Autonomous Agents Shift Bottlenecks Downstream
Factory
The real prize is no longer generating code, it is controlling the queue of work that appears after code lands. Once agents can open many more pull requests, the scarce resource becomes the systems that decide which diffs are safe, which bugs are real, which tests to run, and whether a change can ship without waking up senior engineers or security teams. Factory is expanding into that control layer with PR review, STRIDE based security review, secret detection, and browser and terminal QA workflows.
-
CodeRabbit and Greptile are narrow examples of the downstream bottleneck. Both focus on pull request review rather than code generation, and CodeRabbit has scaled quickly to an estimated $50M revenue by July 2026, showing that review can become a large standalone budget once AI tools increase PR volume.
-
Security vendors are moving the same way. Snyk now sells detection and fix workflows across code, containers, and cloud, with estimated revenue of $326M by February 2026. Semgrep and Sonar both added AI remediation, which turns a scanner from a tool that files tickets into a tool that proposes code changes developers can merge.
-
Factory is trying to bundle these steps into one agent loop. Its Droid system can inspect a PR, identify the main claim to test, run the app through a browser or terminal, capture evidence, and report results. That matters because handoffs between separate review, security, and QA tools are where agent driven throughput usually stalls.
This market is heading toward verification stacks, not just coding copilots. The winners will be the products that can generate a change, test it in context, prove it is secure, and hand over a mergeable diff with evidence attached. That favors platforms like Factory, but only if their accuracy stays close to the best specialist tools in each step.