- Dataset
- 2026-10-27-catalog-ai-v2
- Ruleset
- b2e8889c66f7
- Scanned
- 2026-10-27
- Window
- February–September 15, 2026
NIST Certified SCAP 1.2 toolkit
01Result
OpenSCAP/openscap ↗OpenSCAP/openscap AI coding statistics: 7.3%
One person is driving this. The headline number reflects a single contributor's workflow, not a project-wide shift.
02Drivers
What shapes this result
Mode, timing, and detected signatures show whether the result reflects broad adoption or one concentrated workflow.
Assisted or autonomous
Assisted — a developer’s identity authored the commit and the agent added itself as co-author. Autonomous — a bot identity authored the commit without a human identity attached.
Agent share by month
| Month | Agent share | Considered commits |
|---|---|---|
| 2026-04 | 0% | 37 |
| 2026-05 | 55.6% | 9 |
| 2026-06 | 12.5% | 16 |
| 2026-07 | 0% | 25 |
| 2026-09 | 0% | 9 |
Peak month: 55.6%. Bars are scaled to that peak, not to 100%.
Which agents
| Agent | Vendor | Commits | Share |
|---|---|---|---|
| Cursor Agent | Anysphere | 4 | 4.2% |
| Claude Code | Anthropic | 3 | 3.1% |
03Evidence
Inspect the matches
Public commit samples let you inspect the signatures behind the aggregate result.
Matched commit samples
ba42020eon GitHubfix(oval): use %d in CIM datetime sscanf for int fieldsCursor Agentc6216251on GitHubXCCDF: replace ctime with ctime_r in status dumpCursor Agentf70b981eon GitHubselinuxsecuritycontext: const-correct strchr in split_levelCursor Agent43590c09on GitHubtest: use a unique temp dir in test_variable_in_filterClaude Code44e58f73on GitHubfix: account for DST in XCCDF result timestamp offsetClaude Codef9d83c47on GitHubSet install RPATH on macOS so binaries find libopenscapClaude Code
04Method
What entered the denominator
The result begins with commit history, removes merges and routine automation, and reports literal agent signatures as a lower bound.
Exclusion ledger
| Commits in window | 136 |
| Merge commits removed | −40 |
| CI / dependency bots removed | −0 |
| Considered | 96 |
Bots are excluded from the denominator entirely. Agent attribution requires a literal supported signature; no code-style inference is used.
Continue exploring
Related coding-agent evidence
Run the same detector locally.
Deterministic signature matching; no code-style inference. Squash merges can remove trailers, so this result remains a measured floor.
npx qmmit-cli OpenSCAP/openscap