About This Video
A 17-minute video from David Shapiro about a post Anthropic published on October 15, 2026, describing how the team behind Claude Code reviews its own code. Claude writes about 90% of the code in Claude Code, so the post asks whether anyone still reads it and who catches problems. Shapiro walks through the process, argues the underlying principle is much older than AI, and draws three implications for companies.
Summary
Anthropic's team replaced the question "did a human read the code?" with "which check, automated or human, is the right one to catch what could go wrong?" Their output went up and their reverts went down. Shapiro says the same pattern (machines checking machines, with people designing the checks and owning the outcome) already runs databases, networks, and accounting, and he expects it to spread across the whole business.
Anthropic's Results (as Reported in the Video)
- From June to September, pull requests merged into Claude Code more than doubled, while the share reverted fell by more than 40% (01:49).
- In May, about 2,500 code changes a day merged into Anthropic's mono repo. By September it was more than 30,000, or more than 20 per minute (02:20).
- After AI review began on Anthropic's own pull requests, the share receiving substantive review comments rose from 16% to 54% (05:21).
- After a few changes to the review loop, the share of pull requests passing in a single round rose from 65% to 78% (07:23).
The Layers of Review
- Verify before review (04:22). Claude is given something it can run (tests, a build, a screenshot to compare with the design) and must show output rather than just say it is done. The engineer who created Claude Code estimates this makes the result two to three times better.
- AI review of every pull request (04:48). Several agents hunt for bugs at the same time. A separate group of agents votes on each finding, and a finding is posted only if enough agree it is real. Every finding must be answered: fixed, or closed with a reason.
- Automated security review (05:21). A pull request cannot merge while any of its findings are open.
- Usual automated checks (05:33). Tests and builds.
- Human approval scaled by risk (05:37). Low-risk changes such as documentation fixes need no human approval if automated checks pass and a trusted author made them. Ordinary product changes need one person. The riskiest code needs two. The change sets the tier, not the author.
- Merge queue and staged release (06:19). The queue reruns every check. Changes usually ship to Anthropic employees first behind a feature flag, and flags and rollbacks undo most mistakes within minutes.
The Goal and the Guardrail
- The scarce resource is no longer code but human attention (03:09).
- New goal: a pull request should merge with at most one human in the loop, and that human can be the author (03:17).
- Guardrail: if reverts or incidents go up, no human time was saved. It was only moved from reviewing to cleaning up (03:28).
Two Rules Worth Copying
- An agent's approval never counts as a human's approval (06:05).
- Whoever prompted the agent is on the hook for the change, the same as if they had typed it (06:10).
Shapiro calls these the two rules he would copy first (15:24).
Keeping the Reviewer Honest
- Every past incident becomes a test case, and the AI reviewer is scored against all of them every day (06:43).
- A coding agent and a reviewing agent can keep each other busy forever. One pull request went through more than 50 rounds overnight before its author stopped it manually (06:55).
- Fix: after three rounds, the reviewer asks the author to step back and rethink the approach (07:16).
- Humans now make the decisions machines are bad at: whether to build something at all, which code is too risky to leave to machines, which designs set a pattern for others, and whether the evidence holds up (07:44). A person is accountable for every change that ships, whoever typed it (08:06).
Caution From Shapiro
- This is Anthropic grading its own homework, and nobody has independently checked the numbers (08:15).
- Anthropic spends far more on tokens than most businesses would want to, and its code review product only works with GitHub (08:22).
The Older Idea
Shapiro's point is that machines checking machines is not new (08:36):
- Oracle databases: every change is written to a log, shipped to a standby server that replays it, and separate processes watch the log for anything wrong.
- TCP: puts a checksum on every packet and resends anything damaged or missing.
- Error correcting memory: fixes a flipped bit on its own.
- Double entry bookkeeping (09:22): more than 500 years old, it records every transaction as a debit and a credit so the books must balance. Triple entry proposals add a cryptographically signed receipt as a third verifiable party.
- Claude Shannon (09:51): in 1948 he showed a message can be sent reliably over a noisy channel if the right redundancy is added.
His conclusion: systems were made reliable by having machines check machines, and people design those checks (10:06). He says AI is an epistemic bubble whose members often do not realize engineering and finance solved this long ago (10:13).
Auditor Agents Already Exist
- Shapiro predicts agents that do the work, agents that supervise them, agents that coordinate, and agents whose only job is auditing safety and security: an org chart of their own (10:29).
