LIVE · cybersecurity feed
Live wire
ai

Small teams are the heaviest users of AI coding agents

The pull request arrives with the tests already run and the description already written, the work of an agent that handled the whole thing on its own. Somebody still has to read it. On GitHub that somebody is usually one developer sitting alone with the diff, and the rest of the project never sees the code. Maliha Noushin Raida and Daqing Hou at Rochester Institute of Technology sorted 25,264 agen

zeroday.news · 10d ago

Research into the use of AI coding agents on GitHub has revealed that small development teams are the most intensive users of these tools, frequently relying on a single developer to review and merge the agent-generated code. The study, conducted by Maliha Noushin Raida and Daqing Hou at Rochester Institute of Technology, analyzed 25,264 "agentic" pull requests from repositories with at least 100 stars between May and July 2025. The agents examined included popular tools like GitHub Copilot, OpenAI Codex, and Claude Code.

The findings indicate that nearly 79% of agentic pull requests are handled by a single developer who reviews, makes necessary corrections, and merges the code. This figure rises to almost 90% when including cases where a single person reviews the agent's work without making changes. While larger teams tend to distribute review tasks more broadly, the solo review process remains prevalent across projects of all sizes.

Most repositories in the dataset showed infrequent use of AI agents, with a median of one to two agentic pull requests over the three-month period. However, a small number of teams demonstrated significantly higher engagement. Repositories with one to five contributors averaged 50.2 agentic pull requests, substantially more than medium or large teams. Even among these highly active small teams, the single-reviewer workflow remained dominant, suggesting that increased agent activity does not necessarily lead to more distributed review practices.

The research highlights code review as a limiting factor in the adoption of AI coding agents. Code review already consumes a significant portion of developers' time, and each agent-generated pull request still requires human scrutiny, testing, and approval. Only 25 projects in the sample matched the output rate of a professional developer, indicating that human review capacity often caps the volume of agent-generated code that can be integrated.

Despite the concentrated review process, pull requests handled by a single person showed a similar merge rate to those reviewed by multiple individuals. Single-reviewer pull requests had an 81.2% merge rate, compared to 80.3% for multi-reviewer/committer pull requests within the study's timeframe.

The study also observed differences in the types of tasks assigned to agents based on the review pattern. Single-reviewer workflows predominantly involved feature-related pull requests, while multi-human workflows more frequently addressed fix-related issues. The research focused on acceptance within the study window and did not track subsequent reverts, bug fixes, or the long-term stability of merged agent code.

The pattern of a single developer reviewing and integrating agent-generated code is a common practice, particularly for small teams. Even when small teams generated dozens of agentic pull requests, a single individual typically remained responsible for the review process throughout. The extent to which this single-reviewer model can scale before encountering limitations remains largely unexplored.

ai
ShareXLinkedInWhatsAppFacebook

More News

view all →
ai

7 States’ Water Systems Hit by Cyberattacks Likely Tied to Iran

Plus: The FBI eyes AI-powered tech to detect future crimes, Russia charges Telegram’s founder, xAI sues to stop a state’s “nudification” ban, and the Democrats learn a lesson about getting scammed.

vulnerability

Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes

An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million at the time. Galaxy Research mapped the sweep and tied it to a firmware flaw in Coldcard, the Bitcoin-only hardware wallet made by Canadian firm Coinkite. A March 2021 firmware integration error routed seed generation to a deterministic software pseudorandom number generator (PRNG

vulnerabilitycritical

Rails patches critical Active Storage flaw with RCE potential

A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE). [...]

malware

Russian Hackers Hijack Hotel Wi-Fi to Steal Microsoft 365 Tokens

Microsoft says Russian hackers hijacked hotel Wi-Fi portals to spread malware and steal Microsoft 365 tokens from travelers. Microsoft Threat Intelligence disclosed CaptiveCrunch, a campaign it attributes to Storm-2945, an operational sub-cluster of Midnight Blizzard, the Russian SVR-linked group also known as APT29 and Cozy Bear. Since early May 2026, Storm-2945 has been manipulating DNS […]

CVE-2026-48449critical

Adobe fixed a maximum-severity vulnerability flaw in Campaign Classic

Adobe fixed a maximum severity vulnerability in Campaign Classic that could let attackers run code remotely without user interaction. Adobe has addressed a critical vulnerability, tracked as CVE-2026-48449 (CVSS score of 10.0), in Adobe Campaign Classic, the company’s enterprise marketing automation platform. The flaw is caused by incorrect authorization and could allow attackers to execute […]

security

Balance Theory Raises $19 Million to Help Enterprises Manage Cybersecurity Investments

The funding round was led by SYN Ventures, with participation from existing investors DataTribe and TEDCO. The post Balance Theory Raises $19 Million to Help Enterprises Manage Cybersecurity Investments appeared first on SecurityWeek.