AI Code Review Bots: BugBot, Codex, Claude Compared

A new wave of AI code review bots arrived in 2025-2026, and they work fundamentally differently from the first generation. BugBot runs 8 parallel review passes on every PR. OpenAI Codex reviews code with full repository context via AGENTS.md. Claude Code Review dispatches multiple specialized agents in parallel. This guide compares the second wave head-to-head on pricing and capability - and then does something the rest of the comparisons do not, which is rebuild the benchmark everyone quotes. It credits one bug per pull request. The same cases hold 160. Scored against all of them, by two independent judges, the published leaderboard turns over.

Why Is There a New Wave of AI Code Review Bots?

The first generation of AI code review tools, covered in our AI code review tools guide, relied on static analysis enhanced with language models. GitHub Copilot Code Review, CodeRabbit, Qodo, and Sourcery analyze diffs and leave comments. They work. But they share a fundamental limitation: they review code the way a human skimming a diff does, one pass, top to bottom.

Adoption has moved faster than the debate about it. When we measured review practice across 222 of the most-starred projects on GitHubin August 2026, a third of all merged pull requests had already drawn at least one bot review, rising to 37% among the busiest projects. Worth knowing before you read any team's review coverage figure: a bot reviewing a change is not the same as a colleague reading it.

The second wave, arriving in late 2025 through early 2026, introduced three architectural shifts:

• Multi-pass review - BugBot runs 8 parallel passes with randomized diff ordering, catching bugs that single-pass reviewers miss because context from later in the diff would have revealed the issue earlier.
• Multi-agent systems - Claude Code Review dispatches specialized agents (logic, security, API misuse, boundary conditions) that each focus on one class of issue, then deduplicates and ranks the findings.
• Full codebase indexing - Greptile and Codex build a graph of your entire repository, so they understand how a changed function affects callers three layers up the stack.

These are not incremental improvements. The shift is from "AI that reads your diff" to "AI that understands your codebase." That matters because the bugs that actually reach production are almost never visible in the diff alone.

"The bugs that reach production are almost never visible in the diff alone. They live in the interactions between changed code and everything it touches."

What Does Each Bot Actually Catch?

Not every bot targets the same issues. BugBot deliberately skips style and formatting to focus on logic bugs. Claude Code Review prioritizes architectural and security concerns. Codex leans heavily into backward compatibility and edge cases. Here is how they compare across five detection categories:

None of them arrive knowing your house rules, which is the gap a Claude Code review skill fills - a committed checklist that runs on the diff before the PR is even opened.

The catch-rate column is the Greptile 2025 AI Code Review Benchmarks, 50 real-world PRs from projects including Sentry, Cal.com and Grafana. Codex and Claude Code Review were never in that set, so nobody has a comparable number for them. The last two columns are ours, and they are why this guide got rewritten.

What Happens When You Score Every Comment Instead of One Bug?

A catch rate asks one question per case: did the tool find the bug we nominated? That leaves two holes. A reviewer that posts three times as many comments gets three times as many chances at the nominated bug, and the metric never charges it for anything else it said. And the nominated bug is not the only bug in the diff.

So we rebuilt the ground truth. Every comment from five competitors and our own reviewer, 749 of them across 39 cases, was shown with the diff to two independent judge models, classified independently as a real defect, a nitpick or wrong, and clustered so that a bug several tools reported counts once. A comment becomes evidence only where both judges agree. Those cases turned out to hold 160 distinct real defects, more than three per case on average.

Scoring against all 160 rather than one nomination per case changes who leads. The published benchmark ranks Greptile first; scored against every real defect in the same diffs, CodePulse Reviews finds 76.9% against Greptile at 34.4%.

Defect recall is the share of the 160 known defects a tool found. Case recall is the share of the 39 cases where it landed at least one real finding. Precision counts nitpicks against a tool, and excludes the roughly 16% of comments the two judges could not agree on rather than counting them either way.