- Security agents watch corporate networks around the clock, and some triage alerts entirely on their own (10:50).
- Other agents audit code repositories for vulnerabilities. In 2025, Google's Big Sleep agent found a flaw in SQLite that, per Google, only attackers knew about (11:01).
- Audit firms use AI to check every transaction in a general ledger instead of a sample (11:23).
Implication One: The Future of Coding
- Writing code is no longer the scarce skill, and reading every line is no longer possible (11:45).
- Valuable work moves upstream (deciding what to build and specifying it precisely enough for a machine to check) and downstream (designing the checks and owning risk). That is where senior engineers belong (11:57).
- Pulling a senior engineer from deep work to catch a routine mistake wastes your most expensive attention (12:08).
- When the same review comes up 100 times, it should become a rule, a test, or a tool (12:20).
- Start with your worst outage and test your AI reviewer against it daily. Nobody else has your incidents, so nobody else can build that test (12:25).
Implication Two: Efficiency
- Shapiro calls AI a bottleneck shifting machine: speed up writing and the bottleneck moves to reading (12:48).
- He cites a study of more than 10,000 developers in 2025 by a company that measures engineering teams (he names it as "Nero's AI"; the spelling is unclear in the transcript). Teams using AI heavily merged 98% more pull requests, but review time rose 91% (12:57).
- The Claude Code team built for the new bottleneck: more than double the output, and the revert rate down by almost half (13:19).
- That only works if you build the floor before opening the fire hose. Anthropic can loosen human review because nearly everything is reversible: tests agents can run, feature flags, staged releases, and fast rollback (13:29).
- In Google's 2025 DORA research, only about 21% of teams could recover from a failed deployment in under an hour. If you cannot undo mistakes quickly, you cannot afford to review less (13:44).
- Start strict and loosen only when the evidence supports it (13:58).
Implication Three: The Org Chart
- Most companies bolt AI onto the old structure, with a person supervising a portfolio of agents and reading their output. If that person reviews line by line, the organization has only moved its queue from typing to reading (14:06).
- The end state looks like the verification stack: machines do the work, supervision, coordination, and most auditing, while people hold purpose, trust, and accountability (14:31).
Three jobs for executive leadership (14:42):
- Map every kind of decision by how much human attention it needs: none, a human on the loop who watches and can step in, a human in the loop who approves each step, or a licensed signature such as a doctor's or engineer's. Anthropic's risk tiers are an early version of this map.
- Automate the coordination before you fire the coordinators, because coordination is one of the biggest bottlenecks in any company.
- Keep a human on the hook.
Shapiro notes that in September GitHub let companies count Copilot's approval toward the approvals a change requires, so not everyone agrees (15:37). He warns regulated companies to be careful: none of the major compliance rules he looked at require a human to read every line, but most require someone to approve each change (15:47). Managers would be measured by span of accountability (how much work they can answer for) rather than span of control (how many people report to them) (15:57).
The Punchline
- First the technical stack is automated (code, infrastructure, security), then the business stack (finance, operations, compliance) (16:13).
- This is not a world without checks but one with more checks than ever, almost all automatic. Automatic double and triple checking becomes its own discipline (16:37).
- Does anyone read the code anymore? Increasingly, no. Machines write it, check it, and check the machines, which is how the most reliable systems we have built already work (16:48).
- Everyone can buy the same models. What sets companies apart is whether they rebuild the process around the model on purpose (17:08).
Key Takeaways
- Replace "did a human read it?" with "which check is right for what could go wrong?"
- Human attention is the scarce resource, so spend it on decisions machines are bad at.
- Layer checks (verification, AI review, security, automated tests, risk-scaled approval, staged release) because each misses something the others catch.
- An agent's approval never replaces a human's, and the person who prompted the agent owns the outcome.
- Test your AI reviewer daily against your own past incidents.
- Build fast rollback and feature flags before reducing human review.
- Treat Anthropic's figures as self-reported and unverified.
Reflect & Discuss
- Which checks in your own work are really a proxy for "a human read it," and what would a more precise check be?
- How quickly could your team undo a bad change? Is that fast enough to review less?
- Which review do you repeat often enough that it should become a rule, a test, or a tool?
- If your regulator requires someone to approve each change, how would you keep a named person accountable when agents do most of the work?
- Where does Shapiro's argument rest on Anthropic's own numbers, and how would you check them?