Human reviewers approve AI code more the longer they're exposed to it

Every team's answer to "how do we control agent output quality" is human review. A study submitted September 5 says that gate loosens on its own.

Researchers analyzed 11,429 code reviews and found approval rates for AI-authored changes climb with repeated exposure: 30.5% early, rising to 36.6%. They call it habituation. The detection detail matters as much as the effect: sentence-embedding structure catches the drift, while lexical diversity and Shannon entropy miss it. The surface metrics most teams would reach for don't see it happening. arXiv 2609.06213

Put that next to what Gergely Orosz collected this week. GitHub pull requests are up fivefold over three years, and PRs plus commits nearly doubled since the end of 2025 alone. At Duckbill Group, a five-person startup, weekly merged PRs went from 353 to 684. PRs merged within an hour went from 28% to 45%. Human-reviewed PRs took a median 26 hours; unreviewed ones took 1. The Pragmatic Engineer

So: volume up 5x, review time 26x slower than skipping it, approval rate drifting upward with exposure. Three forces all pushing the same direction, and the direction is "the human looked at it" becoming a formality.

The projects that see this clearly are writing it down. A study of 281 open-source AI contribution policies, a governance artifact that barely existed a year ago, found 83.3% permit or encourage AI in code contributions while 67.3% require a high level of human involvement and 43.4% explicitly assign accountability. Disclosure is required by 48.8%. arXiv 2609.07542 GrapheneOS published its own version September 8: submitting a PR or issue report created by an AI model without fully understanding it is not permitted, contributions largely created that way will typically be rejected, and code must read as regular human-written code regardless of assistance level. They acknowledge frontier models find real vulnerabilities and still require experienced developers to triage the output, citing a high false-positive rate on AI-generated bug reports. GrapheneOS

Concrete thing to do: instrument your approval rate over time, split by whether the change was agent-authored. If you can't tell agent-authored from human-authored in your own PR data, that's the first fix. Then watch the trend line for three months. The study's claim is that the number moves without anyone deciding to move it, and you can only catch that with a time series.

Orosz's second finding is the better structural answer. The teams handling this well stopped reviewing diffs and started triaging risk: auth, public APIs, design systems and database schemas force human review at OpenAI, Anthropic and Duckbill. Everything else gets the fast path. That's a policy you can write down in an afternoon, and it survives habituation because it doesn't depend on a reviewer's attention staying sharp across 684 PRs a week.