The 4.6x Wait: What 8.1 Million Pull Requests Reveal About Your AI Coding Agent Rollout

Every engineering leader who rolled out an AI coding agent this year has heard some version of the same pitch: agents write pull requests faster, so your team ships faster. The first half of that sentence is true. The second half, according to the largest dataset ever assembled on the subject, is not — and the gap between the two is becoming one of the most expensive blind spots in enterprise software delivery.

Two independent 2026 datasets converge on the same number. Opsera’s AI Coding Impact Benchmark Report, covering more than 250,000 developers across 60-plus enterprises, found AI-generated pull requests “wait 4.6x longer in review.” LinearB’s 2026 Software Engineering Benchmarks, a separate analysis of 8.1 million pull requests from more than 4,800 engineering teams and over 163,000 contributors across 42 countries, put a finer point on it: at the 75th percentile, fully autonomous agentic PRs sit untouched for 17.6 hours before a human even opens them, versus 3.4 hours for pull requests written without AI assistance — a 5.25x gap. Code generation got faster. Code review did not. This post walks through what the data actually shows, why the bottleneck is happening, what it’s costing enterprises in security debt, and what engineering leaders should change before the next budget cycle locks in more agent licenses than review capacity can absorb.

The Numbers Behind the Bottleneck

Pickup Time vs. Review Time

The LinearB dataset separates two very different clocks: how long a pull request waits for a reviewer to start looking at it, and how long the review itself takes once someone does. It also splits “AI” into two distinct categories that behave differently: PRs where a human used an AI copilot (“AI-assisted”), and PRs opened autonomously by an agent (“agentic”). At the 75th percentile, AI-assisted reviews finish in about 3.2 hours — faster than the 4.2-hour baseline for unassisted work. Fully autonomous agentic PRs go the other direction, taking about 6.4 hours to review once a human opens them, largely because they run bigger: agentic PRs measure 293 lines at the 75th percentile against 157 lines for unassisted work, according to the same report — nearly double the surface area a reviewer has to reason about in one sitting.

The Acceptance Rate Gap

The starkest number in the report is the 30-day merge rate: only 32.7% of AI-generated pull requests get merged within a month, compared with 84.4% for manually written ones. LinearB’s own framing is blunt about what this means operationally — “adoption alone will show a rising line while delivery stays flat,” meaning the volume of code being generated is climbing without a proportional rise in code that actually ships. Teams that measure success by lines of code produced or PRs opened are tracking the wrong number entirely.

Why Reviewers Are Hesitating

This isn’t reviewer laziness — it’s a real trust and context problem. When a human engineer opens a PR, the reviewer usually has some sense of the decision trail: a Slack thread, a design doc, a hallway conversation about tradeoffs. When an agent opens one, the reviewer often gets a completed diff with none of that context, and has to reconstruct intent from the ticket, the PR description, and the code alone. A Gatepoint Research survey of 100 engineering directors and VPs, fielded across financial services, healthcare, technology, and telecom in early 2026, found only 12% are “very confident” in AI-generated code quality before it reaches production, and 30% describe themselves as not very confident or not confident at all — a workforce that hasn’t decided how much to trust the tool it’s being asked to review for. Confidence gets worse, not better, as adoption deepens: among teams where AI writes 51-75% of new code, the share of leaders lacking confidence rises to 38%. That hesitation is rational, not a training problem to be waved away with a Slack announcement, and it’s compounded by unclear ownership: a PR an agent opened on behalf of a human doesn’t always have an obvious accountable owner the way a self-authored PR does.

The consequence shows up directly in the reliability numbers our earlier coverage of Real-SWE’s private-codebase benchmark already flagged: agents that look strong on public benchmarks regress hard on unfamiliar, private codebases, which is exactly the environment where a reviewer’s caution is most justified.

The Security Trade-off Nobody Priced In

The bottleneck would be tolerable if it were purely a speed problem. It isn’t. Opsera’s AI Coding Impact 2026 Benchmark Report, which tracked more than 250,000 developers across 60-plus enterprises using tools including GitHub Copilot, Cursor, and Claude Code, found that AI cuts time-to-PR by up to 58% while the resulting code introduces 15-18% more security vulnerabilities than human-written equivalents. Academic research backs this up with more granular detail: a peer-reviewed study of agentic pull requests on GitHub, submitted to Information and Software Technology and revised in September 2026, examined over 33,000 curated agent-authored PRs and found agents select known-vulnerable dependency versions more often than humans do (2.46% of the time versus 1.64%), and that when agents do introduce a vulnerable dependency, fixing it is more disruptive — 36.8% of those cases require a major-version upgrade, versus 12.9% for human-introduced ones.

The same research found something counterintuitive: agents rarely fix critical vulnerabilities on their own initiative. Security-related activity made up only about 4% of agentic PR volume, and most of that was “supportive hardening” — better error handling, test coverage, configuration — rather than patching serious flaws. That mirrors the pattern this publication documented in GhostApproval, the AI coding assistant symlink flaw: the tooling introduces new categories of risk faster than it resolves existing ones, and reviewers are the last line of defense standing between that risk and production.

