- Dataset
- 2026-10-27-catalog-ai-v2
- Ruleset
- b2e8889c66f7
- Scanned
- 2026-10-27
- Window
- February–September 15, 2026
Snyk CLI scans and monitors your projects for security vulnerabilities.
01Result
snyk/cli ↗snyk/cli AI coding statistics: 7%
Adoption is broad. Many contributors are committing agent-authored work, which is what a real organisational rollout looks like.
02Drivers
What shapes this result
Mode, timing, and detected signatures show whether the result reflects broad adoption or one concentrated workflow.
Assisted or autonomous
Assisted — a developer’s identity authored the commit and the agent added itself as co-author. Autonomous — a bot identity authored the commit without a human identity attached.
Agent share by month
| Month | Agent share | Considered commits |
|---|---|---|
| 2026-02 | 0% | 93 |
| 2026-03 | 0% | 96 |
| 2026-04 | 1.4% | 74 |
| 2026-05 | 3.9% | 102 |
| 2026-06 | 10.4% | 67 |
| 2026-07 | 9.9% | 91 |
| 2026-08 | 6.4% | 110 |
| 2026-09 | 35.1% | 57 |
Peak month: 35.1%. Bars are scaled to that peak, not to 100%.
Which agents
| Agent | Vendor | Commits | Share |
|---|---|---|---|
| Claude Code | Anthropic | 37 | 5.4% |
| Cursor Agent | Anysphere | 11 | 1.6% |
03Evidence
Inspect the matches
Public commit samples let you inspect the signatures behind the aggregate result.
Matched commit samples
80b2f008on GitHubfix: resolve .snyk per project under --all-projects [OSF-497]Claude Codeda692a6aon GitHubfix: report an unreadable .snyk file as SNYK-POLICY-0002 [OSF-495]Claude Code8605b8e2on GitHubchore: bump cli-extension-dep-graph to v2.16.0Claude Codead487e9con GitHubfix: remove daemon initializer from private CLI buildCursor Agent830c1db0on GitHubfix: remove daemon initializer from private CLI buildCursor Agent1c8bdaceon GitHubchore: pin GAF to v0.23.0 from mainCursor Agent
04Method
What entered the denominator
The result begins with commit history, removes merges and routine automation, and reports literal agent signatures as a lower bound.
Exclusion ledger
| Commits in window | 1,317 |
| Merge commits removed | −627 |
| CI / dependency bots removed | −0 |
| Considered | 690 |
Bots are excluded from the denominator entirely. Agent attribution requires a literal supported signature; no code-style inference is used.
Continue exploring
Related coding-agent evidence
Run the same detector locally.
Deterministic signature matching; no code-style inference. Squash merges can remove trailers, so this result remains a measured floor.
npx qmmit-cli snyk/cli