Adversarial Code Review

Overview

A multi-agent review pattern where one agent builds (or authors), a second agent critiques the code, and a third agent critiques the review itself. This layered adversarial approach filters out low-value nitpicks and surfaces only high-confidence, high-priority issues that deserve human attention.

Core principle: Fewer, higher-quality review comments build trust. Filter ruthlessly to high confidence + high priority only. Target roughly two comments per PR.

Dependency: Claude Code CLI with --append-system-prompt support. Optionally, a different model for the review pass than the one used for writing.

When to Use

• - Reviewing pull requests before merge, especially when review quality matters more than speed
• As a CI-integrated automated reviewer that developers actually read instead of ignore
• When existing automated reviews produce too much noise and developers have stopped trusting them
• During versioned critique cycles where a plan or design needs iterative refinement

When NOT to Use

• - Trivial PRs (typo fixes, dependency bumps, single-line config changes)
• When you need instant feedback during live pairing sessions (too slow for interactive use)
• As a replacement for human review on security-critical or compliance-gated changes

Common Mistakes

Mistake	Why it's wrong
Surfacing every finding to the developer	Noise kills trust. Developers stop reading reviews that cry wolf. Filter to ~2 high-priority, high-confidence comments per PR.
Using the same model for writing and reviewing

The model is biased toward its own patterns. Use a different model for review than the one that wrote the code — it catches different classes of issues. | | Skipping the meta-reviewer (third agent) | Without a check on the reviewer, you get false positives and nitpicks dressed up as critical findings. The meta-reviewer filters the reviewer's output. | | Running adversarial review without priming the critic | A neutral prompt produces polite, hedging reviews. Tell the reviewer the code likely contains bugs to prime it for genuine criticality. | | Treating all review comments as equal priority | Without confidence and priority scoring, developers cannot triage. Every comment must carry explicit confidence (high/medium/low) and priority (high/medium/low). |

The Three-Agent Adversarial Pattern

CODEBLOCK0

Step 1: Set up the builder context

Agent 1 is the code author (or a proxy that understands the change). It produces:

• - The diff itself
• A summary of intent ("what this PR is trying to do")
• Related context (linked issues, design docs, test plan)

If you are reviewing someone else's PR, have an agent read the PR description, diff, and linked issues to reconstruct this context.

Step 2: Run the adversarial reviewer (Agent 2)

Spawn a sub-agent with a system prompt that primes it for critical review. The key trick: tell the reviewer the code likely contains bugs.

CODEBLOCK1

Model selection: If the code was written by Claude, use a different model for review. Cross-model review catches different failure modes.

Step 3: Run the meta-reviewer (Agent 3)

The meta-reviewer receives Agent 2's comments and filters them. Its job is to reject false positives, remove nitpicks that escaped the confidence filter, and validate that remaining comments are actionable.

CODEBLOCK2

Step 4: Format and deliver the filtered output

The final output should contain only the surviving comments, each with:

• - Location: File and line range
• Issue: One-sentence description
• Why it matters: Impact if not fixed
• Suggested fix: Concrete code change
• Confidence: high
• Priority: high

CI Integration with --append-system-prompt

To run this as an automated CI reviewer, add a workflow step that pipes the diff through the three-agent chain:

CODEBLOCK3

The --append-system-prompt flag is what makes this work in CI: it lets you inject the adversarial priming without modifying the user message, keeping the diff clean as the primary input.

Versioned Critique Cycle (For Plans and Designs)

For longer-form work like architecture plans, use a versioned critique loop:

1. 1. planv1: Initial plan authored by Agent 1
2. critiqueopusv1: Critique from one model (e.g., Claude)
3. critiquegptv1: Critique from a different model (e.g., GPT) for cross-model coverage
4. revise: Author incorporates valid critiques
5. planv2: Revised plan, repeat if needed

This ensures the plan survives scrutiny from multiple perspectives before implementation begins. Each critique version is saved so you can trace which feedback was incorporated and which was rejected (and why).

Quick Reference

Item	Details
Agent 1 (Builder)	Produces diff, intent summary, and context
Agent 2 (Reviewer)

Adversarially primed critic, scores by confidence + priority | | Agent 3 (Meta-Reviewer) | Filters reviewer output, rejects false positives | | Target output | ~2 high-confidence, high-priority comments per PR | | CI flag | --append-system-prompt for injecting adversarial priming | | Model strategy | Use a different model for review than for writing | | Priming trick | "AI agent likely introduced bugs — find them" | | Versioned cycle | planv1 -> critiquev1 -> revise -> plan_v2 |

Key Principles

1. 1. Fewer comments build more trust. A reviewer that posts two real bugs gets read. A reviewer that posts twenty nitpicks gets ignored. Filter to ~2 high-priority, high-confidence findings.
2. Cross-model review catches what self-review misses. A model is biased toward its own idioms. Use a different model for review than the one that wrote the code.
3. Prime the critic for genuine adversarial behavior. Telling the reviewer "an AI agent likely introduced bugs, find them" produces dramatically more critical and useful reviews than a neutral prompt.
4. The meta-reviewer is non-negotiable. Without a third agent checking the reviewer, false positives leak through and erode developer trust in the entire system.
5. Every comment must be actionable. If the developer cannot immediately understand what to fix and why, the comment has failed. Include file, line, impact, and concrete fix.

Attribution

Based on techniques from the Coding Agents: AI Driven Dev Conference. Sid (Anthropic) demonstrated the three-agent adversarial pattern and CI integration with --append-system-prompt. Ankit (Databricks) contributed the cross-model review strategy. Demetrios introduced the priming trick of telling the reviewer that bugs were likely introduced. Chad described the versioned critique cycle for iterative plan refinement.