AI coding agents have moved from novelty to the default starting point for a large share of software changes. GitHub's Octoverse 2026 report, published on October 28 alongside its Universe conference, says that by September more than 40% of pull requests on the platform began with an agent's first draft, up from 17% in March. That works out to roughly 110 million agent-started pull requests in a single month, about six times March's volume.
The Agent Numbers
The report covers October 1, 2025 to September 30, 2026, across public and private repositories. Its headline agent findings are striking, and GitHub frames them carefully:
- More than 40% of September pull requests started with an agent draft, versus 17% in March
- 87% of agent-started pull requests touched multiple files, compared with 79% of pull requests with no detected agent involvement
- The share of agent-involved pull requests merged within two weeks rose from 83% in February to 90% in September, while the comparison group held at about 86%
- Among repositories created in 2026, those containing an agent configuration file averaged eight times as many commits as those without one
GitHub stresses that it only counts agents it can detect, so the agent share should be read as a floor rather than a ceiling. It also does not mean that 40% of all code is machine-written; it measures who opened the first draft of a change.
Activity Has Exploded Since June
The broader platform numbers show how much agents are amplifying output. Over the 12-month window developers made 17.9 billion pushes, more than 2024 and 2025 combined, and 34.3 billion commits, up from 12.9 billion a year earlier. Merged pull requests climbed to 1.3 billion, about 3.5 million a day, and GitHub Actions ran 45.4 billion jobs, roughly 1,440 every second.
GitHub says the curve bent sharply around June. Compared with September 2025, commits in September 2026 were running about six times higher. From June onward, around 55% of commits landed in brand-new repositories, a sign that agents are spinning up fresh projects as well as patching old ones. The platform now counts more than 225 million developers, with the United States at 38.3 million and India at 32.0 million; both added more than 10 million developers this year.
Developers Are Mixing Models
Agentic workflows are also making developers less loyal to any single model. In September, 61% of Copilot users who picked a model themselves used more than one, up from 50% four months earlier. Paid Copilot plans drew on 47 distinct models that month, and no single model exceeded 25% of requests. Of every 100 developer-selected requests, 38 went to general-purpose models, 37 to deep reasoning models and 25 to fast, lightweight ones.
Agentic features are now mainstream inside Copilot itself: GitHub says 55% of monthly active Copilot users use them, up from 35% a year earlier, and Copilot cloud agent usage grew 230% year over year. Among open-source projects, Anthropic's claude-code and OpenAI's codex were among the fastest-growing vendor repositories by contributors.
Security and Review Pressure
Code volume is now outrunning traditional checks. GitHub's push protection ran 5.8 billion scans against 17.9 billion pushes. Security firm GitGuardian, analysing the report, argues that most pushes therefore go unchecked and that teams need controls that run while agents work, not only after code lands. It points to its own research showing that 3.2% of Claude Code-assisted public commits contained a secret, against a 1.5% baseline, and that 40% of high and critical secrets on developer laptops sat in AI tool directories and logs.
Its recommendations include shorter-lived credentials for automation, removing local secrets from developer machines and building safe credential handling into the tools used by non-specialist "citizen developers".
Why It Matters
Octoverse 2026 is the clearest large-scale evidence yet that agentic software development has reached production scale. When four in ten pull requests start with an agent, the bottleneck shifts from writing code to reviewing, testing and governing it. Higher merge rates suggest agent output is increasingly acceptable to maintainers, but merging is not proof of quality, and GitHub itself presents the figures as observed behaviour, not a judgment on model capability.
For engineering leaders, the practical takeaways are clear:
- Treat agent-opened pull requests as a distinct workflow with its own review rules
- Invest in automated security scanning that keeps pace with agent output
- Expect multi-model use to be the norm and plan policy controls accordingly
- Keep human developers accountable for what ships
The next test is whether review capacity and security tooling can scale as fast as the agents filling the queue.
