We have been running LLM-assisted code review on a few client codebases for about a year. The headline: it works, but only with very specific guardrails — and the failure modes are sneakier than the wins are obvious.
What works
Style + convention enforcement (PR-time), spotting obviously-missing tests, and surfacing TODOs and FIXMEs that humans miss. These are the boring 80% of CR comments and LLMs cover them well.
What does not
Architectural correctness, security review, and anything that requires reasoning about side effects across files. LLMs hallucinate confidently here, and a hallucinated security-review pass is worse than no pass at all.
About the author
Keep reading
Related articles.
Keep talking
Talk to the engineering team
If you're shipping something into production and want a sanity check from people who've done it, we'd be glad to compare notes.