{"id":"https://openalex.org/W7119067352","doi":"https://doi.org/10.48550/arxiv.2601.00477","title":"Security in the Age of AI Teammates: An Empirical Study of Agentic Pull Requests on GitHub","display_name":"Security in the Age of AI Teammates: An Empirical Study of Agentic Pull Requests on GitHub","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7119067352","doi":"https://doi.org/10.48550/arxiv.2601.00477"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2601.00477","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2601.00477","pdf_url":"https://arxiv.org/pdf/2601.00477","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2601.00477","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5083926745","display_name":"Mohammed Latif Siddiq","orcid":"https://orcid.org/0000-0002-7984-3611","observed_orcids":["https://orcid.org/0000-0002-7984-3611"]},"institutions":[{"id":"https://openalex.org/I107639228","display_name":"University of Notre Dame","ror":"https://ror.org/00mkhxb43","country_code":"US","type":"education","lineage":["https://openalex.org/I107639228"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Siddiq, Mohammed Latif","raw_affiliation_strings":["Department of Computer Science and Engineering , University of Notre Dame , Notre Dame , 46556 , IN , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering , University of Notre Dame , Notre Dame , 46556 , IN , USA","institution_ids":["https://openalex.org/I107639228"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121823423","display_name":"Xinye Zhao","orcid":"https://orcid.org/0000-0001-5507-4814","observed_orcids":["https://orcid.org/0000-0001-5507-4814"]},"institutions":[{"id":"https://openalex.org/I107639228","display_name":"University of Notre Dame","ror":"https://ror.org/00mkhxb43","country_code":"US","type":"education","lineage":["https://openalex.org/I107639228"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhao, Xinye","raw_affiliation_strings":["Department of Computer Science and Engineering , University of Notre Dame , Notre Dame , 46556 , IN , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering , University of Notre Dame , Notre Dame , 46556 , IN , USA","institution_ids":["https://openalex.org/I107639228"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026347831","display_name":"Vin\u00edcius Carvalho Lopes","orcid":"https://orcid.org/0000-0002-7980-8488","observed_orcids":["https://orcid.org/0000-0002-7980-8488"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lopes, Vinicius Carvalho","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5003772299","display_name":"Beatrice Casey","orcid":"https://orcid.org/0009-0001-0097-2120","observed_orcids":["https://orcid.org/0009-0001-0097-2120"]},"institutions":[{"id":"https://openalex.org/I107639228","display_name":"University of Notre Dame","ror":"https://ror.org/00mkhxb43","country_code":"US","type":"education","lineage":["https://openalex.org/I107639228"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Casey, Beatrice","raw_affiliation_strings":["Department of Computer Science and Engineering , University of Notre Dame , Notre Dame , 46556 , IN , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering , University of Notre Dame , Notre Dame , 46556 , IN , USA","institution_ids":["https://openalex.org/I107639228"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5043541139","display_name":"Joanna C. S. Santos","orcid":"https://orcid.org/0000-0001-8743-2516","observed_orcids":["https://orcid.org/0000-0001-8743-2516"]},"institutions":[{"id":"https://openalex.org/I107639228","display_name":"University of Notre Dame","ror":"https://ror.org/00mkhxb43","country_code":"US","type":"education","lineage":["https://openalex.org/I107639228"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Santos, Joanna C. S.","raw_affiliation_strings":["Department of Computer Science and Engineering , University of Notre Dame , Notre Dame , 46556 , IN , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering , University of Notre Dame , Notre Dame , 46556 , IN , USA","institution_ids":["https://openalex.org/I107639228"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":11,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9771000146865845,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9771000146865845,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.013799999840557575,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.004699999932199717,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/autonomous-coding-agents","display_name":"autonomous coding agents","score":0.9089999794960022},{"id":"https://openalex.org/keywords/software-security","display_name":"software security","score":0.8220000267028809},{"id":"https://openalex.org/keywords/pull-request-review","display_name":"pull request review","score":0.7450000047683716},{"id":"https://openalex.org/keywords/security-hardening","display_name":"security hardening","score":0.7900000214576721},{"id":"https://openalex.org/keywords/vulnerability-remediation","display_name":"vulnerability remediation","score":0.625},{"id":"https://openalex.org/keywords/aidev-dataset","display_name":"AIDev dataset","score":0.7289999723434448},{"id":"https://openalex.org/keywords/github","display_name":"GitHub","score":0.7239999771118164}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7340999841690063},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.614799976348877},{"id":"https://openalex.org/C179518139","wikidata":"https://www.wikidata.org/wiki/Q5140297","display_name":"Coding (social sciences)","level":2,"score":0.5408999919891357},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.5351999998092651},{"id":"https://openalex.org/C51929080","wikidata":"https://www.wikidata.org/wiki/Q2425187","display_name":"Codebase","level":3,"score":0.48100000619888306},{"id":"https://openalex.org/C197129107","wikidata":"https://www.wikidata.org/wiki/Q1921621","display_name":"Merge (version control)","level":2,"score":0.4683000147342682},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.4499000012874603},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.43540000915527344},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.3862999975681305},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.32739999890327454},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3179999887943268},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.311599999666214},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.29750001430511475},{"id":"https://openalex.org/C99613125","wikidata":"https://www.wikidata.org/wiki/Q165194","display_name":"Application programming interface","level":2,"score":0.28790000081062317},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.2800000011920929},{"id":"https://openalex.org/C13687954","wikidata":"https://www.wikidata.org/wiki/Q4826847","display_name":"Autonomous agent","level":2,"score":0.27970001101493835},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.2637999951839447},{"id":"https://openalex.org/C5894958","wikidata":"https://www.wikidata.org/wiki/Q2297769","display_name":"Software agent","level":2,"score":0.2578999996185303},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.25110000371932983}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2601.00477","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2601.00477","pdf_url":"https://arxiv.org/pdf/2601.00477","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2601.00477","doi":"https://doi.org/10.48550/arxiv.2601.00477","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.00477","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2601.00477","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2601.00477","pdf_url":"https://arxiv.org/pdf/2601.00477","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7119067352.pdf","grobid_xml":"https://content.openalex.org/works/W7119067352.grobid-xml"},"referenced_works_count":45,"referenced_works":["https://openalex.org/W1972978214","https://openalex.org/W1978394996","https://openalex.org/W1980206868","https://openalex.org/W2149684865","https://openalex.org/W2468328197","https://openalex.org/W2899274966","https://openalex.org/W2911964244","https://openalex.org/W2969797873","https://openalex.org/W2978017171","https://openalex.org/W3177813494","https://openalex.org/W3196083106","https://openalex.org/W4225632195","https://openalex.org/W4226278401","https://openalex.org/W4288057765","https://openalex.org/W4292956935","https://openalex.org/W4304195432","https://openalex.org/W4308627645