Why Maintainers Are Blocking AI Pull Requests on GitHub

Open-source maintainers are replacing written AI disclosure rules with automated workflow scripts that block agent-generated pull requests, or proposed code changes, before human review. Projects enforce these blocks because agent submissions jumped from 17% to over 40% of monthly volume in 2026, draining test budgets and review hours on code submitters cannot debug.

How Are Top Repositories Automating Agent Rejection?

Open-source projects now deploy automated .github/workflows scripts that programmatically block unverified agent pull requests before human review begins.

For the first half of 2026, open-source projects tried to manage AI-generated code through written requests. A July 2026 study of the top 1,000 most-starred active repositories on the SEART GitHub Search index conducted by software engineering researchers Andre Hora and Romain Robbes found that 118 projects, including TypeScript (microsoft/typescript), Deno (denoland/deno), and Biome (biomejs/biome), had added AI rules to their CONTRIBUTING.md instruction files, with 51% requiring contributors to disclose AI use and 74% requiring human-in-the-loop oversight. Repositories, the central project folders where code is stored on collaborative platforms, relied on these text policies before autonomous coding agents began submitting patches directly.

Written policies failed when autonomous coding agents began submitting pull requests directly. A July 2026 benchmark study testing 280 runs across four coding agents, OpenCode with DeepSeek-V4-Pro, Codex with GPT-5.3-Codex, Codex with GPT-5.5, and Claude Code with Claude Sonnet 4.6, found that unaided agent compliance with instruction-file disclosure rules ranged from 17% for GPT-5.3-Codex to 40% for GPT-5.5, while compliance with restraint rules instructing an agent to refuse a task stood at 0% across all four models.

As agent-initiated pull requests rose from 17% of GitHub volume in March 2026 to over 40% in September 2026, maintainers shifted from written guidelines to automated blocks. A September 2026 empirical audit of open-source AI policies and repository configuration files shows that projects now deploy three distinct gates to stop unverified agent submissions before human review begins:

• Automated closure and commit-trailer linters: Across repositories with active AI countermeasures, 48.4% now authorize closing unrefined AI pull requests without review, led by projects such as Apache Flink (apache/flink), rqlite/rqlite, and the Rust-based JavaScript toolchain Oxc (oxc-project/oxc), while workflow linters such as Commit Check’s CC014 rule and repository agent configuration files flag or reject commits carrying automated Co-Authored-By: trailers from Claude, Copilot, or Cursor. Commits are the saved logs of every file modification made to a repository.
• Legal sign-off and attribution rules: In April 2026, the Linux kernel formalized its AI patch guidelines, barring AI agents from adding a legal Developer Certificate of Origin (DCO) Signed-off-by: tag, a formal attestation certifying who wrote the code and holds the right to license it, and requiring contributors to disclose tool usage via an Assisted-by: commit trailer while a human engineer bears full legal accountability.
• Contributor vouch gates and external PR locks: In February 2026, Mitchell Hashimoto, creator of the Ghostty terminal emulator, released Vouch (mitchellh/vouch), a workflow GitHub Action that checks incoming pull requests against a flat VOUCHED.td trust file and automatically closes submissions from un-vouched accounts; by June 2026, roughly 150 repositories had adopted VOUCHED.td files alongside Ghostty’s list of more than 250 vouched contributors.

Other high-traffic projects in TypeScript, Python, and Rust have shut off public pull requests altogether. In January 2026, TypeScript canvas library tldraw began automatically closing external pull requests, followed in June 2026 by the C++ and Rust browser Ladybird halting public pull requests and the 84-project Python collective Jazzband restricting external submissions.

“For decades, code contributions have been how open source projects learned who to trust,” Andreas Kling, lead developer of Ladybird, wrote in his June 5, 2026 announcement closing public pull requests. “A substantial patch used to imply substantial effort, and that effort was a reasonable proxy for good faith. That assumption no longer holds.”

Blocking external submissions at the workflow level shifts the burden of rejection from volunteer reviewers back to automated scripts. That shift raises a baseline question: how much of GitHub’s record 2026 code volume is surviving inside production software?

Why Is GitHub’s 110 Million Agent PR Volume Creating Maintainer Triage Debt?

