Anthropic's 12x Surge in Merges Shows Why Review Is the New Bottleneck

What Anthropic reported

In an engineering post covered by Simon Willison, Anthropic describes why it built its own alternative to Git. The headline figure: "In May 2026, Anthropic averaged around 2,500 code changes merged per day; as of September, we merged over 30,000 per day." Willison's annotated chart puts the single-day peak at 30,401 on 9 September.

The post gives scale figures for the monorepo. The history of the main branch is almost 100 GB, and a compressed working copy is over 25 GB. CI alone performs about 25 million code checkouts a day, before counting developer environments, agent sandboxes and research jobs. Anthropic says naive Git fetching at that rate would mean over 600 PB of traffic a day. It reports completing the migration off Git in five months with a team of seven.

The new source control system is called Scion, and the new code review system is called Antique. Per Willison's chart, Antique appeared in late May, overtook pull requests in mid-June and nearly replaced them by mid-July.

Why this matters for security teams

This is a source control story, but the security consequences sit in the review and release path. Our reading, not a claim from the sources: most application security programmes assume that a human reviews a meaningful share of changes before they ship. At tens of thousands of merges a day, that assumption cannot hold, and the controls have to be built differently.

• Review becomes a system, not a step. Anthropic replaced pull requests with a purpose-built review tool. It also notes that adversarial review is "incredibly effective in many ways," but "it can also be myopic." A reviewer, human or model, can miss things outside its frame.
• Provenance matters more. When most changes are machine-authored, knowing which agent, prompt and context produced a change becomes part of the audit trail. That is the same class of problem as build-pipeline integrity in software supply-chain security.
• Agent sandboxes are part of the attack surface. Anthropic lists agent sandboxes among the consumers of code checkouts. Any environment that checks out code and runs agent-driven tooling needs its credentials and network reach scoped tightly.
• Design trade-offs are visible. One Scion engineer said, on Hacker News, that offline support was not important because Claude, the heaviest user, is necessarily online. Systems tuned for agent workflows will make different assumptions from human-first tools, and those assumptions should be threat-modelled.

What to do before your own change rate climbs

1. 1Measure how many changes currently ship with no human reading the diff, and set an explicit policy for them.
2. 2Move security checks that matter (secrets scanning, dependency policy, SAST, infrastructure-as-code policy) into mandatory automated gates that cannot be skipped by the author, human or agent.
3. 3Record the origin of each change, including whether an agent produced it, and keep that record tamper-resistant.
4. 4Isolate agent execution environments and give them short-lived, least-privilege credentials.
5. 5Test your review pipeline adversarially. Plant known-bad changes and see whether the pipeline catches them.

Caveats

These figures are Anthropic's own and describe one very large monorepo. Willison's chart marks public model release dates, not internal availability, so it cannot show which models drove the increase. Willison guesses that the Fable and Mythos class models are a significant factor, but that is his speculation. Treat the numbers as a signal about direction, not as a benchmark for your own organisation.