Do These Violent Delights Have Violent Ends? Measuring the Post-Merge Fate of Agentic Code

2026-07-14 · Source: cs.SE updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Software Development & Engineering, Cybersecurity & Data Privacy · Depth: Expert, extended

Summary

A longitudinal empirical study across 182 open-source repositories, tracking contributions from May 2025 to May 2026, reveals the post-merge fate of agentic code compared to human code. While overall maintenance rates are similar, agentic contributions require a 46% higher corrective maintenance rate and a 45% higher bug-fixing rate. They also introduce 1.14 times more Semgrep security findings and 1.10 times more OSV-Scanner dependency vulnerabilities. The study found that a 10 percentage-point increase in a project's no-review rate is associated with roughly a 6% increase in agentic maintenance burden. This highlights the critical need to evaluate agentic tools for long-term security and maintainability, not just pre-merge success.

Key takeaway

For software engineering teams adopting Generative AI coding tools, recognize that pre-merge metrics like pull request volume are insufficient. Your focus must shift to post-merge code quality, as agentic code demonstrably increases corrective maintenance and introduces more security vulnerabilities. Implement rigorous, human-led code review processes, especially for agentic contributions, and advocate for tools designed to produce maintainable and secure code throughout its lifecycle, not just mergeable changes.

Key insights

Agentic code, despite similar overall maintenance, incurs significantly higher corrective burden and introduces more vulnerabilities post-merge.

Principles

• Generation-review velocity asymmetry creates post-merge costs.
• Lifecycle-spanning evaluation is crucial for agentic code quality.
• Project characteristics influence agentic maintenance burden.

Method

The study employed a longitudinal empirical analysis, tracking line-level survival, classifying commit maintenance intent, and using static analysis tools (Semgrep, OSV-Scanner, SonarQube) on 182 repositories from May 2025 to May 2026.

In practice

• Expand evaluation metrics beyond pre-merge benchmarks.
• Prioritize robust code review processes for agentic contributions.
• Design agentic tools to reduce post-merge maintenance costs.

Topics

• Agentic Coding Tools
• Software Maintenance
• Code Quality
• Security Vulnerabilities
• Code Review
• Generative AI

Code references

• post-merge-reality/post-merge-reality
• features/copilot
• logic-star-ai/insights

Best for: CTO, AI Architect, Research Scientist, AI Scientist, Machine Learning Engineer, Software Engineer

Related on AIssential

• Do These Violent Delights Have Violent Ends? Measuring the Post-Merge Fate of Agentic Code — Agentic code, despite similar overall maintenance, demands more corrective fixes and introduces more security and dependency vulnerabilities post-merge.
• Toward Instructions-as-Code: Understanding the Impact of Instruction Files on Agentic Pull Requests — Instruction files for AI agents do not guarantee improved pull request merge rates or reduced effort.
• 72% Solved. 48% Actually Merged. The Gap Nobody Was Measuring. — Automated code benchmarks significantly overstate AI agent performance compared to human mergeability.
• A Year Of Vibes — Agentic coding tools are fundamentally reshaping software engineering workflows, challenging traditional practices and human-machine relationships.
• SWE-Review: Closing the Loop on Issue Resolution with Agentic Code Review — Agentic code review closes the AI-generated PR loop by enabling adaptive, repository-grounded diagnosis and iterative revision.
• Quality and Security Signals in AI-Generated Python Refactoring Pull Requests — AI-generated Python refactoring PRs show mixed quality and security outcomes, yet achieve high developer acceptance.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.SE updates on arXiv.org.