Your open-source project probably added an AI-contribution policy in the last few months. Apache has one. The Linux Foundation has one. The OpenSSF Technical Advisory Council is finalizing a foundation-wide one right now. Bitcoin Core, ripgrep, uv, and dozens of smaller projects have copied the pattern. If you maintain something popular, you've either written one or you're about to.
Almost all of them say some version of the same three things: disclose when you use AI; a human must review and remain responsible for every change; no fully autonomous agent PRs.
These are good norms. But I want to point at something uncomfortable: as written, almost none of them are enforceable. They're prose in a CONTRIBUTING.md, and prose is an honor system. So I went looking for how big the gap actually is.
What agent PRs actually do at scale
I scanned 2,204 recently merged, agent-authored pull requests across public GitHub repos (Devin, Copilot coding agent, Codex, Claude Code, Cursor). The scan is deterministic and checkout-free — it reads PR metadata and file contents through the GitHub API, never executes PR code, and never calls an LLM, so every finding replays. Three results are directly relevant to anyone writing one of these policies:
