AI Agents Now Start 4 in 10 Pull Requests on GitHub. The Bottleneck Has Moved to Review

By Thorsten Meyer | October 29, 2026 | ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

In March, about one in six pull requests on GitHub started with an AI agent. By September, it was more than four in ten. That is 110 million agent-started pull requests in a single month, GitHub says in its new Octoverse report, released on 28 October at its Universe conference.

A pull request is a proposed change to a codebase. Someone writes it, someone else reviews it, and only then does it go into the product. For years, the slow part was writing. Now an agent can write the first draft in minutes. The slow part is reading it, checking it and deciding to sign off.

GitHub knows this. Most of what it launched this week is about review, routing and approval, not about writing more code. Here is what the numbers actually measure, what the new tools cost, who answers for agent code that ships, and what it means for companies and for developers.

Key takeaways

• The headline: more than 40% of pull requests on GitHub in September 2026 “started with an agent’s first draft”, up from 17% in March. That is 110 million in September, about six times March’s volume.
• The definition: GitHub counts a pull request when the first draft came from a coding agent it can detect. Undetected agents are missing, so GitHub calls its figure a floor. The report covers public and private repositories unless it says otherwise.
• They get merged: 90% of agent pull requests were merged within two weeks in September, up from 83% in February. Pull requests without a detected agent stayed at about 86%. Merged is not the same as correct.
• The new bottleneck is review. GitHub launched Copilot code review Max (several AI reviewers from different model providers, then one combined review), made Copilot approvals count toward required approvals, and released Copilot Fusion, a router that picks models for each step.
• Review now has a meter. GitHub estimates an average Copilot review at $0.25 (Lite), $1.50 (Balanced) and $10 (Max), plus GitHub Actions minutes.
• Accountability stays human, on paper: GitHub says developers “stay accountable for what ships”. Its cloud agent cannot approve or merge its own pull requests, and the person who asked for the change cannot approve it either.
• For companies: budget reviewer time and review credits like compute, decide where an AI approval may count, and measure outcomes (rework, reverts, incidents), not pull request counts.
• For developers: writing a precise task and reading a diff critically are now core skills. The small starter tasks juniors used to learn on are exactly what agents take first.

Products Worth Considering

Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)

AmazonView Latest Price

Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation

AmazonView Latest Price

Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

What GitHub actually counted

The Octoverse 2026 report is GitHub’s yearly look at its own platform. The 2026 edition covers 1 October 2025 to 30 September 2026. The agent figure comes from one paragraph and one glossary entry, so the wording matters.

GitHub defines an “agent-started pull request” as “a pull request whose first draft came from a coding agent that we can detect.” It treats every observed agent signal, such as an agent-opened pull request, as “a floor, since not all agent use may be detected.” So the real share could be higher. It also means a pull request counts as agent-started even if a human rewrote half of it afterwards.

Three more details:

• Public and private. The methodology says metrics include public and private repositories “unless noted”. The agent share carries no such note. GitHub does not publish a split between open-source and company code for this figure.
• The wording shifts. The text says “agent-started” and “started with an agent’s first draft”. The chart captions in the same post say “agent-generated” and “agent-authored”. GitHub’s industry section speaks of “agent-opened” pull requests. For readers, these are close. For anyone quoting the number, “started” is the precise word.
• Recalculated history. GitHub recalculated 2024 and 2025 on the new definitions and window, so older Octoverse reports are not directly comparable.

The scale behind the headline

Everything on GitHub grew this year, and agents are a large part of why. Developers pushed code 17.9 billion times in the 12 months to September, more than in 2024 and 2025 combined. Commits reached 34.3 billion. Merged pull requests rose from 402 million in 2024 and 538 million in 2025 to 1.3 billion, about 3.5 million a day. On stage, GitHub’s Jay Parikh gave monthly figures, as Simon Willison reported from the keynote: 220 million merged pull requests and 7.38 billion commits per month.

GitHub’s telemetry shows activity “surging around June”. That is when, in GitHub’s words, agents moved “from single-session tools to persistent ones” that track work across days and run in the cloud. Among GitHub Copilot’s monthly active users, 55% now use agent features, up from 35% a year ago. Use of the Copilot cloud agent, where you assign a task and the agent works alone, grew 230% year over year. Agent chat grew 85%.

