What happened
Nadella said AI agents now author more than 40% of pull requests opened on GitHub, a figure Crypto Briefing surfaced on Tuesday evening. The claim covers PRs opened, not merged, and bundles Copilot's autonomous agent features together with third-party coding agents that push to GitHub repos through the standard API. Microsoft, which owns GitHub, hasn't published a breakdown by repo type, language, or merge rate alongside the headline number.
For context, GitHub's own 2024 Octoverse report put total annual PR volume well into the hundreds of millions across public and private repos, so a 40% share implies tens of millions of agent-opened PRs on a run-rate basis. Nadella didn't give the measurement window. He also didn't separate human-reviewed-and-sent agent drafts from fully autonomous agent sessions, a distinction that matters for every reviewer downstream.
Why it matters
GitHub isn't just where web2 developers work. It's where Bitcoin Core, go-ethereum, Solana Labs, Uniswap, and most of DeFi's audited contract code live, review, and ship. A 40% agent-authored PR share means crypto maintainers are already receiving autonomous diffs at scale, whether they've opted in or not.
That reframes two long-standing problems. Supply-chain risk gets worse: a malicious or hallucinated agent-authored dependency bump can slide into a protocol repo faster than a human reviewer can read it. And audit economics tilt further: if the code is cheap to write but the review cost per line is unchanged, the bottleneck moves to firms like Trail of Bits, OpenZeppelin, and Spearbit, not to the devs shipping the feature.
The headline is bullish for throughput. The flow picture for security review isn't.
