Adoption is broad. Many contributors are committing agent-authored work, which is what a real organisational rollout looks like.
Assisted or autonomous
Assisted — a developer’s identity authored the commit and the agent added itself as co-author. The agent ran git commit during a working session, with a person there. Autonomous — a bot identity is the author, no human in the loop. Across the whole index, 93.7% of agent commits are assisted.
Agent share by month
Peak month: 4.9%. Bars are scaled to that peak, not to 100%.
Which agents
| GitHub Copilot | GitHub | 37 | 1.5% |
| Claude Code | Anthropic | 16 | 0.6% |
| Cursor Agent | Anysphere | 13 | 0.5% |
Verify it yourself
Sample commits that matched. Every one links to GitHub — check the trailers.
aff26cdfAdd error handling for version parsingGitHub Copilotd71d1f4bPotential fix for pull request findingGitHub Copilotdbecf435Potential fix for pull request findingGitHub Copilot4e8069f1Implement dual-target payload support for vsftpd_234_backdoorClaude Code1170d520Fix RuboCop style violation in wp_planyo_lfi moduleClaude Code8acc5ce8Add regression specs and comments for fetch payload prepends fixClaude Codea6a98085Wire AArch64 through psexec's PowerShell delivery pathCursor Agent35415c2cAdd RSpec coverage for Msf::Util::EXE.to_winaarch64peCursor Agent8f83a22dDrop ineffective sockx0 Convention from AArch64 stagerCursor Agent
What was excluded
| Commits in window | 3,103 |
| Merge commits removed | −593 |
| CI / dependency bots removed | −0 |
| Considered | 2,510 |
Bots are excluded from the denominator entirely. Counting dependabot as “AI-written code” is the fastest way to produce a meaningless number.
How this was measured
Measured over February–August 2026, cloned directly. Detection is deterministic string matching against signatures agents write about themselves — no heuristics, no style analysis. Merge commits and CI bots are excluded from the denominator. The figure is a floor: squash merges strip trailers, so real usage is higher. Contributor counts are aggregate — no individual is named.
Run it yourself: npx qmmit-cli rapid7/metasploit-framework