Cloudflare cut AI code review costs 68%: the tokenomics breakdown

Cloudflare engineer Ryan Skidmore published a detailed breakdown on October 19, 2026, showing how the company cut its internal AI code reviewer from $2.43 to $0.77 per review, a 68% reduction, while also cutting median review time from 4m 09s to 1m 32s. The surprise is in the attribution: only 40% of savings came from code changes. The other 60% came from switching models, adjusting reasoning effort, and fixing a broken prompt-cache configuration that had been silently costing money on every session since August.

How the cost doubled without anyone changing anything#

In April 2026, an average review cost $1.19. By the end of August it had reached $2.46. The architecture had not changed. The coordinator still handed work to the same specialist reviewers, using the same logic to decide how intensive each review should be.

Two things drove the increase. First, Cloudflare moved every reviewer to Anthropic models in early August, which pushed the average cost per job from $1.38 to $2.03. Second, engineers were shipping larger, more complex diffs, meaning more reviews fell into the most expensive review category, rising from 59% of reviews in March to 65% in August. Token consumption per review more than tripled from 0.91 million to 2.99 million tokens over the same period. A high cache hit rate on three times as many tokens still costs substantially more.

The prefix problem#

When Cloudflare instrumented each reviewer's first request on September 14, the data was stark: cache hits on first requests ranged from only 14% to 26%. Every session starts with identical tool definitions and agent prompts, between 11,000 and 21,000 tokens that are the same across every repository. Almost all of them should have been cache hits.

The problem was structural. OpenCode v1 built a single system-prompt block combining the static agent prompt with dynamic, repository-specific data, then placed its only cache breakpoint at the end of that block. Because the shared prefix was never stored separately, a review in one repository could never reuse what a reviewer in another repository had already computed. On September 16, Cloudflare split the block at a marker, gave the static first half its own breakpoint, and removed any repository-specific content from in front of it. First-request cache hits jumped to 91–99.5%.

That single change, plus moving the internal standards reviewer's reference index directly into the prompt rather than reading it via tool calls at session start, dropped per-review cost from $2.47 to $2.02 in the same week.

What code changes contributed#

The engineering fixes after September 14 were incremental but concrete. Sub-reviewers had access to a tool for posting the final review comment that they were not permitted to call; in 57% to 76% of sessions they tried anyway, got rejected, and spent an additional recovery call. Removing that tool saved one call per session and eliminated 2,900 tokens of tool definitions from every sub-reviewer request.

In 64% of the code quality reviewer's turns, the model made exactly one tool call, usually to read a single file. Parallelizing file reads in the first response, up to 150 KB, eliminated those sequential round trips. Skipping redundant sub-reviewers on re-reviews added further savings: two-thirds of jobs are a second or later review of the same merge request, and often most reviewers have nothing new to examine. Together the code changes accounted for $0.65 of the total $1.67 reduction.

Model selection and effort tuning accounted for more#

The remaining $1.06 came from experimenting with models and effort settings, as Skidmore described in the full post.

Switching the coordinator from Opus 5 to Opus 5.5 at medium effort showed no measurable change in review outcomes or critical findings in a randomized split. Opus 5.5 is cheaper per token, but per-token price only explains about $0.20 of the drop; the rest comes from the newer model generating fewer tokens to complete the same task. Cache reads per review fell 82% since September, cache writes fell 54%, and output tokens fell 67%.

On October 3, Cloudflare ran a 50/50 split between Sonnet 5 and Sonnet 5.5 across the Sonnet reviewers. After two and a half days, Sonnet 5.5 was 62% cheaper per run for code quality, 58% for performance, and 47% for security. The two models cost the same per token, so the savings come entirely from token efficiency. All Sonnet reviewers moved to 5.5 on October 5.

Quality is not a free variable#

A cheaper review that misses real problems is not a saving. Cloudflare measured quality two ways: tracking whether authors changed the flagged lines in their next push, and running a blinded review of 657 findings judged by two models from different providers.

For code quality at high effort, the results held. Authors acted on 59% of serious findings, up from 34% before optimization. Important findings per review went from 0.28 to 0.30, within the margin of error. The bigger improvement was in severity calibration: before optimization, 0.46 findings per review were rated more severe than they deserved. After, that figure dropped to 0.14, a 70% reduction in severity inflation. Less noise, similar signal.

Medium effort was a different story. Code quality at medium effort produced roughly a quarter as many acted-on findings as at high. Performance lost about 64% of important findings per review. Those two results are why Cloudflare moved code quality to high effort and left performance and security testing at high effort as the next experiment.

Ryan Skidmore's conclusion is direct: "Lower cost reviews didn't automatically mean worse quality, but it didn't automatically mean fine either."

Why this matters for any team running review agents#

The Cloudflare numbers are the first concrete, production-level tokenomics case study for agentic code review at scale. The implications extend beyond their specific configuration.

Inference cost for review agents is not a fixed function of model pricing. It is determined by cache prefix ordering, the number of calls per session, which models handle which tasks, and what effort level each task requires. All of those are engineering decisions, not line items to accept. A misconfigured cache breakpoint that sits between static and dynamic content silently converts cheap reads into expensive writes on every session, and it looks like nothing from the outside until someone instruments the first request.

Hyrax makes the same tradeoffs on every scan, calibrating model selection, reasoning effort, and context structure across six agent domains. The Cloudflare data provides a public baseline: teams with agentic review pipelines should check first-request cache hit rates, and treat effort level as a quality variable, not just a cost one.

Hyrax is live at hyrax.dev.