AI Coding Agents Now Start 40% of Pull Requests: What GitHub's 2026 Octoverse Means for Your Business

If your business ships software, the way that software gets written has just shifted under your feet. GitHub's annual Octoverse report, released this week at GitHub Universe, shows that more than 40% of pull requests on the platform now start with a first draft written by AI coding agents. In March the share was 17%. That is not a slow trend line, it's a jump that happened over a single summer.

A quick refresher for the non-technical reader: a pull request is the standard unit of change in modern development, a packaged set of code edits that a developer proposes and a colleague reviews before it reaches the product. In September alone, agents opened around 110 million of them.

We went through the report and the coverage around it to pull out the parts that matter for business owners and managers who pay for development work. Let's sink in!

The Numbers Behind the Headline

Octoverse is GitHub's yearly census of activity across more than 225 million developer accounts, so it is about as close to a full picture of the software industry as you can get. The 2026 edition covers October 2025 through September 2026, and the raw totals are hard to believe at first glance. Developers made 34.3 billion commits over the year, up from 12.9 billion the year before. They pushed code 17.9 billion times, which GitHub notes is more than 2024 and 2025 combined.

Merged pull requests reached 1.3 billion, roughly 3.5 million every day. By September, monthly commits were about six times what they were in September 2025. Nothing in normal human staffing explains growth like that. The extra output is coming from agents working alongside people.

One caveat the report itself makes: these are activity numbers, not quality numbers. GitHub counts what was written and merged, not whether any of it made a product better. It also says the agent figures are a floor, because not every agent leaves a detectable trace.

What Changed Around June

The growth was not spread evenly through the year. Activity climbed steadily from January and then surged around June, and the report is fairly clear about why. Agents stopped being autocomplete in an editor and became persistent workers that run in the cloud, keep track of progress across days and even coordinate other agents.

Developer behaviour followed. Among monthly active Copilot users, 55% now use agentic features, up from 35% a year earlier, and usage of cloud-based coding agents grew 230% year over year. From June onward, about 55% of all commits landed in brand-new repositories, which suggests a wave of fresh projects started with agents in the loop from day one.

One more number is worth a pause. New repositories that include an agent configuration file averaged eight times the commit volume of those without one. GitHub is careful to say this does not prove the file causes the speed. Still, teams that plan for agents from the start are clearly moving faster than teams that bolt them on later.

AI Coding Agents Are Fast, but Review Is the New Bottleneck

Here is the part that should interest anyone responsible for software quality. Agent-started pull requests tend to be bigger: about 87% of them change multiple files, against 79% for the rest. They also get merged quickly, with 90% merged within two weeks in September, slightly above the comparison group.

Fast merging of large, machine-written changes is either a sign of mature review processes or a sign of rubber-stamping, and the report cannot tell you which one you have. Microsoft's Jay Parikh put it bluntly at the launch: completed work, not more code, is the output that matters.

The security side tells the same story. Usage of AI-assisted code review and GitHub Advanced Security each grew more than 90% year over year, and push protection ran 5.8 billion secret scans, nearly four times last year's pace. Dependabot merged over 30 million dependency updates, double the previous rate. When the volume of code multiplies, the surface you need to check multiplies with it.

The Economics Are Shifting Too

Alongside the report, GitHub launched Copilot Fusion, a system that routes each step of a coding task to whichever AI model suits it best, mixing models for reasoning, generation and debugging. GitHub claims the top Fusion tier lands within two points of the strongest frontier coding model on an independent index, at half the cost and 40% less time per task.

The pricing change matters as much as the technology. Enterprise customers can now skip per-seat Copilot subscriptions and pay for the AI credits their teams actually consume. Budgets for development tooling start to look like cloud bills: variable, usage-based and worth watching every month.

There is no single winner among the models either. Paying Copilot users tried 47 distinct models in September, and no single model took more than 25% of requests. For a business, that means lock-in at the model level is weaker than the headlines suggest, and AI costs can be optimised much the way cloud costs are.

What It Means for Hiring and Outsourced Development

If you hire developers or buy development from an agency, the ground rules have moved. Code volume was never a great measure of progress, and now it is a meaningless one, because volume is nearly free. What costs money is judgment: scoping the work, structuring the system, reviewing what agents produce and taking responsibility for it in production.

That changes what to ask a vendor. How do they use agents, and on which parts of the work? Who reviews agent-written changes, and what security scanning sits in the pipeline? A small senior team that runs agents well can now outdeliver a much larger team that does not, so headcount tells you less than it used to.

It should also show up in price. If agents draft a large share of routine code, the cost of a typical feature should be drifting down, and a quote built on 2024 productivity assumptions deserves a question or two. The data points the same way for technology choices: TypeScript leads agent involvement, with AI detected in 44.1% of its merged pull requests, so mainstream stacks are where the leverage is biggest.

Practical Takeaways for Your Next Project

A few concrete things to take into your next development project. Measure progress in working features and closed business problems, never in lines of code or pull request counts, because those numbers are now inflated by default.

Insist on a named human reviewer for anything that goes to production, and ask to see the review step in the workflow rather than taking it on faith. Make automated security scanning a requirement in the contract, not an optional extra, since machine-written code arrives faster than any human can eyeball it.

Treat AI usage as a budget line of its own. Credit-based pricing means spend can creep the way cloud spend does, so give it an owner. And invest in the unglamorous things: clear documentation, good tests and a tidy codebase. Agents perform noticeably better in well-organised projects, so the same housekeeping that helps a new hire now also makes your tooling cheaper and faster.

Final Notes

The 40% figure will be quoted everywhere this week, and it is worth remembering what it does and does not say. It says machine-drafted code is now a structural part of how software gets built, on private business repositories as much as in open source. It does not say the code is good, and GitHub is honest about that limit.

The practical conclusion for a business is fairly simple. Writing code is no longer the scarce resource; reviewing it, securing it and pointing it at the right problem are. If you are planning a web or mobile project for 2027, assume your team or your contractor will be working this way, and shape your budget, your contract and your questions around it.