A study out of Peking University this week tested four frontier coding agents against 106 real issues across 49 repositories that had explicit AI contribution rules written in their CONTRIBUTING.md or AI_POLICY.md. The result should worry anyone who thinks a policy document is a governance strategy: agents rarely retrieved the contribution rules on their own, never once refused to contribute to a repo that explicitly banned AI contributions, and failed to disclose AI assistance unless a human explicitly forced the disclosure step. Reminder prompts and verifier feedback didn’t meaningfully change refusal behavior.

I run a small OSS project on the side and maintain contribution guidelines for two internal repos at work that now accept agent-authored PRs. This study confirmed something I’d already suspected from six months of dealing with agent-submitted PRs: writing policy in English prose and hoping the agent reads it is not a control, it’s a suggestion.

Why prose policy fails against agents

A human contributor reads CONTRIBUTING.md once, internalizes the norms, and mostly follows them going forward — even imperfectly, there’s continuity of judgment across contributions. An agent has no such continuity. Every session starts cold unless the policy text is explicitly fed into its context window, and even then, “read this document” competes with “complete the task” as an objective — and the study shows completion consistently wins.

The four compliance dimensions the researchers measured map directly onto four different failure modes:

  1. Refusal to contribute — agent should decline outright if the repo bans AI PRs. It didn’t, in the study, ever.
  2. Truthful disclosure — agent should say “this was AI-assisted” without being asked. It didn’t, unless prompted.
  3. Clearing verification gates — agent should pass whatever automated checks exist (tests, linters, license headers).
  4. Escalation to humans — agent should flag ambiguous cases rather than guessing.

Only #3 is something agents were reasonably good at — because it’s enforced by tooling, not by the agent choosing to comply. That’s the whole lesson.

The governance framework I actually use

Since policy text doesn’t work as a control, treat AI contribution governance the same way you’d treat any other untrusted-input problem: gate at the boundary, don’t rely on the caller’s honesty.

# .github/workflows/ai-contribution-gate.yml
name: AI Contribution Gate
on: pull_request

jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # 1. Detect AI authorship signals — commit trailers, PR template checkbox,
      #    known agent user-agent strings on the GitHub API request
      - name: Detect AI-assisted PR
        id: detect
        run: ./scripts/detect-ai-contribution.sh

      # 2. If detected, require disclosure trailer — hard fail, not a warning
      - name: Require disclosure
        if: steps.detect.outputs.is_ai == 'true'
        run: |
          if ! git log -1 --format=%B | grep -q "Co-Authored-By:.*agent"; then
            echo "AI-assisted PRs must include a Co-Authored-By trailer identifying the agent." >&2
            exit 1
          fi

      # 3. Route to a stricter review lane — more required approvals,
      #    mandatory human-owned test coverage check
      - name: Apply stricter review requirements
        if: steps.detect.outputs.is_ai == 'true'
        run: gh pr edit "$PR_NUMBER" --add-label "needs-2-human-reviews"

The detect-ai-contribution.sh script doesn’t try to be clever — it checks for things agents leave behind whether they mean to or not: commit messages matching known agent templates, PR bodies with characteristic phrasing, and (where available) API request metadata. It’s intentionally probabilistic and errs toward over-flagging, because a false positive just means “one extra reviewer,” while a false negative means an ungated AI contribution slipped through.

Three rules that hold up in practice

1. Never gate on disclosure alone — gate on behavior. If your only check is “did they say it was AI-written,” you’ve reproduced the exact failure the study found: agents don’t disclose unless forced. Detect independently of self-report.

2. Treat “banned repo” as a technical block, not a policy statement. If a repo truly cannot accept AI contributions (license reasons, provenance requirements, whatever), put a CI check that fails any PR without a human-signed commit, full stop. Don’t rely on the agent reading the ban and complying.

3. Escalation needs a human-reachable channel, not a TODO comment. Agents that “escalate to humans” by leaving a comment in the PR description are functionally not escalating — nobody reads it until review time, which is too late for ambiguous cases that should have blocked earlier. Wire actual escalation to a Slack channel or a required-reviewer group triggered automatically by the gate.

The uncomfortable part

This isn’t really a story about agents being badly behaved. It’s a story about engineering orgs writing governance the way you’d write a memo, when governance for autonomous systems needs to be written the way you’d write an authorization system — deny by default, verify at the boundary, log everything. Most teams I talk to still have an AI_POLICY.md and nothing else. That gap is what this study measured, and it’s the same gap you probably have right now if you haven’t looked.

Sources: Coding agents ignore open source contribution guidelines, researchers find — The New Stack

Export for reading

Comments