More review is not the same as better review
Anthropic says the Claude Code team runs automated bug and security reviews on every pull request. Several agents look for bugs. Other agents vote on the findings. Open findings block the merge until someone fixes or resolves them.[1]
The same article describes the failure mode. One pull request went through more than fifty review-and-fix rounds overnight. About 59 percent of the repeated findings concerned code that already existed on the first pass. The team responded with a three-round cap, diff-only re-review after the first passes, class-level fixes, and suppression of repeated findings.
A reviewer that cannot stop is a work generator, even when every individual comment sounds reasonable.
Put a budget on the loop
A review loop needs a stop rule before the first review starts. Set the maximum number of autonomous passes. Define which failures can trigger another pass. Record the new diff and the evidence produced on each lap. Escalate when the same bug class returns or when two fixes reverse each other.
Anthropic reports that its convergence changes raised one-round passes from 65 percent to 78 percent. Pull requests needing five or more rounds fell from 8.9 percent to 1.5 percent. Those numbers describe its internal process. They are not a target for every repository.
Approval is a different control
GitHub pull request reviews distinguish comments, approvals, and change requests. Repository administrators can require approvals before merge. CODEOWNERS can request the people responsible for changed paths.[2]
Anthropic makes the same separation explicit. Automated review can clear a low-risk change under its policy, but an agent approval does not fill a human approval slot. Higher-risk paths require one or two people. The person who directed an agent remains responsible for the result.
VS Code 1.142 adds more visible control over agent sessions. It can stop attached background shells, show the active agent harness, and let administrators restrict permission modes. These controls govern execution. They do not decide whether a code change fits the product or should ship.[3]
Keep the handoff inspectable
The machine should hand over a bounded packet, not a green badge. Include the exact revision, the final diff, resolved and open findings, test output, rollback route, and the person who owns the decision. If any field is missing, the packet is incomplete.
The Hacker News discussion around Anthropic's post contains support, skepticism, and questions about maintainability. It is useful as reaction, not evidence that the workflow transfers to another team.[4]