- Dataset
- 2026-10-27-catalog-ai-v2
- Ruleset
- b2e8889c66f7
- Scanned
- 2026-10-27
- Window
- February–September 15, 2026
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
01Result
beenuar/AiSOC ↗beenuar/AiSOC AI coding statistics: 38.6%
A small group is using agents. Adoption has spread beyond one person but is not project-wide.
02Drivers
What shapes this result
Mode, timing, and detected signatures show whether the result reflects broad adoption or one concentrated workflow.
Assisted or autonomous
Assisted — a developer’s identity authored the commit and the agent added itself as co-author. Autonomous — a bot identity authored the commit without a human identity attached.
Agent share by month
| Month | Agent share | Considered commits |
|---|---|---|
| 2026-05 | 12.1% | 355 |
| 2026-06 | 78.3% | 46 |
| 2026-07 | 92.2% | 103 |
| 2026-08 | 94.6% | 37 |
Peak month: 94.6%. Bars are scaled to that peak, not to 100%.
Which agents
| Agent | Vendor | Commits | Share |
|---|---|---|---|
| Cursor Agent | Anysphere | 203 | 37.5% |
| Claude Code | Anthropic | 6 | 1.1% |
03Evidence
Inspect the matches
Public commit samples let you inspect the signatures behind the aggregate result.
Matched commit samples
ca603c3don GitHubstyle(ueba): ruff format peer_group + baseline scoring tests (#607)Cursor Agent6123c1c8on GitHubchore(deps): bump github/codeql-action init+autobuild+analyze to v4.37.6 (Cursor Agent8dddf962on GitHubfix(agents): persist investigations by resolving the 'default' tenant (#60Cursor Agent460cc4f0on GitHubfeat(agents,api): route LLM tasks through gateway aliases; drop default moClaude Codedcd36682on GitHubfix(api): reconcile detection_rules/cases schema drift on initdb installs Claude Code6cd64cadon GitHubfeat(infra): LiteLLM gateway for task-based model routing + observability Claude Code
04Method
What entered the denominator
The result begins with commit history, removes merges and routine automation, and reports literal agent signatures as a lower bound.
Exclusion ledger
| Commits in window | 753 |
| Merge commits removed | −25 |
| CI / dependency bots removed | −187 |
| Considered | 541 |
Bots are excluded from the denominator entirely. Agent attribution requires a literal supported signature; no code-style inference is used.
Continue exploring
Related coding-agent evidence
Run the same detector locally.
Deterministic signature matching; no code-style inference. Squash merges can remove trailers, so this result remains a measured floor.
npx qmmit-cli beenuar/AiSOC