","https://openalex.org/W4315815628","https://openalex.org/W4327810158","https://openalex.org/W4385327683","https://openalex.org/W4389599215","https://openalex.org/W4396790452","https://openalex.org/W4399554733","https://openalex.org/W4401109317","https://openalex.org/W4403238748","https://openalex.org/W4403646794","https://openalex.org/W4405035693","https://openalex.org/W4405601545","https://openalex.org/W4412945727","https://openalex.org/W4414586252","https://openalex.org/W4415055415","https://openalex.org/W4415997683","https://openalex.org/W4416248351","https://openalex.org/W4416462338","https://openalex.org/W4417420254","https://openalex.org/W7081912778","https://openalex.org/W7083174324","https://openalex.org/W7092291249","https://openalex.org/W7102401796","https://openalex.org/W7117986328","https://openalex.org/W7125909867","https://openalex.org/W7134077757","https://openalex.org/W7136464128","https://openalex.org/W7154600872","https://openalex.org/W7155357960"],"related_works":["https://openalex.org/W7155408947","https://openalex.org/W7171992820","https://openalex.org/W7168425616","https://openalex.org/W7213516748","https://openalex.org/W7167427608","https://openalex.org/W7171925781","https://openalex.org/W7162323345","https://openalex.org/W7171946610","https://openalex.org/W7171928444","https://openalex.org/W7172002873"],"abstract_inverted_index":{"Autonomous":[0],"coding":[1,32,123],"agents":[2,33,163,200],"are":[3,44,52,82],"increasingly":[4],"deployed":[5],"as":[6],"AI":[7],"teammates":[8],"in":[9,38,94],"modern":[10],"software":[11,36],"engineering,":[12],"independently":[13],"authoring":[14],"pull":[15],"requests":[16],"(PRs)":[17],"that":[18],"modify":[19],"production":[20],"code":[21,116],"at":[22],"scale.":[23],"This":[24],"study":[25],"aims":[26],"to":[27,35,124,136,180],"systematically":[28],"characterize":[29],"how":[30,40],"autonomous":[31,109],"contribute":[34],"security":[37,168,218],"practice,":[39],"these":[41],"security-related":[42,97,127,183],"contributions":[43],"reviewed":[45],"and":[46,48,105,113,129,132,175,189,201,213],"accepted,":[47],"which":[49],"observable":[50],"signals":[51,139],"associated":[53,140,209],"with":[54,141,197,210,216],"PR":[55,142,204,211],"rejection.":[56,143],"We":[57,99],"conduct":[58],"a":[59,85,147],"large-scale":[60],"empirical":[61],"analysis":[62],"of":[63,71,115,150],"agent-authored":[64],"PRs":[65,75,81],"using":[66,84],"the":[67],"AIDev":[68],"dataset,":[69],"comprising":[70],"over":[72],"33,000":[73],"curated":[74],"from":[76],"popular":[77],"GitHub":[78],"repositories.":[79],"Security-relevant":[80],"identified":[83],"keyword":[86],"filtering":[87],"strategy,":[88],"followed":[89],"by":[90],"manual":[91],"validation,":[92],"resulting":[93],"1,293":[95],"confirmed":[96],"agentic-PRs.":[98],"then":[100],"analyze":[101],"prevalence,":[102],"acceptance":[103],"outcomes,":[104],"review":[106,134,191],"latency":[107],"across":[108,199],"agents,":[110],"programming":[111,202],"ecosystems,":[112],"types":[114],"changes.":[117],"Moreover,":[118],"we":[119],"apply":[120],"qualitative":[121],"open":[122],"identify":[125,137],"recurring":[126],"actions":[128],"underlying":[130],"intents,":[131],"examine":[133],"metadata":[135],"early":[138],"Security-related":[144],"Agentic-PRs":[145,184],"constitute":[146],"meaningful":[148],"share":[149],"agent":[151],"activity":[152],"(approximately":[153],"4\\%).":[154],"Rather":[155],"than":[156,215],"focusing":[157],"solely":[158],"on":[159],"narrow":[160],"vulnerability":[161],"fixes,":[162],"most":[164],"frequently":[165],"perform":[166],"supportive":[167],"hardening":[169],"activities,":[170],"including":[171],"testing,":[172],"documentation,":[173],"configuration,":[174],"improved":[176],"error":[177],"handling.":[178],"Compared":[179],"non-security":[181],"PRs,":[182],"exhibit":[185],"lower":[186],"merge":[187],"rates":[188],"longer":[190],"latency,":[192],"reflecting":[193],"heightened":[194],"human":[195],"scrutiny,":[196],"variation":[198],"ecosystems.":[203],"rejection":[205],"is":[206],"more":[207],"strongly":[208],"complexity":[212],"verbosity":[214],"explicit":[217],"topics.":[219]},"counts_by_year":[{"year":2026,"cited_by_count":11}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-01-08T00:00:00"}