More comments did not mean more bugs

Read the comment column against the defect column. CodePulse Reviews found 123 of the 160 real defects, and 125 of its comments described one. Greptile found 55, a little under half as many, from 226 comments - of which 64 described a real defect, 80 were nitpicks and 47 were wrong. Per pull request that is 3.3 pieces of noise from Greptile against 0.2 from us. CodeRabbit and Copilot show the same shape from a lower base: both post more than a hundred comments to find fewer real defects than either of us, at 45.3% and 35.3% precision. Graphite is accurate when it speaks and hardly ever speaks, at 4.4% defect recall.

"Finding more than twice the bugs while being wrong a quarter as often is not a tie. Somebody on your team pays for the difference."

The precision gap is a different category of tool: 94.0% of our comments described a real defect, against 33.5% of the comments Greptile posted, with 0 wrong comments against 47.

Why we do not file nitpicks

8 nitpicks and 0 wrong comments across 39 pull requests is a product decision rather than a tuning accident. A language model can always say something: an unused import, a name that could be clearer, a docstring that could be fuller, a typo in a comment. Every one of those is technically correct, which is exactly why they are worthless as evidence that a reviewer is working, and exactly why a benchmark that only asks "did it find the bug" pays a tool for emitting them.

The cost is not the seconds spent reading one. It is what a steady drip of correct, unimportant comments does to how the next one gets read. Once a reviewer has taught your team to resolve without reading, the critical finding at comment 14 gets closed along with the other thirteen. We would rather be quiet and be read.

The column we used to lose

Until this run Greptile edged us on case recall, and this section conceded it. That has reversed: 94.9% of the 39 cases against Greptile’s 76.9%. We say something real about all but two of them. Stated as a reversal rather than deleted, because the previous version of this guide said the opposite.

Is that headline in-sample?

Partly, and the honest answer is a number rather than a reassurance. Our reviewer carries a checklist written from misses on this same corpus, so the 29 of these 39 cases it was demonstrably not written from were scored separately. On those it finds 79.8% of the defects, above its 76.9% across all of them, and lands a real finding in every one. Two limits the other way: this run covers 39 of 51 corpus cases and our margin is narrower on the 12 it skips, and it is one run per arm in a benchmark that is noisy run to run. The gaps here are many times that noise; a few points would not be.

The benchmark leaked its own answers

This matters if you are weighing anyone's benchmark claims, ours included. The public evaluation forks give away their answers in 3 ways, all of which we found by auditing our own runs: the rival bots' reviews are still sitting on the pull requests, the fork branches are named after the defect they plant, and the repository history reachable from the fixture contains the upstream commit that repairs the bug.

We sealed all three before the run above, and one of them had been working against us: our reviewer found a planted defect, saw a rival bot had already reported it, and suppressed its own comment as a duplicate, scoring a miss on a bug it had found. The other two inflate whoever is exposed to them. We then audited a transcript on a case we had not used to build the seal, and every file the reviewer opened was inside the fixture.

We are not alleging that anyone cheated, and it is worth being exact rather than insinuating. The competitors' comments in this study came from those same public forks with the branch names and the fix commits intact, and there is no way for us or for anyone else to know what those tools read. We know what ours read, because we removed the channels and then checked. Of the six columns above, one was produced under conditions somebody verified, and it happens to be ours. Two channels remain open even for us, and they are named in the full write-up, along with the method and the caveats.

How Do BugBot, Codex, and Claude Compare Head-to-Head?

BugBot (Cursor)

BugBot launched out of beta in July 2025 and reviews over 2 million PRs monthly. Its core design choice is running 8 parallel review passes with randomized diff ordering. This is not marketing fluff - it means the model sees each changed function in different contexts, which catches interaction bugs that single-pass tools miss.

Discord's engineering team reported BugBot finding real bugs on human-approved PRs, with over 70% of flagged issues getting resolved before merge. BugBot's bug resolution rate has climbed from 52% to nearly 80%, a 15-point lead over its closest competitors.

