Signal Scout · Research · September 2026

AI coding: common, fragmented, and some security improvements

A third of AI projects we reviewed are configured for coding agents; many organizations run several. Those projects show more security practices than other AI code, but AI-specific protections are rare everywhere.

Corpus 251,174 reposSeeded from 77 topics + AI package dependentsIndicator set v0.9.0Cadence Weekly

1 in 3

AI projects is set up for a coding agent

2×

as likely to show secure coding practices

AI repositories configured for a coding agent are about twice as likely as other AI repositories to have CI, tests, pinned dependencies and a security policy.

Common

Common: a third of AI projects use a coding agent

We count coding agents by the artifacts they leave in a repository: CLAUDE.md, AGENTS.md, a .cursor/ folder, a Copilot instructions file.

About one in three AI projects has one.* In our corpus that's 66,358 repositories, owned by 10,577 organizations and 40,088 individuals.

* Our corpus leans toward coding agents, because 16 of the 77 GitHub topics we search are about them. So "one in three" comes from repositories found only through AI package dependencies, with no coding-agent topic: 16,705 of 51,282, or 32.6%.

Repositories with each tool's configof 66,358

Claude Code

47,081

AGENTS.md

32,658

Cursor

6,417

GitHub Copilot

4,120

Gemini CLI

2,317

Google Antigravity

Claude Code means a CLAUDE.md file or a .claude/ folder. Repositories set up for more than one tool count once for each. AGENTS.md is a shared format that several tools read.

Newer projects use them more

Share of AI projects that call a model and carry a coding-agent file, by the half-year the repository was created:

Share with a coding-agent fileby creation half-year

This shows which projects use coding agents, not when they adopted them. An older repository may have added the file recently. Repositories created since July 2026 are left out because that period is incomplete.

Fragmented

Fragmented: organizations use several at once

42% of organizations using a coding agent use more than one.

Organizations by number of coding agents10,577 total

1 tool6,125 · 58%

2 tools3,375 · 32%

3 tools805 · 7.6%

4 tools225 · 2.1%

5 tools47 · 0.4%

1,077 organizations use three or more different coding agents. Each has its own config file and its own rules for what the agent can touch.

Filtering to organizations where the practice has spread across several repositories:

Organizations using a coding agentcount · share

All

10,577100%

In 2 or more repositories

1,86317.6%

In 2+ repositories, with 2+ different tools

1,25811.9%

In 2+ repositories, with 3+ tools

4073.8%

In those 407 organizations the practice spans several projects, and there's no single tool.

Some security improvements

Some security improvements: coding-agent repos show more of the basics

Code configured for an AI coding agent is much more likely to contain indicators of secure coding and deployment practices.

We compared AI repositories that call a model when they run: 11,948 configured for a coding agent and 46,172 without one.

Share of AI repositories with each signal With coding agentWithout

Security scanners are Bandit, pip-audit, Safety, Semgrep, detect-secrets, eslint-plugin-security, Snyk, Socket, audit-ci, njsscan, gitleaks, TruffleHog and osv-scanner. Scanner and test rows count only repositories whose dependency files we store. A security policy or CI folder can be boilerplate, so these are indicators of practice and nothing more.

Rare everywhere

Rare everywhere: AI-specific protections

Guardrails, prompt-injection filters and model scanning barely register, with or without a coding agent.

AI repos with a coding agent

0.70%

84 of 11,948 use an AI security package

AI repos without one

0.45%

210 of 46,172

Each grid shows 2,000 repositories at the measured rate. Red dots use an AI security package.

Most of what exists is privacy. Presidio, which masks personal data before it reaches a model, is in 244 repositories. Everything aimed at attacks reaches 122 combined.

Presidio (built by Microsoft)

244

Finds and masks personal data (general privacy tool, but common for prompts)

NeMo Guardrails

Enforces rules at runtime

Guardrails AI

Validates model output

LLM Guard

Filters prompt injection

garak

Scans models for vulnerabilities

PyRIT (Microsoft)

Red-teaming framework from Microsoft's AI Red Team

Giskard

Tests models

Rebuff, ModelScan, Snyk

Combined

Many teams handle this another way: commercial products that ship no package, or rules set in a gateway's config. Those are invisible to us, so read these as the open-source and self-serve layer only.

Method

Method and limits

Every figure is derived from files in public GitHub repositories. How repositories are found, classified and re-checked each week, along with known limitations, is described on the methodology page.