Small teams lead in AI coding agent adoption
▼ Summary
– 78.9% of agentic pull requests are handled by a single developer who reviews, fixes, and merges the code.
– The median repository opened only one or two agentic pull requests in three months, with heavy usage concentrated in small teams.
– Even among small teams with over 30 agentic pull requests, the majority still followed a single-reviewer workflow.
– Code review remains the bottleneck, as every agentic pull request requires human reading, testing, and judgment.
– Single-reviewer and multi-reviewer pull requests have similar merge rates (81.2% vs. 80.3%), but single-reviewer workflows focus on features while multi-reviewer workflows handle fixes.
The pull request arrives fully assembled, with tests already executed and descriptions already composed, all handled autonomously by an AI agent. Yet a human still must review it. On GitHub, that responsibility typically falls to a lone developer, sitting alone with the code diff, while the rest of the project remains uninvolved.
Researchers Maliha Noushin Raida and Daqing Hou at the Rochester Institute of Technology analyzed 25,264 agent-generated pull requests, categorizing them by who reviewed and committed the code. The repositories examined all had at least 100 stars, and the agents involved were familiar tools like GitHub Copilot, OpenAI Codex, and Claude Code. The data spans May through July 2025.
Most agentic pull requests pass through a single developer. That person reads the AI’s code, makes necessary fixes, and merges it. This pattern covers 78.9% of all pull requests in the dataset.
It mirrors how many maintainers already work. Prompt the agent, wait for the pull request, open it, tweak a few lines, ship it. When counting cases where someone reviews the agent’s work and merges without changes, one-person oversight accounts for nearly nine out of ten.
Group review remains rare at every project size. Small teams rely most heavily on the solo routine, while larger teams distribute the workload more often, though without displacing it entirely.
Most repositories open one or two agentic pull requests per quarter. The median project saw just that many in three months. For most GitHub projects, the agent appears sporadically and then goes quiet, with only a fraction of contributors ever interacting with its output.
Heavy usage belongs to tiny teams. Repositories with one to five contributors averaged 50.2 agentic pull requests each , many times what medium and large teams managed , driven by a few outliers pushing agents aggressively. But line up the small projects, and the median looks like everyone else.
Raida examined the small teams that exceeded 30 agentic pull requests in the window and checked who reviewed them.
“Even among the most active small repositories (i.e., small teams with more than 30 agentic PRs), the majority of agentic PRs continued to follow a single-reviewer workflow,” Raida told Help Net Security. “This suggests that increased agentic activity did not necessarily lead to more distributed review practices.”
The agent scales up. The review desk stays one person wide.
The real bottleneck is review. Code review already consumes a large portion of most developers’ workweeks, and every agent pull request still requires reading, testing, and a judgment call on whether to merge. That work rests with a human, and there are only so many hours available.
The limit shows in the numbers. Twenty-five projects in the sample generated agent pull requests at a rate comparable to a working developer’s output, based on a Worklytics benchmark of professional productivity. Everyone else fell below that threshold.
Solo and group review end with similar outcomes. Pull requests handled by one person get merged at nearly the same rate as those reviewed by multiple people.
“The merge rate (i.e., the percentage of PRs merged within the timeframe described in the paper) was very similar between the two collaboration patterns: 81.2% for single-reviewer pull requests and 80.3% for multi-reviewer/committer pull requests,” Raida said.
The two groups handle different tasks. According to Raida, “the most common type of PR among single-reviewer workflows was feature-related, whereas fix-related PRs were the most common among multi-human workflows.” Solo maintainers point their agents at new functionality. A crowd shows up for repairs.
These numbers cover acceptance within the study window and stop there. Reverts, follow-up bug fixes, and how well merged agent code holds up over time fall outside the dataset.
The one-person review desk is standard practice, familiar to anyone who has merged their own Copilot output on a quiet afternoon, and it holds up under load. Small teams running dozens of agent pull requests kept one person in the loop the entire time. Few projects have pushed hard enough against that ceiling to find out where it gives.
(Source: Help Net Security)
