GitHub Octoverse 2026 has one number that will end up in every engineering all-hands this quarter: AI agents started more than 40% of pull requests on GitHub in September 2026, up from 17% in March. That is roughly 110 million agent-started pull requests in one month.
The rest of the report is just as lopsided. Developers pushed code 17.9 billion times in the twelve months to September 30, more than 2024 and 2025 combined, and commits more than tripled to 34.3 billion.
I went through GitHub’s Octoverse 2026 post line by line, including the methodology notes most coverage skips. Below are the statistics that matter if you write or review code for a living, what they actually measure, and where I think they mislead.
GitHub Octoverse 2026 Key Statistics
Here is the year in four rows. GitHub recalculated 2024 and 2025 with this year’s definitions, so these will not match older reports.
| Metric | 2024 | 2025 | 2026 |
|---|---|---|---|
| Pushes | 5.2B | 6.7B | 17.9B |
| Commits | 10.0B | 12.9B | 34.3B |
| Merged pull requests | 402M | 538M | 1.3B |
| GitHub Actions jobs | 8.0B | 14.0B | 45.4B |
(Source: GitHub Octoverse 2026, October 28, 2026. Public and private repositories, October to September years.)
A few more numbers that stood out:
- More than 225 million developers are now on GitHub. The US has 38.3 million and India 32.0 million, and each added more than 10 million in the year.
- 1.3 billion merged pull requests works out to 3.5 million a day.
- Actions ran 1,440 jobs per second, 124 million a day.
- From June onward, about 55% of all commits came from brand-new repositories.
- All four activity curves accelerated after June. Measured against September 2025, commits were up about 6x by September 2026.
GitHub ties the growth to developers building with agents, but it does not claim the June inflection has a single cause, and neither will I. The timing still matches the year cloud and background agents went mainstream.
The short version: activity on GitHub roughly tripled in a year, and most of the new volume arrived in the second half.
AI Agent Pull Requests: The 40% Figure Explained
More than 40% of September 2026 pull requests started with an agent’s first draft. The trend line runs from 17% in March, and September’s 110 million agent-started PRs were about six times March’s volume.
Before you quote it, read the definition. GitHub says the agent signal is “a floor”: it counts only agents it can detect, and an agent-started PR means the first draft came from an agent, not that no human touched it. A developer who has Claude Code write a branch and then opens the PR by hand may not register at all.
So the real share is probably higher. That is the opposite of the usual caveat about vendor statistics.
GitHub also compared agent PRs with everything else:
| Pull request type | Touches multiple files | Merged within two weeks |
|---|---|---|
| Agent-started | 87% | 90% (Sep), up from 83% (Feb) |
| No detected agent | 79% | ~86% |
(Source: GitHub Octoverse 2026)
This is the finding that surprised me most. Agent PRs are broader, touching multiple files more often, and they now merge at a higher rate than PRs without an agent. Six months ago they lagged.
I would not read that as “agent code is better”. The more likely explanation is that teams have learned which tasks to hand to agents, and agents get the well-scoped work that merges cleanly. Anthropic’s own internal study, How employment is changing at Anthropic, found no difference in the rate at which agent-written and human-written lines were later removed or reverted, which points the same way: no quality penalty, but no evidence of a bonus either.
Agents are now a first-class source of pull requests, and the merge data says reviewers are accepting their work at least as often as human work.
Where AI Agents Are Used Most: Languages and Industries
TypeScript is the most used language on GitHub by contributors, ahead of Python and JavaScript. It also has the highest share of merged PRs with AI involvement.
| Language | AI involvement in merged PRs | YoY growth in that share |
|---|---|---|
| TypeScript | 44.1% | 134% |
| Python | 41.1% | 118% |
| Rust | 40.4% | 162% |
| Java | 21.2% | 30% |
(Source: GitHub Octoverse 2026)
TypeScript added 3.62 million monthly contributors in the year and Python 3.23 million. Rust doubled its contributor count, the fastest percentage growth among top languages, and its AI share is growing fastest of all.
The pattern makes sense to me. Typed languages give an agent a compiler that rejects bad output before a human sees it, and TypeScript and Rust both have strong type checkers. Repos created in 2026 with an agent signal picked TypeScript as their primary language 35% of the time, against 24% for repos without one. If you are starting a project you expect agents to work in, that is a meaningful data point, and it matches what we wrote about designing codebases for AI agents.
Java sits at the bottom with 21.2%, and C#, Java and C++ cluster between about 21% and 34%. Enterprise codebases in those languages tend to be older, larger and more locked down, which is exactly where agents get the least room.