In February 2026, BugBot shipped Autofix, which spawns cloud agents in their own virtual machines to fix the issues BugBot finds. Over 35% of Autofix changes get merged into the base PR. The "Fix in Cursor" button is the tightest editor-to-review loop available today.

Trade-offs: BugBot is tightly coupled to Cursor. At $40/user/month on top of your Cursor subscription ($20/month for Pro), the combined cost is $60/user/month for the review + editor bundle. It intentionally skips style enforcement, so you still need a linter. And if your team uses VS Code or JetBrains, BugBot is not an option without switching editors.

OpenAI Codex

Codex integrates directly into GitHub via @codex review comments on PRs. It applies guidance from AGENTS.md files in your repository, with more specific instructions deeper in the tree for packages needing extra scrutiny. In GitHub, Codex flags only P0 and P1 issues by default, which is a deliberate noise-reduction choice.

The model powering Codex has evolved rapidly. GPT-5-Codex, released in 2025, was further optimized for agentic coding tasks. The current GPT-5.3-Codex focuses on real-world software engineering patterns. According to independent reviews, tasks that failed reliably in mid-2025 now succeed routinely. Codex performed best in backend Python code-review benchmarks and was the only tool to consistently catch backward compatibility issues.

Trade-offs: Token-based pricing makes cost unpredictable for large PRs. Codex requires ChatGPT Pro or Team plans. The AGENTS.md approach means you need to maintain review configuration files in your repository, which is either a feature (version-controlled review rules) or a chore (another config file to keep updated), depending on your team.

Claude Code Review (Anthropic)

Claude Code Review launched in March 2026 and is the newest of the bunch. According to TechCrunch, it dispatches multiple specialized agents in parallel: one for logic errors, one for boundary conditions, one for API misuse, one for authentication flaws, and one for project-specific conventions. A verification step checks candidates against actual code behavior to filter false positives before posting.

Reviews take about 20 minutes on average. Results show up as inline comments on the specific lines where issues were found. Because each agent specializes, Claude Code Review catches architectural issues and cross-cutting concerns that span multiple files better than the other tools tested.

Trade-offs: At $15-25 per review (small PRs around $8-12, large PRs up to $30-40), this is the most expensive option on a per-review basis. It requires a Claude Teams ($30/user/month) or Enterprise plan. GitHub-only at launch, with no GitLab or Bitbucket support. The 20-minute review time is slower than BugBot or Codex for teams wanting instant feedback.

Greptile

Greptile takes a different approach by indexing your entire repository and building a code graph before reviewing any PR. Its v3 release in late 2025 adopted the Anthropic Claude Agent SDK for autonomous multi-hop investigation: it traces dependencies, checks git history, and follows leads across files.

In Greptile's own benchmarks, it achieved an 82% bug catch rate across 50 PRs from Sentry, Cal.com, and Grafana, nearly double CodeRabbit's 44% and ahead of Copilot's 54%. Its v4 release in early 2026 showed a 74% increase in addressed comments per PR and a 68% increase in positive developer replies.

That catch rate is real, and it is also the most volume-dependent number in this guide. On the 39 cases of the re-scored run, Greptile posted 226 comments - more than CodeRabbit, Copilot, BugBot and Graphite each needed on the same diffs. 80 of them were nitpicks and 47 were wrong, which puts its precision at 33.5%, second from bottom in the set. Its multi-hop investigation genuinely does find things nothing else finds, including a missing end-anchor in Discourse's email validator that lets an address slip past the domain whitelist entirely, and it lands a real finding in more pull requests than anyone else here. You are buying real depth and paying for it in review noise.

Trade-offs: The codebase indexing step means onboarding takes longer than diff-only tools. At $20/user/month (Pro plan), it is competitively priced but lacks the editor integration of BugBot or the AGENTS.md configurability of Codex. Supports GitHub and GitLab but not Bitbucket or Azure DevOps. And the comment volume is a real adoption risk rather than a rounding error: only one comment in three carrying a problem that mattered is how teams learn to skim. Worth noting that CodeRabbit is also the agent most willing to block a merge: in our measurement of who actually reviews public code it requested changes on 9.2% of its reviews, more than twice the human rate.

