What AI review reliably misses

The flip side matters more. Knowing where AI review goes quiet is what keeps you from trusting it too far.

It misses architecture. A model reading a diff sees the change, not the system. It cannot tell you that the new call creates a circular dependency, that this belongs in a different service, or that the pattern fights the rest of the codebase. Independent studies in 2026 found that automated reviewers detect only a modest share of the real issues in a change, and that they get worse as the surrounding context grows.

It misses intent. The model does not know what the pull request was supposed to do, so it cannot tell you the code is correct but solves the wrong problem.

It misses security nuance. It flags an obvious injection string, but not the subtle authorization gap where a user reads another account by changing an id, because that needs your domain and your threat model.

It misses domain rules. The tax rule, the pricing edge case, the regulatory constraint — none of that lives in the diff.

A blunt way to see the gap:

Ask the model what this change is for. When it guesses wrong, you have found the exact class of problem it cannot catch for you.

Safety angle: these gaps are precisely the ones that cause outages and breaches. That work belongs to the human reviewer, and no amount of good prompting moves it onto the machine.