- Published on
A Validated Multi-Method Census of 180 Million Repositories
- Authors
- Name
- DeepHorus
A Validated Multi-Method Census of 180 Million Repositories Reveals Widespread, Largely Invisible AI Coding Agent Activity
A groundbreaking new study provides the most comprehensive view to date of how generative AI coding agents are infiltrating the global open-source software supply chain. The research reveals that the prevalence of these tools has been dramatically underestimated, as their activity is often hidden from conventional detection methods. Published on arXiv, the paper introduces a novel multi-layered detection framework that uncovered over 850,000 commits from a single AI agentâClaude Codeâin a single snapshot of the code ecosystem.
The research was necessitated by the rapid, often covert adoption of AI agents like Claude Code, Codex, and Aider by software developers. As these tools become integrated into daily workflows, their diverse and frequently invisible traces leave their actual usage rates poorly understood. Most prior estimates have relied on a single signal, such as identifying commits made from known bot accounts, which the new study proves to be a fundamentally flawed methodology. This gap in knowledge has made it difficult for the open-source community to assess the true impact and scale of AI-assisted development.
The core innovation is a validated, multi-method census conducted across the "World of Code" dataset, which encompasses over 180 million Git repositories. The framework combines configuration-file scanning, commit-message analysis, author-identity matching, and bot-signature lookup. The team then hand-validated 495 detection labels to ensure precision. The results starkly illustrate the weakness of single-signal detection: while their multi-method approach identified 850,157 Claude Code commits in one analysis, a simple bot-account lookupâthe signal most adoption studies rely onâcaught only 28,154 (3.3%), revealing a 30x undercounting bias.
Tracking activity from December 2024 to April 2026, the researchers found that commit-attributed AI agents consistently generate over 320,000 commits per month. Claude Code dominates this landscape, accounting for 886,122 total commits across 17,295 projects and leading in silent, configuration-file-only adoption within 21,078 projects. The study also compared its commit-channel findings with an independent pull-request (PR) census called AIDev. The two channels captured nearly disjoint populations of agent users, demonstrating that focusing on only one channel gives a wildly incomplete picture.
The implications for the open-source ecosystem are profound. The research indicates that no single detection channel is representative of AI agent adoption. PR-deployed cloud agents like Codex and Cursor are typically used for feature work and are visible in PRs, while commit-deployed in-editor agents like Claude Code are used for maintenance and are detectable primarily through commit analysis. This means a PR-only audit misses 79% of commit-detected Claude Code adopters and essentially all Codex adopters, leaving a massive blind spot for project maintainers and security auditors.
The open-source community has reacted with a mix of concern and validation. Lead author Arsham Khosravani stated, "Our work demonstrates that current estimates of AI agent adoption in open source are likely biased low by at least 30 times." Co-author Audris Mockus emphasized, "The work profile we observe follows the deployment and detection mode rather than the tool itself, so understanding this is key to managing the transition." These findings are expected to spark discussions on governance, attribution, and the future of software provenance.
Looking ahead, this census sets a new standard for monitoring AI in software development. The researchers highlight the urgent need for projects and platforms to adopt more sophisticated, multi-signal auditing to accurately understand their contributor base. As AI agents become more capable and ubiquitous, this validated methodology provides a critical tool for ensuring transparency and security in the digital infrastructure that powers the modern world. The era of invisible AI co-development is now measurable, bringing its challenges into sharp focus.
