Electric Twin says its agent-reviewed factory merged 564 PRs in 13 weeks and had 1 pen-test finding against 7 for a human-reviewed product

Smith writes that every code change at Electric Twin goes to an agent-run review panel, which escalates to an engineer when reviewers cannot agree or flag a serious risk. In the 60 days to September 22 the panel cleared 83% of reviews and referred 17%. Auto-merge was switched on September 10; 39% of backend merges have been automatic since, and the post puts the week of October 5 at 50%. The team's stated hypothesis was 80%. With one dedicated engineer, the factory merged 564 PRs in 13 weeks, a median of 27 a week and a peak of 145, excluding Dependabot updates. Areas the team calls "arches" still need human review regardless of the panel's verdict.

On security, the company says it put its two core products through the same independent penetration test. The post reports one vulnerability in the factory-built product and seven in the product built with human review of every change. The post does not name the tester or publish the report.

The most reusable part is a failure the team describes. A scheduled security scan ran green for a week; an engineer grew suspicious, ran a one-off audit, and confirmed real vulnerabilities. The team then required each check to show that it ran to completion, reported its own coverage against the full required scope, and confirmed the work matched the behavior the task required.

Why it matters: A green check that does not report what it covered looks the same as one that covered everything, and the post's own example shows a person catching what the automation missed. Treat the headline numbers as one company's claim: they come from a single pen test across two different products, and the report is not public.