At Anthropic, AI Reviews Code First; Human Approval Depends on Risk
AI checks the code first, and humans approve based on how risky the change is and who wrote it. Anthropic says merged change requests more than doubled from June to September, while the rollback rate fell by more than 40%.

On October 15, Anthropic published an account of how the Claude Code team reviews its own code. The setup is straightforward: AI checks AI-written code first, and humans sign off depending on how risky the change is. According to the team, the number of change requests merged into the codebase more than doubled between June and September, while the share that had to be rolled back afterward fell by more than 40%.
AI looks at it before a human does
Anthropic says Claude writes about 90% of Claude Code’s own code. With that volume of change, reading every line by hand simply does not scale, the team explains. So instead of saving review for the end of a task, they shifted to catching and fixing errors while the code is still being written.
The first step is making Claude verify its own output. It runs tests or compares the rendered screen against the design spec, and reports actual results rather than just declaring the work done. Next, a separate AI takes a fresh look at the changes. Once a formal change request is opened, Claude examines the full codebase alongside the intent behind the change, checking whether it breaks anything else.
Problems the AI finds are not handed straight to a human, either. Multiple AI instances hunt for errors, and still other AI instances judge whether each flagged item is a real problem. Only findings that win enough agreement survive as review comments. Security review runs as a separate track. Remaining comments must either be fixed or accompanied by a written explanation of why the author does not consider them a problem before the code can be merged.
Risky changes need a human sign-off
Whether a human approval is required depends on how risky the change is. A documentation edit and a change to the auto-update mechanism are not held to the same bar. Automated classification assigns a risk level, and an additional judgment step decides whether review by another person is needed. Sensitive areas, and configuration files for automated checks, always get human review. The streamlined approval path applies only to authors on a repository’s trusted list.
Whoever directed the AI to do the work owns the result. Nor can AI stand in for an approval that a human is supposed to give. The team’s goal is to merge most change requests through no more than one person, the author included, without increasing rollbacks or incidents. Just before merging, the system confirms that the change still passes checks when combined with other changes. New features typically go to employees first, and can be switched off without shipping a new release if something goes wrong.
Can my team use this?
Code Review for Claude Code, the version available to outside development teams, is generally available on the Team and Enterprise plans, Anthropic said. Administrators pick a review depth per repository from Quick, Standard, or Deep. Deep makes sense, the company explains, for work where the cost of missing a single error outweighs the extra time spent reviewing. There is also a lighter-weight review mode developers can run in their own working environment.
Automated review brought its own problem: loops. The team described one change request that bounced between review and revision more than 50 times over the course of a single night. Tracing the repeated comments showed that about 59% concerned code that had already been there at the time of the first review. Alongside how many real errors review catches, the team now watches how many round trips it takes to clear review. Changes that caused incidents in the past are used as material for daily tests of review performance.
Anthropic explained that it counts not only the time humans spend reviewing, but also the time spent fixing bad code, as a cost. That said, the team noted there is still no mechanism to automatically raise the approval bar when incidents or rollbacks start climbing. Building that mechanism, the team says, is a prerequisite for widening the range of changes that merge without passing through human hands, and it remains on their to-do list.