Pulse
2026-09-18-v3.0
Dataset
2026-09-18-v3.0
Ruleset
b2e8889c66f7
Scanned
2026-09-16
Window
February–September 15, 2026
Local to this browser

01Result

OWASP/CheatSheetSeries ↗

OWASP/CheatSheetSeries AI coding statistics: 10.1%

of 189 commits in February–September 15, 2026 were committed by an AI agent — a floor, not an estimate
10.1% agent · top contributor 15.8%12 contributors
org-wide

Adoption is broad. Many contributors are committing agent-authored work, which is what a real organisational rollout looks like.

19
agent commits
170
other considered commits
12
agent contributors
15.8%
largest contributor

02Drivers

What shapes this result

Mode, timing, and detected signatures show whether the result reflects broad adoption or one concentrated workflow.

Assisted or autonomous

19assisted
0autonomous

Assisted — a developer’s identity authored the commit and the agent added itself as co-author. Autonomous — a bot identity authored the commit without a human identity attached. Across the whole index, 96% of agent commits are assisted.

Agent share by month

Agent-attributed commit share by month
MonthAgent shareConsidered commits
2026-025.6%18
2026-0324.1%29
2026-040%22
2026-050%31
2026-067.1%28
2026-0718.2%11
2026-0811.1%36
2026-0921.4%14

Peak month: 24.1%. Bars are scaled to that peak, not to 100%.

Which agents

AgentVendorCommitsShare
Claude CodeAnthropic105.3%
GitHub CopilotGitHub94.8%

03Evidence

Inspect the matches

Public commit samples let you inspect the signatures behind the aggregate result.

Matched commit samples

  • 1eacf6cb on GitHubdocs(CSP): note that prefetch-src was removed from CSP Level 3 (#2327)Claude Code
  • c1a874a1 on GitHubdocs: state what verifies a self-made patch in Case 3 (#2360)Claude Code
  • b994fb66 on GitHubVulnerable Dependency Management: add remediation and maintained backportsClaude Code
  • 8aaf426d on GitHubRework the Java section of the XXE Prevention Cheat Sheet (#2405)GitHub Copilot
  • dbf07c1b on GitHubRemove dead CSRF community link from cheat sheet (#2418)GitHub Copilot
  • 86286859 on GitHubFix terminology: behaviours -> behaviors in Authentication_Cheat_Sheet.md GitHub Copilot

04Method

What entered the denominator

The result begins with commit history, removes merges and routine automation, and reports literal agent signatures as a lower bound.

Exclusion ledger

Commits in window229
Merge commits removed−0
CI / dependency bots removed−40
Considered189

Bots are excluded from the denominator entirely. Agent attribution requires a literal supported signature; no code-style inference is used.

05Provenance

Pinned to a source state

This observation names the repository state, release, and detector that produced it. Use these identifiers when reproducing or citing the result.

Dataset release
2026-09-18-v3.0
Scan date
2026-09-16
Ruleset
sha256:b2e8889c66f72c18a61839f0bf1a9f77b5481ba2def044dba33c797b2f2bdcae
Canonical repository
OWASP/CheatSheetSeries
Default branch
master
Resolved HEAD
8aaf426de610ea603c21cf6a75222a6b7a30f820 ↗
Resolved
2026-09-16
Measurement window
February–September 15, 2026
Download observation JSONDeterministic export · same values as this page

06Peer context

Position among comparable repositories

The cohort uses the same release and measurement window, then narrows to the repository’s ecosystem and removes low-activity observations.

CohortPython · 247 eligible repositories · at least 100 considered commits2026-09-18-v3.0 · February–September 15, 2026 · 145 of 392 ecosystem repositories excluded
Agent-commit share position60th percentile

Midrank percentile; equal shares split the tied positions.

Repository
10.1%
Cohort median
6.3%
Share rank
100 / 247
0th50th100th

Percentile = (repositories below + half of 1 tied repository) ÷ 247.

Continue exploring

Claude Code commitsBrowse repositories with detected Claude Code signatures →GitHub Copilot commitsBrowse repositories with detected GitHub Copilot signatures →GitHub AI commit analyzerInspect another repository with the same evidence model →
Reproduce this observation

Run the same detector locally.

Deterministic signature matching; no code-style inference. Squash merges can remove trailers, so this result remains a measured floor.

npx qmmit-cli OWASP/CheatSheetSeries

Scan another repository

Try