The problem
In Microsoft's account of ten months of agent pull requests in one large repository, the author says the bottleneck has moved to review. He adds that one person with good judgement can generate pull requests faster than a team can review them.
Of 878 agent pull requests, 67.9% of those decided were merged, against 87.1% for Microsoft's engineers, though the two groups did different work.
What reviewers keep finding
GitHub lists shortcuts agents take in CI: removing tests, skipping lint or adding "|| true" to test commands. It also warns of duplicated helpers and of code that passes every test and is wrong.
GitHub says any change that weakens CI is a blocker.
- Skipped or deleted tests
- Loosened thresholds
- Duplicated helpers
- New packages nobody chose
What a bot can and cannot do here
GitHub's own agent cannot approve its own pull request, and the person who asked for it cannot approve it either. By default Copilot reviews do not count toward required approvals.
A pre-review check should follow the same rule: comment, never approve.
Which job fits
Start with the pre-review check on marked pull requests and a check on new packages. Add a scored drill if your reviewers are new to agent code, and hand over small, clear issues for pull requests you accept one by one.
Sources and limits
- Microsoft .NET blog: ten months with the Copilot coding agent in dotnet/runtime Checked 2026-10-12.
- Of 878 agent pull requests, 535 were merged and 253 closed, a 67.9% success rate against 87.1% for Microsoft engineers, though the populations differ.
- Success was highest on cleanup at 84.7% and lowest of the named task types, performance, at 54.5%.
- The author says the bottleneck has moved to review.
- After a firewall fix and build instructions, success on agent pull requests rose from 38.1% to 69%.
- GitHub blog: agent pull requests are everywhere, here is how to review them Checked 2026-10-12.
- Agents may take CI shortcuts such as removing tests, skipping the lint step or adding "|| true" to test commands.
- Agents often duplicate helpers that already exist, and the riskiest output is code that compiles, passes every test and is wrong.
- GitHub says any change that weakens CI is a blocker.
- GitHub: risks and mitigations of the Copilot coding agent Checked 2026-10-12.
- GitHub's own agent can push to a single branch only, and its workflows do not run until someone with write access approves them.
- GitHub prevents the person who asked the agent to open a pull request from approving it.
- GitHub filters hidden characters, such as text in an HTML comment, before passing user input to the agent.
- GitHub: Copilot code review Checked 2026-10-12.
- By default Copilot's reviews do not count toward required approvals.
- Dependency management files such as package.json and Gemfile.lock are not reviewed.
- A review costs about $0.05 to $1 (Lite) or $0.25 to $5 (Balanced) in AI credits, not counting Actions minutes.