Enterprises Are Investing Anyway

None of this has slowed enterprise spending down. A McKinsey analysis reported by CIO Dive on September 22, 2026 found investment in agentic software development is on pace to grow more than 12-fold from 2025 to 2026, even though only 25% of companies report meaningful acceleration in their product development lifecycle from these tools, and 30% say productivity actually declined after rollout. McKinsey partner Oana Cheta summed up the mismatch: “The defining question of the agentic era is not how autonomous agents can become but how much autonomy the enterprise can safely absorb.” Nearly half of developers surveyed still actively distrust the accuracy of AI-generated code — which tracks precisely with the review hesitation showing up in the LinearB pickup-time data.

This is the same pattern this publication flagged when covering the AI coding agent price war: vendors are competing to make generation cheaper and faster, but cost-per-task metrics say nothing about cost-per-merged-and-secure-task, which is the number that actually determines ROI.

What Engineering Leaders Should Do Now

Measure delivery, not generation. Track PRs merged and deployed, not PRs opened or lines generated. If your dashboard rewards agent throughput without netting out the 30-day acceptance rate, you’re measuring exactly the vanity metric LinearB’s report warns against.

Right-size AI-generated PRs before they hit a human reviewer. Since agentic PRs run nearly double the size of unassisted ones at the 75th percentile, enforce the same PR-splitting discipline on agents that good engineering teams already enforce on people — smaller, single-purpose diffs review faster and get rejected less.

Assign explicit ownership to every agent-authored PR. Unclear accountability is a named driver of the pickup-time gap. A human sponsor, not just a bot account, should be listed as the owner responsible for context, follow-up questions, and the fix if something breaks.

Treat AI-generated dependency and security changes as higher-risk, not lower-risk. The data says the opposite of the common assumption: agent-introduced vulnerabilities are both more frequent and more expensive to remediate. Route these changes through the same or stricter security review as human-authored infrastructure changes, not a lighter one.

Budget for review capacity, not just agent licenses. The 12-fold spending growth McKinsey documented is going almost entirely into generation. Unless a comparable share goes into review tooling, senior reviewer time, or AI-assisted review systems, the bottleneck documented here will only get worse as agent adoption climbs.

The lesson from 8.1 million pull requests isn’t that AI coding agents don’t work. It’s that “faster to write” and “faster to ship safely” are two different metrics, and right now enterprises are optimizing hard for the first one while the second one quietly stalls.

Frequently Asked Questions

Why do AI-generated pull requests wait longer for review than human-written ones?

Reviewers cite low confidence in AI code quality, missing context about why a change was made, and unclear ownership of agent-authored work. LinearB’s benchmarks found that, at the 75th percentile, these PRs wait 17.6 hours before a reviewer opens them, compared to 3.4 hours for unassisted work.

Does AI-generated code actually contain more security vulnerabilities?

Yes, according to multiple independent studies. Opsera’s analysis of 250,000+ developers found 15-18% more vulnerabilities in AI-generated code, and academic research on GitHub PRs found agents choose known-vulnerable dependency versions roughly 50% more often than human developers do.

If AI-generated PRs cause more review delay, why are enterprises still increasing investment?

McKinsey’s research shows agentic software development investment is set to grow more than 12-fold from 2025 to 2026 despite only 25% of companies reporting meaningful lifecycle acceleration. The investment is largely driven by competitive pressure and vendor momentum rather than proven ROI at the review-and-deployment stage.

Once a human starts reviewing an AI-generated PR, does it go faster than reviewing human code?

It depends on which kind of “AI-generated” you mean. LinearB’s benchmarks show PRs where a human used an AI copilot review faster than average (3.2 hours vs. a 4.2-hour baseline at the 75th percentile), while PRs opened autonomously by an agent review slower (6.4 hours), largely because agentic PRs tend to be substantially larger in scope.

What’s the single most useful metric for judging whether an AI coding agent rollout is working?

The 30-day merge/acceptance rate, not the number of PRs generated or the time-to-first-draft. LinearB found only 32.7% of AI-generated PRs merge within 30 days versus 84.4% for manual PRs — a rising generation volume with a flat delivery rate is a sign the rollout isn’t paying off yet.

Should enterprises pause AI coding agent adoption until review tooling catches up?

The data doesn’t support a pause so much as a rebalancing: pair every increase in agent licenses with a matching investment in review capacity — whether that’s dedicated reviewer time, PR-size limits, or AI-assisted review tooling — so generation speed doesn’t keep outrunning the team’s ability to safely ship what gets generated.

Sources

• LinearB, 2026 Software Engineering Benchmarks - primary dataset of 8.1M pull requests showing AI PR pickup time, review duration, size, and merge rate
• Opsera, AI Coding Impact 2026 Benchmark Report - analysis of 250,000+ developers across 60+ enterprises on time-to-PR and security vulnerability rates
• Security in the Age of AI Teammates: An Empirical Study of Agentic Pull Requests on GitHub, arXiv:2601.00477 - peer-reviewed study of 33,000+ agentic PRs and their security characteristics
• CIO Dive, “Enterprises keep betting on coding agents despite lackluster results,” September 22, 2026 - McKinsey-sourced reporting on agentic software development investment and ROI
• Qodo, “The AI Code Quality Gap: What 100 Engineering Leaders Told Us” - Gatepoint Research survey on engineering leader confidence in AI-generated code