Govern the Repository, Not the Agent: Measuring Ecosystem-Level Risk in AI-Native Software

Large-scale study finds autonomous coding agents concentrate repository-level integration risk at twice the rate of human contributors

A new arXiv paper analyzes over 930,000 agent-authored pull requests to measure 'integration friction' — the cost of merging contributions into concurrently-changing codebases. The study finds that roughly half of friction variation is a persistent property of the repository rather than any individual contribution or agent, and that agent-authored contributions concentrate this repository-level friction at approximately twice the rate of human contributions (intraclass correlation 0.30 vs. 0.16). The authors argue this means AI-native software risk is an ecosystem-level phenomenon and should be governed and evaluated at the repository level rather than agent-by-agent.