More than four in ten code proposals on GitHub now start as an AI draft

Seventeen percent in March. More than forty in September. On October 28, GitHub, Microsoft's code platform, published its annual Octoverse report. The most striking figure concerns pull requests, the change proposals a developer submits before their code is merged into a project. In September, according to GitHub, more than 40% of them had the work of an AI coding agent as their first draft.

In volume, GitHub counted 110 million of them in that single month, six times more than in March. The report covers the period from October 1, 2025 to September 30, 2026, across public and private repositories.

What GitHub means by an agent

The definition matters. GitHub does not measure code written entirely by an AI, but proposals whose first draft came from an agent it can detect. A human may then have largely rewritten them. Conversely, the company acknowledges that its signal is a floor, because not every use of agents can be detected.

The rest of the report describes an explosion in activity. Developers logged 34.3 billion changes (commits) in twelve months, up from 12.9 billion a year earlier. Proposals merged into projects reach 1.3 billion, compared with 538 million. These agent-originated proposals also more often touch several files at once: 87% versus 79% for the others.

Accepted does not mean well written

GitHub highlights a flattering acceptance rate. In September, 90% of proposals involving an agent were merged in under two weeks, compared with about 86% for the others. In February, the trend was reversed: only 83% for agents.

But this figure measures the decision to accept, not the quality of the accepted code. The report gives neither the number of vulnerabilities introduced nor the time spent reviewing these changes. It is also worth remembering who is speaking: GitHub belongs to Microsoft, which sells the Copilot assistant. The report says 55% of monthly Copilot users use its agent features, up from 35% a year earlier. The report mentions no independent audit of these figures.

The report offers another, more discreet clue to the risks involved. GitHub's protection that blocks the pushing of secrets (API keys, passwords) ran 5.8 billion checks, nearly four times the 2025 pace. More code sent, and faster, also means more chances to let a key slip. The agents themselves can become an entry point, as the booby-trapped file able to control Codex and Claude Code showed.

What does it mean for a development team?

A few points to keep in mind:

• Review becomes the bottleneck: if more than four proposals in ten start from an agent's draft, review rules (two reviewers, mandatory tests, branch protection) deserve to be tightened rather than relaxed.
• Turn on secret detection on your repositories, private ones included, and apply it to the service accounts used by agents.
• Measure your own numbers: the share of code produced by agents and the rate of rollbacks after merging say more than global averages.

France has 4.75 million developers on GitHub, according to the report, ranking eighth worldwide for activity on public projects. One question remains open: what this shift will do to entry-level jobs, whose work most resembles that of agents. Anthropic has already said it is hiring far fewer junior engineers.