DevOps / SRE / Platform · 12.08.2026, 14:40 UTC
Coding agents ignore open source contribution guidelines, researchers find.
| Schweregrad | info |
|---|---|
| Kategorie | DevOps / SRE / Platform |
| Quelle | The New Stack ↗ |
| Veröffentlicht | 12.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
Autonomous coding agents ignore contribution rules in open source communities, finds a new study from researchers at Peking University.
That’s not great news for maintainers who are fast becoming overrun by sloppy AI-generated contributions. If coding agents aren’t even following contributor guidelines, then a simple rewrite isn’t going to do much good for reining in agent activity.
The study experiments on four frontier models, curating 106 issues from 49 repositories containing AI contribution rules and then judging each run against the repository’s rules. Researchers measured four forms of compliance: 1) refusal to contribute; 2) truthful disclosure of its assistance; 3) clearing verification gates; 4) escalation to humans.
How’d the agents perform? Not well. As the researchers wrote, “today’s agents almost never proactively retrieve the contribution rules.”
With some prodding via reminder prompts, quoted policies, and verifier feedback, the agents did improve on disclosure and verification — but they never refused to contribute to AI-banned repositories.
Christian-Alexandru Staicu, senior security researcher, Endor Labs, describes the conflict as an “ethical dilemma” for the agent:
“Imagine that an agent is asked to ‘fix an annoying bug and make a pull request’ to a project that has the clause listed in Figure 1 of the study, ‘This project does not accept pull requests that are fully or predominantly AI-generated,’” Staicu tells The New Stack. “Now the agent is in an ethical dilemma. Should they comply with the user’s request or with the policy?”
Agents …