The industry split is stranger. In administrative services, mining, health care and agriculture, more than 4 in 10 repos mention AI, but fewer than 3% have agent-opened PRs. Construction has the highest agent PR share of any sector at about 9%. GitHub classified repos with an embedding model, so treat the industry numbers as estimates.
Agents cluster in typed, modern stacks, and talking about AI in a README is not the same as letting an agent open PRs.
The Agent Configuration File Effect
One line in Octoverse 2026 deserves more attention than it got. Among repositories created in 2026, those with an agent configuration file logged eight times as many commits as those without one.
GitHub does not name the files it counted. In practice that means things like AGENTS.md, CLAUDE.md or Copilot instruction files.
The 8x figure is a correlation. Repos with an agent config file are, almost by definition, repos where someone is actively running agents, and agents commit a lot. A config file will not make your repo 8x more productive on its own.
What it does show is that serious agent use and explicit instructions travel together. The teams getting the most volume out of agents are the ones that wrote down how the repo works. If you have not done that yet, our guide to building Claude Code subagents covers the same principle at a smaller scale.
Writing a good agent config file is the cheapest thing on this list, and the busiest repos on GitHub have one.
Copilot Model Choice: Nobody Uses Just One Model
The Copilot data reads like a case for the model router GitHub shipped the same day.
- 61% of Copilot users who pick a model manually used more than one model in September, up from 50% four months earlier.
- Paid plans had 47 distinct models in use in September, up from 29 in May, and no single model took more than 25% of requests.
- Per 100 developer-selected requests, 38 went to general-purpose models, 37 to deep reasoning models and 25 to fast models.
- 63% of paying Copilot developers used auto model selection at least once in September.
- 55% of monthly active Copilot users now use agentic features, up from 35% a year earlier. Copilot cloud agent usage grew 230% year over year.
GitHub notes that the model data shows observed use, not quality, and excludes auto selection and bring-your-own-key requests. Even so, the 25% ceiling is striking. There is no default model anymore, which is exactly the argument behind GitHub Copilot Fusion, the router that picks models per prompt.
It also helps explain why a new frontier model like Gemini 4 Carbon can top a leaderboard and still change little in practice. When usage is spread across 47 models and an auto-router, a one-point benchmark lead does not move much traffic on its own.
Octoverse 2026 and Security: The Gap in the Numbers
GitHub reports that push protection ran 5.8 billion scans this year, nearly 4x the 2025 pace, and that AI-assisted code review and GitHub Advanced Security each grew more than 90%. Dependabot merged more than 30 million PRs.
GitGuardian’s read of the report puts those numbers next to the 17.9 billion pushes and draws a blunt conclusion: most pushes went unscanned. That is GitGuardian’s inference from two separate totals, not a GitHub statement, and a security vendor has an obvious interest in making it. It is still worth thinking about.
GitGuardian adds its own data. Its State of Secrets Sprawl 2026 report found 28.65 million new secrets in public GitHub commits in 2025, and public commits co-authored by Claude Code contained a secret 3.2% of the time against a 1.5% baseline. More agent PRs means more code shipped faster, and the secrets problem scales with it. We covered the practical defences in our guide to AI coding agent supply chain attacks.
Review is the other pressure point. Stacked PRs, which GitHub launched as a preview on July 30, reached more than 264,000 developers by September. That is a review-side feature, and its fast uptake suggests reviewers are feeling the volume.
Agent volume has outgrown human review capacity, and the security tooling is growing fast but not yet as fast as the code.
What Octoverse 2026 Means for Developers
The Octoverse numbers line up with what developers say about themselves. The 2026 Stack Overflow Developer Survey found 73% of respondents use coding assistants or agents daily, and Claude Code (66%) and GitHub Copilot (59%) lead among coding agents. Only 48% trust AI output when they can easily validate it. Anthropic’s internal study found about 80% of interactive agent session time is spent idle, waiting for a human.
Put those together and the bottleneck is obvious. Agents write the first draft of four in ten PRs, and humans still validate, review and merge all of them.
Here is what I would take from the report:
- Invest in review, not just generation. If 40% of your PRs start with an agent, your review process is now the throughput limit. Our AI code review tools comparison is a reasonable starting point.
- Write the agent config file. The 8x correlation is not causation, but the repos with the most agent output all have explicit instructions.
- Prefer typed stacks for new agent-heavy projects. TypeScript and Rust lead on AI involvement for a reason.
- Turn on secret scanning everywhere. More code per day means more chances to leak a key.
- Stop assuming one model. Your team is probably already using several, whether you planned it or not.
For the career angle, these numbers sit alongside the hiring data in our analysis of whether AI will replace developers. Octoverse shows more people building, not fewer: 225 million developers, with the US and India adding more than 10 million each. What changed is how much of the first draft they write themselves.