CodePulse Reviews (ours)

Disclosure first: this is our product, and the re-scoring above is ours too - we built the harness, ran our own reviewer through it, and chose the metric. Read our row with that in mind, which is why the per-comment verdicts are published. The head-to-head against CodeRabbit carries the same caveat and the same published limits. CodePulse Reviews differs less in the model than in where the review happens. The other four put their output on the pull request page; this one runs in Slack. You paste a PR link into any channel it is in, and CodePulse reviews the change across correctness, readability, architecture, security, and performance, returning comments tagged Critical, Important, or Suggestion. First review lands in about two minutes. Clicking "Fix the issues" opens a commit on the branch with the fixes applied, so you review a commit instead of retyping feedback.

Pricing runs $6 per developer per month on BYOK, where you bring your own model key and pay the model bill directly; $29 for Team, which puts a frontier model on every review with unlimited reviews; and $49 for Business, which adds Deep Review and a Semgrep SAST pass before the review. Enterprise adds SSO/SAML, audit logs, and self-hosting. The BYOK tier is the cheapest entry point in this comparison, though "cheapest" is doing some work there - your model bill sits on top of it.

Three implementation details are worth naming, because they map onto the weaknesses the rest of this guide identifies. It runs real language servers rather than reading the diff as text, so the reviewer can resolve a symbol to its definition the way your editor does - that missing context is exactly why diff-only tools score weakest on architecture. Dependency caching with team-scoped snapshots restores a previously installed dependency tree instead of reinstalling per review, which is the direct answer to the cold-start cost Greptile pays for its indexing step: repository context without waiting for a full index every run. And on Business, a Semgrep SAST pass runs before the model sees the diff, so deterministic rule-based findings are not left to a probabilistic reviewer - a hardcoded secret is a pattern match, not a judgment call.

Trade-offs: We ran the benchmark above, which is the obvious objection to every number in it, and the reason the method, the caveats and the per-comment verdicts are published rather than summarised. Case recall is the real gap: Greptile lands a finding in 76.9% of pull requests to our 94.9%, so on any given PR it is likelier to say something true, and if "always tell me something" is what you want from a reviewer, that is an argument against us today. The Slack-first workflow is a preference split rather than a strict upgrade: teams that live in the GitHub UI may not want review discussion in a chat channel, and a Slack thread is a weaker audit trail than PR comments. It reviews GitHub pull requests, so GitLab and Bitbucket teams are out. The distinguishing feature is that it feeds CodePulse Analytics, so the review layer and the metrics that judge it read the same history.

"The right AI review bot depends on what kind of bugs are reaching your production. If it is logic errors, pick BugBot. If it is architectural drift, pick Claude or Greptile. If you do not know, you need measurement first."

What Are the Real Limitations Teams Report?

Four problems keep coming up in community feedback, benchmarks, and case studies, and they apply to all the second-wave bots:

1. Noise erodes trust faster than false positives do

Every tool generates false positives, and the honest surprise in the re-scoring was that outright wrong claims are not the main problem. Nitpicks are. Greptile filed 47 wrong comments across 39 pull requests and 80 nitpicks; Copilot's split was similar at 37 and 49. A developer can forgive a bot for being wrong occasionally. What teaches them to click "resolve" without reading is a steady drip of correct, useless comments. Once that habit sets in, the critical finding buried at comment 14 gets dismissed with the other 13.

2. Cost scales with PR volume

A team of 20 developers merging 200 PRs per month pays roughly:

BugBot:              $40/user x 20 = $800/mo  (200 PRs included)
Greptile:            $20/user x 20 = $400/mo
Claude Code Review:  ~$20/review x 200 = $4,000/mo  (varies by PR size)
Codex:               Token-based, estimated $1,000-2,500/mo

Claude Code Review's per-review pricing makes it the most expensive at scale. BugBot is expensive but predictable. Greptile is the most cost-effective for high-volume teams.

