When an AI reviewer misses a bug, the code was usually right there

We classified 792 missed bugs across thirteen models. 79% were real misses, where the relevant code was available and the model did not find the problem. Only 5% were artifacts of the test setup.

It would be comforting if the misses were the benchmark's fault. They are not.

Every bug a model failed to find gets classified. Either the code needed to spot it was served to the model and it still missed, or the bug points at code outside what the replay corpus could serve, or we cannot tell. Across all thirteen models and every pull request, the split is:

ClassificationCountShare
Real miss62879%
Untestable12616%
Not in corpus385%

Four out of five misses are real. The model had access to the code, asked for the files it wanted, produced its findings, and the bug a human caught was not among them.

Why this classification exists at all

A replay benchmark serves files from a snapshot. If a reviewer flagged something that depends on a file the snapshot never captured, scoring the model for missing it would be measuring our corpus, not the model. That is the "not in corpus" bucket, and at 5% it is small enough not to move any ranking.

"Untestable" covers cases where we cannot establish whether the code was reachable. At 16% it is not nothing, and we exclude it from the fair-recall figure on each model page for that reason.

What is left is the number that matters.

What models do report

The severity mix of the findings models actually produce, across all thirteen:

SeverityShare of findings
Critical3%
High29%
Medium48%
Low20%

Nearly half of everything these models say is graded medium by the model itself. Only 3% is called critical. That shapes the reading experience more than any recall number: a reviewer opening a pull request sees a wall of moderate observations, and the severe findings are rare enough to be easy to miss inside it.

The uncomfortable reading

If you deploy one of these as a gate, the base rate is that it misses most real bugs, and when it misses, it is not because the tooling failed it. That is worth knowing before the tool becomes the reason a human stops reading the diff.

Every miss is published. The per-model pages list them with the original reviewer's description, so you can judge for yourself which kinds of bugs a given model walks past.

FAQ

Why does AI code review miss bugs?

Mostly not for lack of context. Classifying all 792 bugs these models failed to find, 79% are genuine misses — the model already had access to the relevant code and simply didn't flag the problem. Only 5% were missed because a needed file wasn't available in the test setup.

Does a clean pass from an AI code reviewer mean a pull request has no bugs?

No. The base rate here is that these models miss most real bugs, and when they miss, it's usually a genuine miss, not a gap in what they were shown. A clean pass from an AI gate shouldn't be read as evidence the pull request is bug-free.

What severity are the issues AI code reviewers actually flag?

Mostly medium. Across all models, 48% of reported findings are self-rated medium severity and only 3% critical — a wall of moderate comments is the typical output, with severe findings rare enough to get lost in it.