LIVE · cybersecurity feed
Live wire
ai

Small teams are the heaviest users of AI coding agents

Research into the use of AI coding agents on GitHub has revealed that small development teams are the most intensive users of these tools, frequently relying on a single developer to review and merge the agent-generated code. The study, conducted by Maliha Noushin Raida and Daqing Hou at Rochester Institute of Technology, analyzed 25,264 "agentic" pull requests from repositories with at least…

ZeroDay News ·

Source: Help Net Security

Research into the use of AI coding agents on GitHub has revealed that small development teams are the most intensive users of these tools, frequently relying on a single developer to review and merge the agent-generated code. The study, conducted by Maliha Noushin Raida and Daqing Hou at Rochester Institute of Technology, analyzed 25,264 "agentic" pull requests from repositories with at least 100 stars between May and July 2025. The agents examined included popular tools like GitHub Copilot, OpenAI Codex, and Claude Code.

The findings indicate that nearly 79% of agentic pull requests are handled by a single developer who reviews, makes necessary corrections, and merges the code. This figure rises to almost 90% when including cases where a single person reviews the agent's work without making changes. While larger teams tend to distribute review tasks more broadly, the solo review process remains prevalent across projects of all sizes.

Most repositories in the dataset showed infrequent use of AI agents, with a median of one to two agentic pull requests over the three-month period. However, a small number of teams demonstrated significantly higher engagement. Repositories with one to five contributors averaged 50.2 agentic pull requests, substantially more than medium or large teams. Even among these highly active small teams, the single-reviewer workflow remained dominant, suggesting that increased agent activity does not necessarily lead to more distributed review practices.

The research highlights code review as a limiting factor in the adoption of AI coding agents. Code review already consumes a significant portion of developers' time, and each agent-generated pull request still requires human scrutiny, testing, and approval. Only 25 projects in the sample matched the output rate of a professional developer, indicating that human review capacity often caps the volume of agent-generated code that can be integrated.

Despite the concentrated review process, pull requests handled by a single person showed a similar merge rate to those reviewed by multiple individuals. Single-reviewer pull requests had an 81.2% merge rate, compared to 80.3% for multi-reviewer/committer pull requests within the study's timeframe.

The study also observed differences in the types of tasks assigned to agents based on the review pattern. Single-reviewer workflows predominantly involved feature-related pull requests, while multi-human workflows more frequently addressed fix-related issues. The research focused on acceptance within the study window and did not track subsequent reverts, bug fixes, or the long-term stability of merged agent code.

The pattern of a single developer reviewing and integrating agent-generated code is a common practice, particularly for small teams. Even when small teams generated dozens of agentic pull requests, a single individual typically remained responsible for the review process throughout. The extent to which this single-reviewer model can scale before encountering limitations remains largely unexplored.

ai
ShareXLinkedInWhatsAppFacebook

More News

view all →
breach

Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management

AI SPERA, the company behind the cyber threat intelligence platform Criminal IP, has announced AITEM (AI-Powered Threat Exposure Management), an expansion of its Attack Surface Management (ASM) offerings. AITEM aims to move beyond traditional asset discovery to provide a more comprehensive approach to understanding, prioritizing, and responding to security exposures. The platform is scheduled…

ai

AI Is Getting Really Good at Messing With Cybercriminals

Anti-cybercrime initiatives are increasingly deploying artificial intelligence to disrupt scammers by engaging them with lifelike bots, which the criminals mistake for genuine victims. This strategy aims to waste scammers' time and resources while gathering intelligence on their operations.

ai

The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't

A new report highlights a significant blind spot in enterprise security architectures concerning the proliferation of third-party AI agents. The forthcoming 2026 State of Agent Security Report indicates that current security models, often designed to protect AI systems directly chosen and deployed by an organization, frequently fail to account for AI capabilities embedded within third-party…

security

Canadian cybersecurity executive arrested in federal extortion case

A Canadian cybersecurity executive was arrested in Pennsylvania on Thursday, facing federal charges of conspiracy to commit extortion. Edward Dubrovsky, 54, a co-founder and former Chief Operating Officer of CYPFER, a firm specializing in ransomware negotiation, is charged with conspiring to threaten the confidentiality of information for extortion and conspiring to commit Hobbs Act extortion,…

ransomware

FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe

The Federal Bureau of Investigation (FBI) has reportedly arrested Edward Dubrovsky, a co-founder of the ransomware negotiation firm Cypfer and currently associated with CyberSteward. The arrest is said to be part of the ongoing ShinyHunters investigation, specifically in connection with an incident involving FBI job applicant data.

security

Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison

A former core infrastructure engineer has been sentenced to prison for an attempted cyber extortion plot against an industrial firm. The engineer reportedly deleted administrative accounts and reset hundreds of user passwords, subsequently demanding a ransom of 20 Bitcoin to prevent further disruption to the company's servers.