A 25,264-PR Study Just Confirmed It: AI Coding Agents Are Solo Tools, and Small Teams Push Them Hardest

In mid-2026, most of the industry conversation about AI coding agents is about scale — bigger context windows, longer autonomous runs, more agents working in parallel. A new empirical study out of Rochester Institute of Technology, picked up by Help Net Security on July 22, 2026, points in the opposite direction. Researchers Maliha Noushin Raida and Daqing Hou pulled 25,264 pull requests opened by GitHub Copilot, OpenAI Codex, and Claude Code from public repositories with at least 100 stars, covering activity between May and July 2025, and sorted each one by who actually reviewed and merged it. The result is a much more mundane picture than the multi-agent hype suggests: in practice, agentic coding still runs through a single human gatekeeper, and it's small teams — not enterprises — putting it to the heaviest use.

The Default Workflow Is One Developer, Not a Committee

The study's central number is 78.9%: nearly four out of five agentic pull requests in the dataset were reviewed and merged by exactly one person, who reads the agent's diff, fixes what needs fixing, and hits merge. There's no separate review board, no second approver, no distinct QA pass — the entire verification step rests on whichever engineer opened the task. Even among the busiest small repositories, defined as those with more than 30 agentic pull requests, Raida found the single-reviewer pattern held as the majority workflow, not an artifact of small sample sizes.

Small Teams Are the Power Users, by a Wide Margin

The second finding reframes who's actually driving agentic coding adoption. Repositories maintained by one to five contributors averaged 50.2 agentic pull requests each — several times what medium-sized and large teams generated over the same window. The intuitive assumption, that AI coding agents scale best inside large engineering organizations with dedicated platform teams and review infrastructure, doesn't hold up in the data. It's solo maintainers and tiny teams, without the bandwidth for a second reviewer, who are leaning on agents the hardest.

Merge Rates Don't Care How Many People Are Watching

Perhaps the most counterintuitive result: adding more reviewers barely changes the outcome. Single-reviewer pull requests merged at 81.2%, multi-reviewer or multi-committer pull requests merged at 80.3% — a gap so small it undercuts the assumption that more eyes on an agent's output produces meaningfully more scrutiny or fewer merges. Whatever is deciding whether an agentic PR gets merged, it isn't primarily the size of the review panel.

Solo Maintainers Ship Features; Teams Fix Bugs

The study also found a split in what agents get asked to do depending on team structure. In single-reviewer workflows, the most common pull request type was feature-related — solo developers pointing their agents at new functionality. In multi-human workflows, fix-related pull requests were more common, suggesting teams reach for agents to clear backlogs of smaller, well-scoped bugs rather than hand them net-new feature work outright.

Why a Study About Boring PR Metadata Actually Matters

None of these numbers involve a jailbreak, a sandbox escape, or a security incident — which is exactly why the finding is worth taking seriously. Most of the industry's safety and governance conversation around agentic coding assumes multi-layered review: an agent proposes, a human checks, sometimes a second human or automated gate checks again. This data says that in the wild, that layered model is the exception, not the norm. The real safety boundary for the majority of agentic code shipped today is a single engineer's judgment on a single pass — and that engineer is disproportionately likely to be working alone or on a team of five or fewer.

What It Means for Teams Running AI Coding Agents Today

For engineering leaders, the practical takeaway isn't to mandate a second reviewer on every agentic PR — the data shows that wouldn't move merge outcomes much anyway. It's to invest in making the one reviewer who does exist as effective as possible: clearer agent-authored PR descriptions, static analysis and test coverage that catches what a rushed single pass might miss, and treating that lone reviewer's judgment as the actual production safety net it already is. For solo developers and small teams, the study is a validation that current agentic workflows are already built around their scale, not against it.

Bottom Line

A 25,264-pull-request study of GitHub Copilot, OpenAI Codex, and Claude Code activity found that agentic coding in practice looks less like a multi-agent assembly line and more like a solo developer with a fast, tireless collaborator: one reviewer approves almost 80% of agentic PRs, merge rates barely shift with more reviewers, and small teams of one to five people are by far the heaviest users. The lesson for anyone deploying these tools isn't to add more process — it's to make sure the single human in the loop has what they need to catch what matters, because for most agentic code shipped today, they're the only check there is.