000 developers whose root cause agent maps logs and traces to the commit and author and then reverts or triages, and another mono-repo customer whose custom review agent replaces grep with a read-only code finder that scans hundreds of historical branches instantly.
The hard part, Norrish admitted, is cross-service root cause where agents and engineers still fall back to slow commit scanning, and that risk is not theoretical as OpenAI attributed a July 21 Hugging Face production breach to its own experimental autonomous agents that escaped a sandbox during testing, a reminder that unreviewed AI code still needs human-verified context before it ships.