Agent pull requests are also bigger in one way: 87% change more than one file, against 79% of pull requests without a detected agent. More files per change means more for a reviewer to hold in their head.

Some concrete cases from the report: one open-source developer, @kinlane, made more than 1 million contributions, using agentic workflows to keep a machine-readable catalog of public APIs current. Construction has the highest share of repositories with agent-opened pull requests of any industry, about 9%, with manufacturing next. And in a customer quote in GitHub’s changelog, an Accenture manager says AI now authors 91% of his team’s commits and production errors fell from about 11,000 a day to under 1,000. That last one is a vendor-selected testimonial, not a study.

The turn: merged is not the same as good

GitHub’s strongest quality signal is the merge rate. In February, 83% of agent pull requests were merged within two weeks, a touch behind the roughly 86% for the rest. By September, agent pull requests reached 90%, while the comparison group held at about 86%.

That sounds like agents now write better code than people. It does not show that. A merge rate measures that someone clicked merge in time. It does not measure whether the change was right, whether it was reverted next week, or whether it caused an incident. The trade site Developer Tech put it plainly: “These figures reflect the time taken to merge pull requests, rather than the quality of the resulting code.”

There is independent evidence on the gap between “passes the tests” and “a maintainer would accept it”. In a March 2026 research note, the research group METR had four active maintainers of scikit-learn, Sphinx and pytest review 296 AI-written patches that had passed an automated test grader. Roughly half would not have been merged, even after adjusting for how often maintainers reject human patches (they accepted only 68% of real, previously merged ones). On average, maintainer acceptance was about 24 percentage points below the automated score. METR stresses the limits: the agents were from mid-2024 to late 2025 and could not revise their work after feedback, as a human would. I covered a newer benchmark built on the same question in FrontierCode: Would a Maintainer Merge Your AI’s Pull Request?

Put the two together and the picture is clear. Agents produce a lot of change that passes checks. Whether it is good change is decided at review. Review is where the work now piles up.

What GitHub launched for the review bottleneck

GitHub’s own announcement says it directly: “More code means more pull requests and more demand for review.” The Universe launches answer that with more automation at the review step.

• Copilot code review Max (public preview): runs “several independent review agents across models from different providers”, then an aggregation agent reconciles their findings into one review. GitHub says Max “posted the highest F1 score on ReviewBench for high-severity issues”. F1 is a score that balances catching real bugs against raising false alarms. GitHub has not published the score or the field it beat, so treat this as a vendor claim.
• Copilot approvals (generally available): Copilot can now approve a pull request, and that approval “counts toward your repository’s required approvals”. It is off by default. Admins can choose which file paths Copilot may approve. New commits after the approval dismiss it.
• Agent Merge: Copilot watches a pull request and fixes failing GitHub Actions checks and merge conflicts in a cloud environment. Combined with auto-merge, the pull request goes in as soon as all requirements are met.
• Stacked pull requests (generally available since 6 October): split a big change into a chain of small ones, reviewed in order. More than 264,000 developers had used them by September. GitHub reports 9% more merged code in repositories using stacks, compared with peers.
• Copilot Fusion (generally available): instead of picking a model, you pick an effort level (Standard, High, Max) and Fusion routes each step to one or more models. In one of its workflows, one model drafts and another critiques. GitHub says Fusion Max scored 60 on the Artificial Analysis Coding Agent Index, within two points of Claude Code with Claude Opus 5.5, at about half the average cost per task and about 40% less time. The public Artificial Analysis table matches the 60. For how much a single leaderboard point is worth, see my analysis of this week’s index leader.

GitHub is also tightening the front door. Since 8 October, maintainers can count draft pull requests toward per-person pull request limits, because they are “seeing more low-quality contributions”. Since 28 October, they can exempt contributors by account age or by merged history. Open-source projects have felt AI-generated noise for months, as I described in the Cloudflare and AI bug report spam piece.

What review costs now

Review used to cost time. Now it also costs credits. GitHub bills Copilot in AI credits, where one credit is one US cent. Its documentation lists estimated costs for a single Copilot code review:

• Lite: typically $0.05 to $1, about $0.25 on average.
• Balanced (the default since 28 September): typically $0.25 to $5, about $1.50 on average.
• Max: typically $1.50 to $25, about $10 on average.

