Do These Violent Delights Have Violent Ends? Measuring the Post-Merge Fate of Agentic Code

Jul 16, 2026

Upload by Aria

Agentic coding tools increasingly create autonomous, repository-level changes, yet their post-merge lifecycle remains largely unknown. A longitudinal empirical study analyzes agentic versus human contributions across 182 repositories, tracking post-merge outcomes over time, characterizing subsequent modification intent, and measuring defects and vulnerabilities. Overall maintenance rates are similar, but agentic contributions demand higher corrective maintenance and introduce more security weaknesses and dependency vulnerabilities. Maintenance burden also correlates with repository characteristics, including a higher no-review rate leading to increased agentic burden.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages13

Reading Time33 min

Introduction

Research gap and motivation

Limitations of tool-centric evaluation

Study overview and research questions

Data and methodology

Do These Violent Delights Have Violent Ends? Measuring the Post-Merge Fate of Agentic Code Chunqiu Steven Xia University of Illinois Urbana-Champaign Urbana, IL, USA [chunqiu2@illinois.edu](chunqiu2@illinois.edu) Courtney Miller George Washington University Washington, DC, USA [courtney.miller@gwu.edu](courtney.miller@gwu.edu) arXiv :2607 .09902v 1 [ cs . SE] 10 Jul 2026 Abstract—Agentic coding tools are increasingly used to make autonomous repository-level changes to real-world projects. Prior work has largely evaluated these contributions at the premerge stage, through outcomes such as pull request acceptance and review effort. Far less is known about what happens to agentic code post-merge. Yet merge success alone does not reveal whether a contribution will remain stable or require bug fixes and other corrective maintenance downstream. We conduct a longitudinal empirical analysis of agentic and human contributions across 182 repositories, tracking their post-merge fate overtime, characterizing the intent of subsequent modifications, and analyzing the defects and vulnerabilities they introduce. While the overall maintenance rates are similar, agentic contributions require significantly higher rates of corrective maintenance and introduce more security weaknesses and dependency vulnerabilities. We also find statistically significant evidence that agentic maintenance burden is associated with repository characteristics. In particular, each 10 percentage-point increase in a project’sno-review rate is associated with roughly a 6% increase in agentic maintenance burden on average. As coding agents become pervasive in software development, our findings highlight the need to evaluate and design agentic tools not only to produce mergeable changes, but to produce contributions that remain secure and maintainable. I. INTRODUCTION The case for adopting Generative AI (GenAI) agentic coding tools is made almost entirely based on tool-centric metrics: how much the tools produce and what their output looks like at merge. Microsoft reports GenAI produces close to 30% of its codebase [1], Meta aims for agentic coding tools to handle half of its development by late 2026 [2], and Google reports that 75% of their new code is produced by GenAI [3] . In a recent survey of more than 200 technology decision-makers, 67% claim that agentic coding tools write over half of their organization’s weekly code [4] . These are the numbers used to justify adoption. They say little about that code’s sustainability, reliability, security, or maintainability in the long term postmerge. What happens to agentic code once it becomes part of the software system remains largely unstudied. This tool-centric framing has revived evaluation metrics that are weak proxies for the quality of what actually ships: lines of code written, number of merged pull requests, percentage of code written by GenAI, and even “tokenmaxxing" (amount of vendor tokens spent) [5] . Such metrics make for impressive growth graphs, but they reveal little about how that change behaves as it evolves with the project. | Cumulative Incidence | 5% 4% 3% 2% 1% 0% | 4.6% ~~ ~~ 4.0% 3.5% 3.3% 2.6% 2.9% 2. 1% 1.6% Agentic Human | | --- | --- | --- | | | | 0 100 200 300 Days Since Merge | Fig. 1: CIF for corrective terminations. Dots represent time points of 10/30/90/180 days since merge. In fields like medicine and aviation, performance claims about tools that carry safety risks are expected to be substantiated before the tool is relied on. Medical devices like surgical robots must clear thorough regulatory review processes for safety and effectiveness before they can get FDA approval for use. Agentic coding tools face no comparable bar before bold sweeping promises are made and they are deployed to write code for banks, hospitals, and other critical systems. And whatever scrutiny the output receives largely occurs

FAQs

What gap does the study address about agentic coding tools?

The study targets the lack of evidence on what happens to agentic code after merge, beyond pre-merge outcomes such as pull request acceptance and review effort.

How do post-merge maintenance rates compare between agentic and human contributions?

Overall maintenance rates are similar, but agentic contributions require significantly higher corrective maintenance than human code.

What security-related findings are reported for agentic contributions?

Agentic contributions introduce more security weaknesses and dependency vulnerabilities, indicating increased downstream risks even when merge succeeds.

Which repository characteristic is associated with higher agentic maintenance burden?

A project’s no-review rate is linked to greater agentic maintenance burden; each 10 percentage-point increase in no-review rate corresponds to roughly a 6% increase on average.

Jul 16, 2026

Upload by Aria