Dev Tools · 1h ago
Study: 0 of 2,204 AI-agent PRs declared machine-readable scope
A scan of 2,204 merged AI-agent pull requests on GitHub found that none included a machine-readable scope declaration, making automated verification impossible. 7% of PRs had boundary violations, with workflow-touching PRs showing elevated risk: 12.9% escalated permissions and 17.5% introduced unpinned actions. The author proposes a lightweight PR-body contract to enable deterministic scope checking.
Meridian48 take
The finding that zero agent PRs declare scope is a stark indictment of current practices, but the proposed fix is pragmatic and vendor-neutral—worth watching if it gains traction.
Read the full reporting
What 2,204 merged AI-agent PRs actually touched (0 declared their scope) →
DEV Community
ai-agentspull-requests