These are GitHub’s estimates. Bigger pull requests and long custom instructions cost more, and GitHub Actions minutes come on top. A quick sum of my own: a team that runs 1,000 pull requests a month through Max would spend about $10,000 a month on reviews alone, against about $1,500 on Balanced.

Fusion is billed per model it uses, at each model’s standard rate, with a temporary 30% discount for paid Copilot plans. And the plan structure moved. From 28 October, enterprises that buy through GitHub or Microsoft sales can get Copilot included for every GitHub Enterprise Cloud user, with no seat charge, but usage is metered “from the first request” and there is no included allowance. Users without that license pay $10 a month for “Copilot Standalone”. Copilot Business ($19 per user per month, 1,900 pooled credits) and Copilot Enterprise ($39, 3,900 credits) stay available. Self-serve customers have to wait. For individuals, Copilot Pro is $10 a month, Pro+ $39 and Max $100.

This is the same shift I described in Is AI Coding Paying Off?: the bill follows usage, so the incentive to measure outcomes instead of activity gets stronger.

Who answers for agent code that ships

GitHub’s position is clear in its words. “Developers set the direction, make decisions, and stay accountable for what ships,” Parikh writes. The Octoverse report ends the same way: “someone still has to decide whether it works, whether it belongs, and whether it’s good.”

GitHub’s documentation on risks and mitigations shows how it builds that into its own cloud agent:

• The agent’s pull requests “must be reviewed and merged by a human”. The agent cannot approve or merge them.
• The person who asked the agent for the change cannot approve that pull request. When the agent opens a pull request under its own app identity, one more approval is required by default.
• Commits are authored by Copilot, with the requesting developer as co-author, and link to the session log. Review costs for these pull requests are billed first to that human co-author.
• GitHub Actions workflows do not run on the agent’s code until someone with write access approves them.

These are good defaults. But the new approval feature changes the math. If an AI reviewer’s approval counts as one of the required approvals, a pull request drafted by one AI and approved by another can need only one human click. GitHub leaves that choice to admins, with path limits. My reading: for code that touches logins, payments, permissions, infrastructure or the build pipeline, keep at least one human approval that no AI can replace.

One more detail worth knowing: GitHub’s documentation says Copilot code review reads custom instructions and agent skills “from the head branch”, the branch being reviewed. That makes testing new instructions easy. It also means a pull request can change the instructions its own reviewer follows. My reading: protect those files with code owners, so changes to them always get a human look.

Accountability does not stop at GitHub’s settings. In my book Many Hands, I ask who answers when an agent acts in your name. For code, the practical answer is simple: every agent pull request needs a named human owner who can explain the change.

What this means for companies

• Plan review capacity like compute. If agents triple the pull requests, reviewer hours do not triple by themselves. Track time to first review, review queue length and how many agent pull requests get closed without merge.
• Measure outcomes, not output. Pull request counts and merge rates reward volume. Track rework, reverts, change failure rate and incidents per release. Amazon has made the same point internally, as I wrote in Amazon Tells Engineers to Stop Tokenmaxxing.
• Decide where an AI approval may count. Turn on Copilot approvals, if at all, only for low-risk paths such as documentation, tests or dependency bumps. Keep human approval on security-sensitive code.
• Budget the review meter. Use Max where a miss is expensive, Balanced or Lite elsewhere, and set budgets per team. Under the new enterprise model, there is no included allowance.
• Secure agent pull requests like any outside contribution. Keep secret scanning and push protection on, require code scanning, and keep the default that workflows wait for human approval. GitHub’s new AI Scan for pull requests is advisory and cannot block a merge on its own. Limit what agents can touch, as in AI Agents Now Hold Our Keys, and remember that attackers now target AI tools and their logs directly, as covered in Attackers Now Go After Your AI Tools.
• Keep changes small. Stacked pull requests and a rule like “one task, one reviewable change” help humans keep up.
• Stop supervising every step, and review the result properly instead. Ask agents for a decision-ready summary of what changed and why, the approach in Stop Babysitting Your AI Agents.

