A Private LLM Is a Claim Until You Audit It, and So Is Your AI Code Review
Three posts this week, all from the same move: we measured our own system instead of trusting the label on it. Here is what the checks found.
The week in one glance
- We ran an egress audit on our own local-first setup and found six kinds of outbound connection, none of them carrying prompts, two of them a surprise.
- A default agent in our system sends 17,296 characters of tool descriptions to the model before the task starts, and no benchmark reports whether a compressed model can still answer that correctly.
- Research on 11,429 reviews found the same people approving more agent-written pull requests over time while leaving 22% fewer comments.
By the Cerevisor team
Why a private LLM is an audit result, not a property you buy
Three posts went out this week, and only in hindsight did we notice they came from the same move. In each one, someone stopped reading a spec sheet and went to measure the actual system. The result was the same shape every time: the property everyone assumes comes with the purchase turned out to be a behaviour you have to go and check.
A private LLM is the clearest case. The weights sit on hardware you own, so the work is confidential, so compliance is handled. That chain of therefores skips the app around the model, the port it listens on, and the tools wired to it. None of those are the model, and all of them have their own ways of sending data out. The honest claim is never that nothing leaves the machine. It is a list of what leaves and who can switch each item off.
What we published
AI coding agents this week
A study of 400 repeat reviewers across 11,429 reviews found approval rates for agent-written pull requests rising from 30.1% to 36.8% while inline comments fell 22%, which the authors read as habituation rather than reviewers learning where the agent can be trusted.
Running models locally this week
Model cards report reasoning and coding scores, never whether a compressed build still emits a parseable tool request under a 17KB block of tool descriptions, and thirteen tool-calling issues opened across four serving engines in four days show how often that fails in practice.
We read our own harness network behaviour line by line and wrote down every outbound connection, which is a different exercise from installing an open-weight model and calling the workflow private.
Signals to implications for self-hosted LLM and AI code review decisions
Signal. The same reviewers approved more agent-written pull requests the longer they reviewed them, with review latency up three and a half times and inline comments down 22%, on flat median pull request size.
Implication. Stop treating your merge rate as a quality signal and start tracking comments per review over time for the same person, because that is the number that moves first. [Eng Leader]
Source: AI code review does not get cheaper as the agent gets better
Signal. A default agent in our system receives 17,296 characters of tool descriptions before it reads a word of the actual job, and the full set of 30 tools comes to 25,501.
Implication. Before you commit to a quantized model for agent work, run one afternoon test on your own tool definitions at turn nine, not on the vendor's benchmark. [Eng Leader]
Source: Ollama tool calling is the local-model risk no benchmark measures
Signal. Roughly 300,000 internet-reachable inference servers were cited in May coverage of a memory-leak vulnerability, on software many operators installed specifically to keep data private.
Implication. Ask whoever owns your self-hosted LLM which port it listens on and what sits in front of that port, because sharing a GPU across the office is the setting that opens it. [Founder]
Signal. Four coding-agent vendors shipped changes in six days that each reduce how often a person is asked to decide, from assisted tool approvals to agent runs starting from a single pull request comment.
Implication. Each of those is a sensible change on its own, so review them as a set at your next tooling check rather than one release note at a time. [Exec + Eng]
Source: AI code review does not get cheaper as the agent gets better
The contrarian take: the afternoon check beats the better vendor
The thing worth noticing this week is that none of these findings required a better vendor. They required a few hours. Reading our own network behaviour line by line for the egress audit took an afternoon. Counting the characters in our own tool descriptions for the tool-calling piece took less. The review research is the same idea run over seven months on other people’s data. Every one of those checks was cheap, and none of them appear on any roadmap, because a check that returns a clean result feels like it was not worth doing. That is exactly why the results drift. Pick one claim you make about your own AI setup this month, and go measure it.
Next week
If this recap was useful, the newsletter delivers it straight to your inbox every Monday. Subscribe here.