GitHub’s 110 million monthly agent pull requests create severe triage debt because gross submission volume measures activity inputs rather than working code accepted into production.

At GitHub Universe 2026 in San Francisco, GitHub Chief Operating Officer and Chief Marketing Officer Kyle Daigle told that open-source maintainers are building more projects and making more contributions than ever as platform users reached 225 million and annual contributions hit 13.5 billion, exceeding the combined total of 2024 and 2025. According to GitGuardian’s breakdown of the Octoverse 2026 report, annual commits rose 166%, from 12.9 billion in 2025 to 34.3 billion in 2026, while AI agents initiated 110 million pull requests in September 2026 alone, expanding from 17% of all pull requests in March 2026 to over 40% by September.

Submission volume measures activity inputs, not working code. According to Pipeline Magazine’s July 2026 analysis of open-source review queues, as AI-agent pull requests quadrupled over a six-month window in 2026, only an estimated 1 in 10 (10%) of unsolicited external agent pull requests met project standards for merging.

Even when an agent-authored pull request passes initial review and gets merged, empirical repository data shows it requires post-merge repair far more often than human code. A September 2026 study of the AIDev dataset, which tracks more than 450,000 pull requests generated by OpenAI Codex, Devin, GitHub Copilot, Cursor, and Claude Code across 60,000 open-source repositories, compared 6,774 merged agent pull requests against 5,044 merged human pull requests across 891 popular repositories with at least 500 stars.

The researchers found three post-merge defect patterns:

• Higher post-merge fix rates: Within 30 days of being merged, 22.9% of agent pull requests required a candidate follow-up fix and 4.5% required a verified bug-fix pull request.
• Elevated defect odds over human code: In the same repositories and observation window, merged agent pull requests required candidate fixes at 1.41 times the human odds and verified fixes at 1.62 times the human odds.
• Immediate breakage after merge: Half of the 30-day follow-up fixes on merged agent pull requests accumulated within the first seven days after merging, and those repair pull requests required an average of 87.4% agent-authored follow-up commits between first push and merge.

The gap between pull requests opened and code that runs cleanly explains why raw commit totals diverge from maintainer throughput. When an unmerged agent pull request stalls in review, the failure rarely appears in surface syntax checks; it surfaces in the review thread that follows.

What Happens When Human Reviewers Ask Autonomous Agents for Code Justifications?

When human reviewers question agent-generated code, submitters frequently trigger a “ghost contributor” failure mode by abandoning the pull request or pasting unverified model outputs.

Earlier waves of automated repository noise consisted mostly of one-line text edits that maintainers could spot and close in seconds. Agent-generated pull requests in 2026 present a harder triage problem.

Modern coding agents generate diffs, the line-by-line sets of code additions and deletions inside a pull request, that compile cleanly, match a project’s formatting rules, and pass automated style checks. Diffs represent the specific code changes submitted for review. In an October 2026 study of commit detection across AI coding agents and a companion empirical analysis of developer interventions in agentic pull requests, researchers documented how human reviewers must intervene to catch architectural side effects that automated syntax checks miss.

“These pull requests would have been incredible a few months prior,” Steve Ruiz, creator of tldraw, wrote in his January 17, 2026 engineering post. “They all looked good. They were formally correct. Tests and checks passed. Authors almost always ignored our PR template. Even large PRs would be abandoned, languishing because their authors had neglected to sign our CLA.”

Once a maintainer finds an architectural flaw and asks the contributor a verification question in the review thread, the ghost contributor failure mode appears. As documented in CryptoBriefing’s September 2026 investigation into GitHub repository restrictions, contributors using autonomous agents routinely submit changes that fix non-existent bugs and then abandon the pull request entirely as soon as a maintainer leaves a review comment requesting revisions. In one April 2026 case cited in the report, a single engineer running an autonomous coding agent submitted more than 130 pull requests across multiple open-source repositories in 72 hours before GitHub suspended the account.

Maintainers who still accept external contributions have responded by banning automated replies in review threads and enforcing account bans for autonomous submissions. On June 30, 2026, the Godot Engine Foundation updated its official contribution policy to enforce an automatic repository ban for autonomous AI agent use or “vibe coding” and restricted new contributors, defined as users with three or fewer merged pull requests, from using AI to generate substantial code blocks.

