Batching PR reviews drops attack detection from 60% to 16%

AI auditors that catch 50-60% of malicious PRs reviewed one at a time catch just 16-22% of the same attacks bundled into a 24-PR window, per PRWeaver. The benchmark tested 208 execution-validated attacks pulled from ten real repositories, run through three PR-auditing agents across six auditor-model systems in 832 matched renderings.

That gap is the difference between a review process that catches a malicious PR before it merges and one that just produces a false sense of coverage.

Splitting a malicious change across multiple commits barely helps the attacker, dropping detection by five points at most. Interleaving it among concurrent, unrelated PRs costs the auditor 5 to 13 points. Fusing the malicious diff into a change whose stated purpose plausibly explains it works better than either, costing the auditor 10 to 18 points.

None of those attacker tricks comes close to matching the effect of batch size on its own. Widening the review window from one PR to 24 does more damage than any disguise tactic, and that doesn't depend on which auditor model runs the review.

The fix here is queue size, not model choice. Per-PR review catches more than double what whole-window review catches, across every system PRWeaver tested. Teams running AI PR review at batch scale to save reviewer time are trading detection rate for throughput, whether they've noticed it or not.

PRWeaver posted to arXiv in August 2026, testing the same per-PR and batch-review setups teams choose between when they deploy these auditors.