AI Writes Code Faster Than Your Team Can Review It - Andrew Norrish, Sourcegraph
AI has shifted the bottleneck in software delivery from writing code to reviewing it, and SREs are absorbing the incidents that unreviewed AI code produces. This talk examines why trust in AI-generated code is lagging, why SRE and platform teams are best placed to respond, and how code search and a code graph context engine support investigation, prevention, and remediation across large codebases.
The review bottleneck has moved downstream
AI has changed where software delivery slows down. Writing code used to be limited by how fast a developer could type, but now the limit is how fast humans can review what AI produces. Engineering teams lean heavily on agentic tools, velocity rises, and codebases balloon. Pull request counts climb and PR sizes grow with them, so developers are pressured to clear a queue rather than deeply verify each change. The shift shows up in leadership conversations too. The first question on an AI roadmap used to be how many heads it could save, and that question stopped coming up in Sourcegraph’s most recent customer advisory board.
Unreviewed AI code is driving incidents
AI-written pull requests often lack the organizational and cross-repository context needed to be production quality, and some get merged without a human ever reading them. At that volume, breaking changes will eventually slip through. The result is a rise in AI-initiated incidents that are more frequent, slower to resolve, recurring, and costlier. Responders are asked to fix code that no one on the team may have seen, without runbooks tailored to it.
Cross-service failures are especially hard. Agents and engineers both struggle with them, and teams fall back on slow, error-prone approaches like commit scanning. A fix found in one repository may need to land in hundreds or thousands of others, and when each team applies it by hand, things get missed. In regulated sectors such as financial services, the stakes and compliance burden are higher still.
What the industry data shows
Industry projections put AI-written code at roughly two-thirds of all new code by 2027. Some organizations estimate nearly twice as many PRs are now merged with agentic coding, with PRs more than double the size of human-written ones, so developers spend close to twice as much time on review.
Trust lags behind adoption. Almost every developer says they don’t trust everything AI writes, yet nearly half say they don’t always verify it. Quality and security decline accordingly, with more incidents per PR, more deployment-related issues, and more rollbacks, hotfixes, and customer-impacting incidents. Anthropic has also reported that heavier reliance on AI erodes developers’ comprehension of the code they ship.
Why SREs and platform teams are the right place to respond
AI performs best in well-bounded domains with full context, such as vulnerability remediation, security scanning, large-scale migrations, and non-developers prototyping internal tools. SREs and platform teams have operated in exactly this kind of bounded, semi-autonomous territory long before AI, using automated remediation, incident response runbooks, and CVE monitoring. That makes them both the barometer for how trustworthy AI-generated code is within an organization, measured by the incidents it produces, and the teams best positioned to gain from AI inside processes they already control. They are building the guardrails that keep AI-initiated incidents from spreading, and they can use AI to improve their own productivity and safety.
Hiring more SREs is not a durable answer. The role is in high demand and increasingly expensive, and incident volume is outpacing hiring.
Code intelligence as a context engine
Sourcegraph’s platform rests on a full code graph, a complete index of an organization’s entire codebase. Code search and code intelligence, refined over more than a decade, sit on top of it. For agents, these form a codebase context engine accessible via MCP, which powers AI features for humans and agents alike. The same tooling that helps developers search and understand code also helps prevent and resolve incidents.
Investigation, prevention, and remediation
For investigation, deterministic search runs across every repository, branch, and commit with a single query, so root causes that once took days can be found in minutes. Deep search, an agentic feature, answers questions like what’s broken and returns cited answers.
For prevention, monitors alert when risky code is committed or non-compliant patterns appear. This lets organizations enforce their production requirements on AI-written code before it causes trouble.
For remediation, once a break or risky pattern is identified, the same tooling finds every affected area and can make bulk changes across all repositories in the organization, so fixes don’t stop at one team’s boundary.
Customer examples
Sourcegraph’s own security team built a triage workflow around HackerOne. As report volume grew to the point that each one demanded real-time judgment, webhooks feed incoming reports into code search, which determines whether a report can be ignored, needs deeper review, or warrants a proposed change.
An enterprise with over 5,000 developers built an internal root cause analysis agent. When a service goes down or error rates spike, the agent pulls logs and traces, identifies the deployed branch or tag (rarely main), and uses agentic search over Git history to find the commit and author responsible. It then either reverts and redeploys or hands the investigation to the SRE team.
Another customer maintains an internal code review agent used by thousands of developers, built for a massive monorepo that had previously been searched with grep each time. Their evaluation suite spans hundreds of historical branches, and their agents need instant, affordable, deterministic search across all of them. A read-only code finder agent makes this possible, and when the evals pass, the push-and-publish process kicks off.