Cheap models for code review: the cost gap is real, the precision gap is the tax

The headline number almost sells itself: on the Entelligence benchmark (50 real PRs from Cal.com, Sentry, Discourse, Keycloak and Grafana), a cheap model found 75% as many verified bugs as a frontier model for 3.6% of the money. GPT-5.6 Luna ran the whole set for $0.20. GPT-6 Astra cost $5.66.

Any team running AI review on every pull request sees that number and starts doing the math. But the operative number for a review tool is not cost per verified bug. It is precision.

Luna raised 93 findings, 24 of which failed verification. One in four comments was noise. Astra was wrong 4 times out of 96. That gap is the real tax. Developers already skim AI review comments. When a quarter of them are wrong, they stop trusting the channel, which means the two-thirds of findings that are real also stop landing. The cheap model saves you money and quietly raises the cost of getting a human to act on the output.

Where this bites hardest is exactly the code I would not hand to a cheap model: authentication and permission logic. On the Keycloak PRs, the cheap model found 6 verified bugs to the frontier model's 14, and only half of its findings held up. Across the whole run it caught 9 of 24 security bugs; the frontier model caught 19.

So the practical takeaway is not "buy the cheap model." It is that model choice should not be one setting for the whole repo. Route a cheap tier at routine logic and concurrency defects, where it comes within a couple of verified bugs of the frontier model, and keep a frontline model on directory or path filters that see auth, permissions and authorization changes. For teams self-hosting a reviewer on GitLab or Azure DevOps, that routing decision is usually a per-pipeline or per-policy choice, not a platform one, and it is worth making explicit rather than picking a single model for everything.

The benchmark calls out one caveat worth holding: none of the PRs postdate the models' training cutoff, and the code is public, so recall risk is real and unmeasured. Treat the cost numbers as direction, not a promise.

A good reviewer on a cheap model can still be the right call when volume is the problem. Just route the code you would not want a human to skim past.