Welcome to the first monthly roundup of the AI code review space.
April was the month that agentic code review tools stopped being a "nice to have."
A wave of high-profile software breaches hit security teams in rapid succession: Vercel, Vimeo, ADT, Medtronic, Autovista, TrueConf, were all hit, plus a fresh npm supply-chain attack on April 30.
Customer data, source code, internal credentials, and live infrastructure all spilled out in droves.
So what's driving the uptick?
New data this month points to one contributing culprit: the firehose of AI-written code flooding codebases faster than anyone can review it.
ProjectDiscovery's 2026 AI Coding Impact Report, published April 22, surveyed 200 cybersecurity practitioners.
100% reported increased engineering delivery in the past year, with 49% attributing most or all of it to AI-assisted coding.
Two-thirds spend more than half their time manually validating findings rather than fixing the underlying issues.
A separate Sherlock Forensics audit of 50 AI-built applications found 92% had critical-severity vulnerabilities.
The bottleneck has moved downstream, and manual verification doesn't scale to agentic-volume PR throughput.
That tailwind is what the major AI code review tools spent April competing into. CodeRabbit, Cursor Bugbot, and Macroscope all shipped or extended autonomous-fix capabilities. The product category is shifting from "find the bug" to "fix it without me asking."
But the same throughput that creates the demand also created the month's pricing fights.
Greptile's March price change ($30/seat for 50 reviews, then $1/review) sustained backlash through April, with named founders posting bills jumping from $30 to $500+ as their AI agents push 500+ PRs/month.
Below, a breakdown of the moves made by the six big code review players.
MACROSCOPE
1/ Agent.
Like other dedicated AI code reviewers, Macroscope identifies bugs in the background. You open a PR, it analyzes the diff against your wider codebase, and leaves review comments on GitHub with any issues it detects.
But because Macroscope already understands your codebase, it can do more than review PRs. It can use the codebase to answer questions about how your product works, ship fixes, or give leaders weekly status updates on what their team shipped and how the product is evolving.
Macroscope's "Agent" allows you to tap into these capabilities on demand — from Slack, GitHub, or via API/webhooks.
Agent also connects to other tools around your codebase — Slack, Jira, Sentry, PostHog, BigQuery, LaunchDarkly, and any MCP server — so you've got a codebase-aware agent that can ingest data and take actions across your entire stack.
This unlocks use cases like:
- End-to-end fixes — "This Sentry error is spiking — find the cause, open a PR to fix it, and file a Jira ticket for Eliza to QA."
- Cross-stack investigations — "Why did signups drop yesterday? Check Sentry, PostHog, and recent deploys."
- Reporting for leaders — "Summarize what the platform team shipped this week and post it in #eng-updates every Friday."
- Onboarding & docs — "Walk me through how billing works in this repo. Write an internal doc in Notion for new hires, and publish a customer-facing version to Mintlify."
2/ Agent pricing.
Previously bundled, Agent has its own usage-based pricing.
- You pay the raw LLM cost + 5% markup.
- 1,000 free Agent credits per workspace (~$10 of usage), every month. Most light users won't pay anything extra.
- Transparent. Admins can see per-run costs and export the full usage log as CSV from Settings → Billing.
- Live for new signups now, rolled out to existing customers on April 27.
GREPTILE
1/ Brand refresh.
Greptile updated their visual identity this month — new logo, new illustration style.
2/ Fix in Devin.
Greptile review comments now have a Fix in Devin button. Click it, and the issue (file paths, line numbers, suggested code) gets handed to a Devin session that opens a PR with the fix.
CODERABBIT
1/ Agent for Slack (Early Access).
CodeRabbit joins Macroscope in extending their agent to Slack. You can investigate code, generate plans, and open PRs from any thread.
Connects to Jira, Linear, Notion, Sentry, Datadog, PagerDuty, Figma, Google Drive, AWS, GCP, and any MCP server.
Billed separately from CodeRabbit's review plans (in agent minutes, not seats).
A pay-as-you-go toggle so teams that hit their plan's PR limit can keep shipping. Only over-limit reviews get charged.
Autofix (which commits AI-generated fixes to your branch or a stacked PR) is now available on GitLab, not just GitHub.
4/ CLI improvements.
v0.4.0 added browser sign-in and full — agent flag support for Codex, Cursor, Claude Code, OpenCode, etc. v0.4.1 added coderabbit stats.
CURSOR BUGBOT
1/ Learned rules.
Bugbot now tries to learn from PR feedback — downvotes on its comments, replies explaining what was wrong, and issues human reviewers flag that it missed.
It also tries to promote useful rules automatically and disable ones that stop working.
2/ MCP support.
Bugbot can now access MCP servers for additional context during reviews. Teams and Enterprise plans only.
3/ Fix All.
A new action that applies multiple Bugbot fixes in one go, instead of one-by-one.
CLAUDE CODE CODE REVIEW
1/ /ultrareview.
A new slash command that runs a deeper code review than the standard /review in the cloud.
It launches a fleet of agents in parallel that each verify findings before surfacing them. /ultrareview is designed to be better at handling complex codebases.
You trigger it manually (it doesn't run automatically), and it works on either your current branch diff (pre-PR) or a GitHub PR.
Reviews run in the background and take 5–20 minutes.
It's billed separately from regular Claude Code usage — $5–$20 per review depending on diff size. For context, this is still an order of magnitude more expensive than the dedicated usage-based code review tools on this list.
Pro and Max users get three free runs to try it (expiring May 5).
GITHUB COPILOT CODE REVIEW
No new features this month — just billing and admin changes.
1/ Billing change incoming (June 1).
Each Copilot code review on a private repo will start consuming GitHub Actions minutes on top of the AI Credits it already costs.
Public repos unaffected.
2/ Usage metrics.
Admins can now see active vs. passive Code Review users in the Copilot usage metrics, and those counts are now aggregated in the usage metrics API.
The State Of AI Code Review in April 2026
April in a nutshell: Detection is becoming table stakes, autonomous fixing is the new battleground, and per-seat pricing is starting to crack under agentic PR volume.
See you at the start of June with May's moves.