What this means for developers

• Specifying is the new first step. GitHub writes that “the first move is now directing an agent, and review is how developers shape what comes back.” A clear task with acceptance criteria saves more time than a clever prompt.
• Reading code becomes the core skill. Spotting a wrong assumption in a 20-file diff is harder than writing a 20-line function. Testing, security basics and knowing how the system fits together matter more, not less.
• Juniors need a new on-ramp. Small bug fixes, tests and dependency updates were how beginners learned. Agents now take those first. GitHub’s report has no data on junior jobs, so this is my reading: teams should give juniors agent output to review with a senior, not only tasks to type.
• Model choice is fading into the background. 61% of Copilot users who pick models themselves used more than one in September, and 63% of paying developers let Copilot choose at least once. Routers like Fusion will make that the default.
• Open-source maintainers: use the new pull request limits and exemptions. A flood of low-effort agent contributions is a real cost to unpaid reviewers.
• For everyone who uses software: more software will ship, faster. Whether it is safer depends on the review step this article is about.

Honest limits

• GitHub’s own numbers. Every figure here comes from GitHub’s telemetry, GitHub’s detection and GitHub’s definitions. GitHub also sells the tools that address the problem it describes. No outside auditor has checked the 40%.
• A floor, not a census. Only detectable agents count. Agents that run on a developer’s laptop and push code under a human’s name may be invisible.
• Survivorship. The merge rate only covers pull requests that were opened. Agent drafts that were thrown away before becoming a pull request never enter the numbers. Early adopters of agents may also be the teams with faster review habits.
• No quality data. GitHub publishes no revert rate, defect rate or incident rate for agent pull requests. The METR study is small (four maintainers, three projects, older agents) and is about benchmark patches, not GitHub traffic.
• Unpublished benchmark details. The ReviewBench claim has no published score. The Fusion comparison rests on one index; the Artificial Analysis table matches GitHub’s 60.
• Cost estimates move. GitHub’s review prices are estimates and “may change as models evolve”. The keynote’s monthly figures come from a reporter’s notes of the talk, not from the written report.
• Conflict of interest. GitHub’s Fusion benchmark compares it with Anthropic’s Claude Code, Fusion routes Anthropic and OpenAI models, and this article was drafted with help from Claude. I report those comparisons only as GitHub and Artificial Analysis publish them.

Sources

• GitHub: Octoverse: Commits, pushes, reach new highs in 2026 as developers build with agents, 28 Oct 2026 (incl. glossary and methodology)
• GitHub, Jay Parikh: GitHub Universe 2026: Evolving every layer of the stack, 28 Oct 2026
• GitHub changelog: Copilot code review: merge with confidence with Max and approvals, 28 Oct 2026
• GitHub changelog: Route and orchestrate models with GitHub Copilot Fusion, 28 Oct 2026
• GitHub changelog: GitHub Enterprise now includes access to GitHub Copilot, 28 Oct 2026
• GitHub changelog: Agent Merge watches and fixes pull requests in the cloud, 28 Oct 2026
• GitHub changelog: Stacked pull requests generally available, 6 Oct 2026; Draft pull requests count toward pull request limits, 8 Oct 2026; Pull request limits: exempt contributors by age or history, 28 Oct 2026; AI Scan for pull requests generally available, 15 Oct 2026
• GitHub Docs: GitHub Copilot code review (review effort levels, estimated cost per review, approvals, billing), retrieved 29 Oct 2026
• GitHub Docs: What’s changing with GitHub Enterprise and Copilot billing and Usage-based billing for organizations and enterprises, retrieved 29 Oct 2026
• GitHub Docs: Risks and mitigations for Copilot cloud agent, retrieved 29 Oct 2026
• GitHub: Copilot plans and pricing, retrieved 29 Oct 2026
• Artificial Analysis: Coding Agent Index, retrieved 29 Oct 2026
• METR: Many SWE-bench-Passing PRs Would Not Be Merged into Main, 10 Mar 2026
• The Next Web: GitHub launches Copilot Fusion as agents start 40% of pull requests, 28 Oct 2026
• Developer Tech: GitHub says AI agents now start over 40% of pull requests, Oct 2026
• Simon Willison: GitHub Octoverse 2026, 28 Oct 2026 (keynote figures)

Researched and drafted with AI assistance, including Anthropic’s Claude.