“LLMs can’t learn from specific feedback and thus can’t benefit from maintainers providing feedback,” the Godot Foundation wrote in its June 30, 2026 policy announcement. “AI cannot take responsibility, and we can’t trust heavy users of AI to understand their code enough to fix it. When our maintainers volunteer their time to review your issue, PR, or proposal, they do not want to talk to a machine.”

Human review time is only half of the cost imposed by abandoned pull requests. Even when a contributor walks away from a broken patch, the submission has often already consumed server capacity and security review bandwidth.

How Do Unvetted Agent Pull Requests Drain CI/CD Compute and Security Queues?

Unvetted agent pull requests drain server capacity by triggering automated build pipelines and flooding security queues with low-quality or fabricated vulnerability reports.

Open-source projects rely on continuous integration and continuous delivery (CI/CD) pipelines, automated cloud servers, called runners, that compile code and execute test suites every time a contributor opens or updates a pull request. According to GitGuardian’s Octoverse 2026 data, GitHub Actions executed 45.4 billion automated jobs during the 2026 reporting period, up more than 220%, from 14 billion jobs the previous year.

When an external coding agent enters an automated retry loop, each push triggers build queues and log storage overhead across open-source infrastructure. In GitHub Community discussions on 2026 Actions runner pricing and infrastructure, operators reported having to shorten log retention windows to avoid storage bill spikes, while April 2026 security audits of GitHub Actions workflows warned that unvetted external pull requests interacting with pull_request_target triggers risk both compute abuse and credential exposure unless locked behind maintainer workflow approval gates.

The security risk inside agent-generated commits is measurable. Across public GitHub repositories in 2026, GitGuardian’s security analysis found that commits assisted by Claude Code exposed hardcoded secrets, such as private API keys and cloud credentials, at a 3.2% rate, more than double the 1.5% baseline rate across all public commits, while GitHub Push Protection scanned only 5.8 billion of the platform’s 17.9 billion total code pushes.

A parallel flood has hit open-source vulnerability queues. On January 31, 2026, Daniel Stenberg, creator and lead maintainer of curl, the command-line data transfer tool installed on more than 20 billion devices, terminated the project’s six-year bug bounty program via curl pull request #20312 after paying out over $100,000 across 87 confirmed vulnerabilities since April 2019.

As documented in Bugcrowd’s February 2026 post-mortem and Stingrai’s July 2026 triage study, curl’s confirmed vulnerability rate fell from over 15% of submissions before 2025 to below 5% in 2025, fewer than 1 in 20 reports, before hitting 0 confirmed vulnerabilities out of 20 submissions in the first 21 days of January 2026, including 7 fabricated reports arriving in a single 16-hour window.

“The never-ending slop submissions take a serious mental toll to manage and sometimes also a long time to debunk,” Stenberg wrote in his January 26, 2026 announcement ending the curl bug bounty. “Time and energy that is completely wasted while also hampering our will to live.”

The breakdown in security triage spread across the wider open-source ecosystem in mid-2026. According to the Open Source Security Foundation (OpenSSF) 2026 vulnerability handling guide, HackerOne paused submissions to its Internet Bug Bounty for open-source software, stating that “the balance between findings and remediation capacity in open source has substantively shifted”, while GitHub raised its own bug bounty intake rules in May 2026 to require a working proof of concept, and curl paused all vulnerability reports for the entire month of July 2026 to give its maintainers relief.

Locking down test servers and security trackers protects project infrastructure, but it also slows down legitimate first-time contributors. That friction has opened a wider debate over who benefits from automated coding tools and who pays for their supervision.

Where Do AI-Assisted Contributions Succeed Under Human Supervision?

AI-assisted contributions succeed when human developers scope, test, and take direct responsibility for patches rather than dispatching autonomous agents without oversight.

GitHub leadership maintains that the surge in agent-initiated pull requests reflects an industry-wide shift from writing syntax to verifying software behavior. In his October 28, 2026 interview with The Indian Express, Daigle compared the adoption of coding agents to earlier transitions from punch cards to compilers and dynamic languages, noting that India alone added 9.34 million developers on GitHub over the past year to reach 31 million developers as non-technical builders enter software development.

