{
  "video": {
    "id": "-X3yXTwGs9A",
    "title": "AI Writes Code Faster Than Your Team Can Review It - Andrew Norrish, Sourcegraph",
    "duration": 1137,
    "upload_date": null,
    "channel": "AI Engineer",
    "source": "AI Engineer",
    "event_format": ""
  },
  "analysis": {
    "video_id": "-X3yXTwGs9A",
    "title": "AI Writes Code Faster Than Your Team Can Review It - Andrew Norrish, Sourcegraph",
    "one_liner": "Agentic coding has moved the software bottleneck from writing code to reviewing it, and the unreviewed AI code that slips through is landing on SREs as more frequent, costlier incidents. Sourcegraph argues that SRE and platform teams are best placed to fight back, by pointing AI at well-bounded domains like incident root-cause analysis, compliance monitoring and bulk remediation, backed by full-codebase context.",
    "summary": "Andrew Norrish, director of field engineering at Sourcegraph, retells a story he says customers report again and again. Teams adopt AI coding tools, PR counts and sizes balloon, and review becomes the bottleneck. AI-written code that lacks organizational and codebase context gets merged unreviewed, and the resulting incidents fall on stretched SREs, who are being asked to fix code no human has looked at. He argues AI wins in well-bounded domains, which SRE and platform teams already work in. He maps Sourcegraph's code graph, search, Deep Search, monitors and bulk changes onto investigation, prevention and remediation, then gives three examples: Sourcegraph's own HackerOne triage, a customer's automated root-cause-analysis agent, and a customer's internal code review agent.",
    "key_points": [
      "The bottleneck has moved from how fast a human can type code to how fast humans can review the code AI writes. At Sourcegraph's most recent customer advisory board, the question 'how many heads can this save us' did not come up, perhaps for the first time ever.",
      "Industry figures cited: about 2/3 of new code is expected to be written by AI by 2027. Some organizations estimate almost twice as many PRs are being merged with agentic coding, AI PRs are more than double the size of human-written ones, and developers spend almost twice as much time on code review.",
      "Almost every developer says they don't trust everything AI writes, yet almost half say they don't always verify it. Developers also find AI code harder to review because it 'wasn't written by or necessarily always for a human'. Anthropic has reported that developers' comprehension of their code is declining as they rely more on AI.",
      "More incidents per PR, rollbacks, hot fixes and customer-impacting incidents are being traced back to AI-generated code. A large cause is missing context: if the AI can't clone the entire codebase locally, it has to guess. Cross-service problems push teams back to slow, error-prone manual work like commit scanning, and a fix found in one repo may need to go to hundreds or thousands of others.",
      "Hiring more SREs is a band-aid. The role is in high demand and getting more expensive, and incidents are rising faster than companies can hire.",
      "AI wins in well-bounded domains with full context: vulnerability remediation, security scanning, large-scale migrations, and non-developers prototyping their own tools. SRE and platform teams already work this way, so they are both the barometer of how trustworthy AI code is and the teams that can gain the most from it.",
      "Sourcegraph frames SRE work as investigation, prevention and remediation. Investigation uses deterministic search across every repo, branch and commit with a single query, plus Deep Search, an agentic search that gives cited answers. Prevention uses monitors that alert on risky or non-compliant committed code. Remediation uses bulk changes across all repos in the organization.",
      "Three examples. First, Sourcegraph's security team wired HackerOne webhooks to agentic search, which decides whether a report needs a proposed fix, deeper review or can be ignored. Second, a customer with 5,000+ developers built a root-cause-analysis agent: it triggers on downtime or error-rate spikes, finds the deployed branch or tag (rarely main), searches Git history for the commit and author, then reverts and redeploys or hands the triage to the SREs. Third, a customer's internal code review agent runs evals across hundreds of historical branches of a massive monorepo using Sourcegraph's read-only code finder agent, instead of grep."
    ],
    "takeaways": [
      "Treat code review capacity, not code generation, as the constraint. Plan for more and bigger PRs, and for reviewers who are pressured to approve code they don't trust.",
      "Give agents full-codebase context rather than a partial local clone, so they stop guessing about organizational conventions and cross-service dependencies.",
      "Point AI at bounded, semi-autonomous SRE workflows such as incident root-cause analysis tied to logs, traces and Git history, CVE monitoring and remediation, and security-report triage, rather than broad end-to-end automation.",
      "Add prevention controls that flag risky or non-compliant patterns in committed AI code, and make sure a fix found in one repo can be applied in bulk to every affected repo instead of relying on separate teams.",
      "In RCA automation, first identify the branch or tag actually deployed in production, since it is rarely main, before searching history for the offending commit."
    ],
    "topics": [
      "code review",
      "sre",
      "incident response",
      "ai-generated code",
      "platform engineering",
      "code search",
      "agents",
      "remediation"
    ],
    "tools": [
      "Sourcegraph",
      "Sourcegraph Deep Search",
      "Sourcegraph code finder agent",
      "HackerOne",
      "ChatGPT",
      "Anthropic",
      "Git",
      "grep"
    ],
    "quotes": [
      {
        "text": "that bottleneck is now very clearly with how quickly humans can review the code that the AI is now writing.",
        "at": "03:01",
        "url": "https://www.youtube.com/watch?v=-X3yXTwGs9A&t=181s"
      },
      {
        "text": "If you can't clone the entire codebase locally, the AI just needs to make judgment calls and make guesses.",
        "at": "05:47",
        "url": "https://www.youtube.com/watch?v=-X3yXTwGs9A&t=347s"
      },
      {
        "text": "almost half of developers will say they don't always verify the code that AI is writing for them. Kind of scary for an enterprise, right?",
        "at": "08:33",
        "url": "https://www.youtube.com/watch?v=-X3yXTwGs9A&t=513s"
      },
      {
        "text": "First, you have to identify what branch or tag was deployed in production because it's rarely main, of course.",
        "at": "16:42",
        "url": "https://www.youtube.com/watch?v=-X3yXTwGs9A&t=1002s"
      }
    ],
    "words": 3698
  },
  "summary_url": "/#-X3yXTwGs9A",
  "transcript": {
    "html": "/transcripts/-X3yXTwGs9A.html",
    "txt": "/transcripts/-X3yXTwGs9A.txt",
    "vtt": "/transcripts/-X3yXTwGs9A.vtt"
  }
}