Anthropic says Claude writes 90% of Claude Code, kept stable by a seven-layer review system

Anthropic has disclosed that roughly 90% of the code in Claude Code, its command-line coding agent, is written by Claude itself. The figure arrived alongside an account of how the team reviews machine-generated changes: between June and September, merged pull requests more than doubled while reverts fell by more than 40%. The write-up reached the top of Hacker News, and a summary published on dev.to, covering both the engineering details and the community reaction, is the clearest publicly available view of it.

Review as a layered system

According to the dev.to breakdown, the team's core reframe is to stop asking whether a human read a diff and start asking which check would catch a given failure. Review runs continuously rather than acting as a single gate, and humans are repositioned to the decisions where they add most.

The process has seven layers. Before a pull request is opened, the agent runs tests, build and linters, and a second agent re-reviews the diff independently. Every PR then gets an AI review in which several agents hunt for bugs in parallel and a voting mechanism confirms findings before anything is posted; style nits are filtered and findings are sorted as Important, Nit or Pre-existing. A separate security review blocks merges while findings stay open, unless they are fixed or dismissed with a written reason. Automated checks cover linting, types, cross-platform tests and build, with a PR template that demands testing notes and a rollback plan. Human approval is scaled by risk. A merge queue re-runs the full suite against main with the change applied, new behaviour ships behind flags to employees first, and the stable channel trails the latest one. Finally, flags can flip without a deploy for fast rollback, a weekly on-call rotation watches production, and every incident review asks which layer should have caught the problem.

Approval scales with risk, set by a classifier

Changes are tiered: low-risk work such as documentation, copy, internal features and additive flagged changes needs no human approval when checks are green; medium-risk work, including sensitive areas like caching, the auto-updater and prompts, needs one approval; designated sensitive paths need two. The guardrails matter as much as the tiers. A classifier assigns the risk level because authors understate their own risk, lighter paths are reserved for trusted authors, agent approvals never satisfy a human approval requirement, the person directing an agent counts as a required reviewer, and an approval covers one commit and expires on the next push.

Looping agents and how the team stopped them

When the author and the reviewer are both agents, they can argue indefinitely. One CLI pull request reportedly cycled through more than 50 rounds overnight, and the team found that 59% of repeated findings came from the reviewer re-raising the original pass rather than surfacing new bugs. The remedies: after three rounds the reviewer must ask the author to reconsider the approach, later passes review only the new diff, bug classes are flagged so every instance gets fixed, and no finding may be posted twice. Per the figures the team reported, PRs passing after a single review-and-fix cycle rose from 65% to 78%, those needing five or more rounds fell from 8.9% to 1.5%, and the mean reviews to pass dropped from 2.08 to 1.32.

The reviewer is evaluated like a model

The team also built an evaluation set from past incidents and reverts, with engineers confirming each real bug and its location, and every change to the reviewer — prompt, tools or model — is scored against that set daily. Comment outcomes are tracked as fixed, dismissed as wrong, marked intentional or ignored, and the reviewer is run against known-clean PRs to measure false positives. In effect, the AI reviewer is managed like a classifier with a test set, not a bolt-on bot.

Where the criticism lands

The Hacker News thread, as relayed in the dev.to post, was largely skeptical. A security finding can be dismissed with a short written reason, and one commenter argued that closing a critical finding should not bypass application-security review; the open-source claude-code-security-review action also states in its README that it is not hardened against prompt injection, which makes it a control an attacker might talk out of firing. Others questioned the metrics, noting that fewer reverts does not equal higher quality and pointing at constantly shifting UI and long-lived bugs as counter-evidence. The ownership model also depends on small, flagged, reversible changes with fast telemetry — a property of Claude Code's setup that teams on slower release trains cannot copy as is. And several readers maintained that line-by-line human review still catches duplicated code and architectural bloat that revert rates never reveal.

Why it matters

The headline number is a milestone for AI-assisted development: a widely used coding tool is now largely written by the model it ships. But the transferable part is the surrounding system. Anthropic's process treats review as layered infrastructure — automated checks, parallel AI review, risk-tiered human approval, flagged rollouts and an evaluated reviewer — rather than one human reading a diff, and most of its pieces are cheap to adopt individually. The criticism travels just as well: dismissal paths around security gates, prompt-injection exposure and metrics blind to slow architectural decay are the failure modes any team copying this stack should plan for.