“In some ways, building software has never been the hardest part,” Daigle said. “The real challenges have been deciding what to build and knowing whether you have built it correctly. I think we will focus much more on how much capability and context we can give to a set of models to verify that what we are building actually works.”

To give maintainers direct relief from unvetted submissions, GitHub rolled out a series of repository-level access controls across 2026. On February 13, 2026, GitHub shipped new repository settings for configuring pull request access, allowing maintainers for the first time in 18 years to disable pull requests entirely or restrict pull request creation to existing collaborators, followed by concurrent pull-request rate limits in June 2026 and expanded external contributor caps on August 27, 2026 that limit how many open pull requests any single external user can maintain at once.

Many open-source leaders argue that blanket bans on AI assistance are unnecessary when contributors validate their own patches before submitting. In the July 2026 SEART study of repository AI guidelines, 51% (60 of 118) of projects with formal AI policies explicitly welcomed AI-assisted code provided a human engineer scoped and tested the work.

“AI-assisted contributions are welcome, but they must be coordinated, scoped, and verified to keep review load manageable,” the maintainers of Hugging Face Transformers (huggingface/transformers) stated in their repository contribution policy cited in the study.

Even among maintainers who enforce automated blocks against unsolicited agent pull requests, few reject AI coding tools inside their own workflows. Their rules function as accountability gates, not ideological bans on machine assistance.

In the Linux kernel, creator Linus Torvalds and stable maintainer Greg Kroah-Hartman approved AI-assisted patches in April 2026 under the rule that a human developer signs the Developer Certificate of Origin and answers for any regressions. Similarly, after curl removed financial payouts and returned to uncompensated HackerOne reporting in March 2026, Stenberg reported in OpenSSF’s 2026 case study that while nearly all incoming vulnerability reports still used AI tools, the confirmed vulnerability rate rebounded from under 5% back to between 15% and 16%, and pointed to security researcher Joshua Rogers using the AI scanner ZeroPath with manual verification to identify roughly 50 genuine bugs in curl.

“This is what an AI can do when wielded by a competent human,” Stenberg said of the validated findings in Bugcrowd’s February 2026 report.

As GitHub expands multi-model orchestration through Copilot Fusion, the divide in open source is no longer between developers who use AI and developers who do not. The unresolved question for 2027 is whether platforms that profit from cloud-agent compute minutes will require automated tools to verify architectural fit and human comprehension before a pull request can be opened, or leave unpaid maintainers to build higher walls around public code.

Frequently Asked Questions

Why are open-source maintainers blocking AI-generated pull requests? Open-source maintainers are blocking AI-generated pull requests because agent submissions surged past 40% of monthly volume in 2026, creating uncompensated triage debt. Autonomous agents frequently submit syntactically plausible code that fails architectural review, consuming thousands of hours of unpaid volunteer review time and draining continuous integration (CI/CD) server test budgets.

What automated tools do repositories use to stop AI pull requests? Repositories deploy workflow scripts inside .github/workflows configuration files to stop unverified submissions. These include commit-trailer linters that reject automated Co-Authored-By: metadata tags, legal sign-off checks that enforce human Developer Certificate of Origin attribution, and contributor vouch files like Vouch (mitchellh/vouch) that automatically close PRs from unvouched accounts.

How many agent pull requests actually get merged into open-source projects? According to analysis by Pipeline Magazine and studies tracking review queues in 2026, only an estimated 1 in 10 (10%) of unsolicited external agent pull requests meet project standards for merging. Furthermore, research on the AIDev dataset shows that merged agent pull requests require post-implant follow-up fixes at 1.41 times the human rate within 30 days.

Why did curl terminate its bug bounty program in January 2026? Curl lead maintainer Daniel Stenberg terminated the project’s six-year bug bounty program on January 31, 2026, after a wave of fabricated, AI-generated vulnerability reports overwhelmed the security team. The project’s confirmed vulnerability rate dropped below 5% in 2025 before hitting 0 confirmed reports out of 20 submissions in early January 2026.

Do open-source maintainers ban all AI coding tools? No. Most maintainers who block unsolicited external agent pull requests actively use scoped coding agents inside their own workflows. Projects welcome AI assistance provided a human engineer understands the system architecture, verifies every line locally, and takes legal responsibility under Developer Certificate of Origin sign-offs.