3. Lock-in risk is real

BugBot requires Cursor. Claude Code Review requires Claude Teams/Enterprise. Codex requires ChatGPT Pro/Team. Custom rules, AGENTS.md files, and learned patterns do not transfer between tools. Switching costs increase over time as these tools learn your codebase conventions.

4. Architecture review is still weak across the board

Claude Code Review and Greptile are the strongest at architectural feedback, but "strong for AI" is still weak compared to a senior engineer who knows your system. None of these tools reliably catch "this is the wrong abstraction" or "this service should not own this data." Architecture review remains a human job.

How Do You Measure AI Review Bot Impact on Your Team?

Adopting an AI review bot without measurement is guessing. Here is the framework we call the Bot Impact Scorecard, four metrics to track before and after adoption. Python-first teams should pair this with our dedicated AI code review for Python guide - the scorecard is the same, but the language-specific false positives (type-hint drift, dependency version skew) shift the baseline you'll want to set:

CodePulse stores the full body of every PR review via the PRReview model, including reviews left by AI bots. This means you can analyze the quality and substance of bot feedback alongside human reviews, tracking metrics like average comment length, sentiment, and whether bot reviews contain actionable suggestions or just noise.

Which AI Review Bot Should You Choose?

The answer depends on three factors: what your team already uses, what kinds of bugs reach your production, and how much you are willing to spend.

Choose BugBot if:

• Your team already uses Cursor as their primary editor
• Logic bugs and edge cases are your biggest production issue
• You want the tightest "find bug, fix bug" loop with Autofix
• You can absorb $60/user/month (Cursor Pro + BugBot)

Choose OpenAI Codex if:

• Your codebase is primarily Python backend
• You value configurable review rules via AGENTS.md
• Backward compatibility issues are a recurring problem
• Your team already pays for ChatGPT Pro/Team

Choose Claude Code Review if:

• Architectural drift and security vulnerabilities are your top concerns
• You need the deepest multi-agent analysis and can absorb $15-25 per review
• Your team already uses Claude Teams or Enterprise
• You have fewer, larger PRs rather than high-volume small changes

Choose Greptile if:

• You want the highest reported bug catch rate at a predictable price
• Cross-file dependency analysis matters (large monorepos or tightly coupled services)
• Landing one real finding in as many pull requests as possible matters more to you than how much noise comes with it - it leads case recall at 76.9%, and that is a legitimate thing to buy
• $20/user/month fits your budget better than per-review pricing

Choose CodePulse Reviews (ours) if:

• Your team runs on Slack and PR-page review comments get ignored
• Review noise is your actual problem: 0 wrong comments and 8 nitpicks across 39 benchmark pull requests, at 94.0% precision, while finding more than twice the real defects the highest-catch-rate tool did
• You want the review and the metrics proving it worked in one place
• You want to start at $6/dev/month with your own model key
• You can accept a benchmark the vendor ran - if you want that number from someone with no stake in it, nobody has published one, and Greptile’s is the only third-party-cited figure in this guide

"Do not ask 'which AI review bot is best.' Ask 'which bugs are reaching production, and which bot is best at catching those specific bugs.' The answer is different for every team."

Combining bots with human review

You do not have to pick just one bot. Layer AI review as a first pass and save human attention for what AI misses. Here is our recommended approach, detailed in our code reviewer best practices guide:

1. AI bot catches style, common bugs, and security anti-patterns (automated, instant)
2. Human reviewer focuses on architecture, business logic, and design trade-offs
3. Two human reviewers remain the right number for the human pass (see our GitHub review optimization guide)

AI handles what humans are bad at remembering. Humans handle what AI is bad at understanding. Neither replaces the other.

For more on the first generation of tools (Copilot, CodeRabbit, Qodo, Sourcery, and others), see our comprehensive AI code review tools guide.