AI Coding Agents Now Start 40% of GitHub Pull Requests. Code Review Is the New Bottleneck

AI coding agents went from side tool to default in six months

AI coding agents now write the first draft of a large share of the world's software changes. GitHub's Octoverse 2026 report, published October 28, says that by September more than 40% of pull requests on GitHub started with an agent's first draft. In March the figure was 17%. That is 110 million agent-started pull requests in September alone, about six times March's volume.

For US engineering teams, this is the first hard number on how much code is written by AI at platform scale, rather than a vendor survey or a CEO's estimate. It covers public and private repositories, and GitHub says its count is a floor, because not every agent leaves a detectable signal.

Our read: the headline is not that agents can write code. That has been true for two years. The headline is that agentic coding moved from an experiment some developers ran to the default way a large minority of changes begin, and it happened inside a single year.

Agentic coding tripled the volume of software changes

The rest of the report shows what that shift did to volume. In the 12 months ending September 30, developers pushed code to GitHub 17.9 billion times, more than 2024 and 2025 combined. Commits reached 34.3 billion. Merged pull requests more than tripled to 1.3 billion, an average of 3.5 million a day.

Two smaller numbers explain where the volume comes from. Among GitHub Copilot's monthly active users, 55% now use agentic features, up from 35% a year ago. And new repositories with an agent configuration file logged eight times as many commits as new repositories without one. Teams that set up agents properly do not use them a little more; they ship at a different rate.

GitHub's numbers center on its own Copilot, but the same pattern shows up with Claude Code, Codex and Cursor, which all open pull requests on GitHub. If you are choosing between them, our Claude Code vs Cursor comparison covers the current pricing and trade-offs.

Code review is where the real work moved

Here is the part of the report we think matters most. Agent-started pull requests are bigger: about 87% change multiple files, compared with 79% of pull requests without detected agent involvement. And they now merge as reliably as everything else. In February, 83% of agent-involved pull requests merged within two weeks, against about 86% for the rest. By September, agent pull requests were at 90%, while the comparison group held at 86%.

A higher merge rate is easy to read as proof of quality. It is not. A merge rate measures whether a human approved the change, not whether the change was right. When pull requests triple and get wider, every one of them still needs a person to read it, understand it and own it. Writing code got cheap. Code review did not.

GitHub's own data hints that teams already feel this. Use of AI code review and GitHub Advanced Security both grew more than 90% year over year. Push protection, which blocks exposed secrets such as API keys, ran 5.8 billion scans, nearly four times 2025's pace. Stacked pull requests, a feature that breaks big changes into reviewable pieces, reached more than 264,000 developers within two months of its July 30 preview. Those are the tools of a team drowning in review, not a team short on code.

The risk is predictable: reviewers skim, approve and move on, and the bugs land in production. We covered where that ends up in the vibe coding security risks that turn into lawsuits.

Typed languages are where agents do the most work

AI-generated code is not spread evenly. Over the past 12 months, about 44.1% of merged pull requests in TypeScript had detected AI involvement, followed by Python at 41.1% and Rust at 40.4%. Java sat at 21.2%. TypeScript also stayed the most used language on GitHub by contributors, ahead of Python and JavaScript.

GitHub does not explain the gap, so treat this as our interpretation. Agents work best where a compiler or type checker tells them quickly that they are wrong. TypeScript and Rust give that feedback on every change. Large Java codebases tend to sit inside older enterprise systems, where agents get less context and teams allow them less freedom.

What the Octoverse numbers can't tell you

Read the GitHub Octoverse with three caveats. First, GitHub sells Copilot, so it has every reason to frame agent growth as good news. The numbers come from its own platform data, which is the best source available, but the framing is GitHub's. Second, the report has no data on review time, revert rates or bugs traced back to agent changes. Those are the numbers that would show whether faster shipping is also safer shipping. Third, the agent signal only counts agents GitHub can detect, so the real share is likely higher.

There is also a jobs question. If agents write the first draft of 40% of changes, the AI software engineer is less a replacement for human developers than a very fast junior colleague whose work still needs sign-off. The people whose time gets scarcer are senior engineers who review, not the ones who type.

What engineering teams should do now

• Measure review, not just output: track time to first review, review depth and revert rate for agent-started pull requests separately from the rest.
• Keep agent pull requests small. Ask agents for one concern per pull request, and use stacked pull requests when a change is big.
• Put AI code review before human review, not instead of it. Let it catch the obvious problems so people spend their time on design and intent.
• Add an agent configuration file to each active repository, so agents get your conventions, tests and commands up front.
• Turn on secret scanning and push protection. Agents copy patterns, including bad ones like hard-coded keys.

Sources

• GitHub Blog: Octoverse 2026, commits and pushes reach new highs as developers build with agents (October 28, 2026)
• Simon Willison: GitHub Octoverse 2026 (October 28, 2026)
• The Stack: GitHub developers pushed more code in 2026 than in the last two years combined