AI编程代理的代码风险源于整个项目生态，而非单个代理。
Govern the Repository, Not the Agent: Measuring Ecosystem-Level Risk in AI-Native Software
- 从项目整体生态视角衡量AI代理贡献的整合摩擦。
- 超过93万次代理提交中，一半摩擦由项目本身导致。
- 相比人类，AI代理在相同项目中引发的摩擦高两倍。
自主编程代理如今大规模地在共享代码库中开启和合并拉取请求，但领域仍沿用传统方式，逐个评估代理在孤立基准任务上的表现。然而，即使每个代理都通过了自身测试，其贡献仍会导致代码库累积无法归因于单一变更的问题。我们探究这种问题究竟是源于个体代理还是其所在的代码库生态。研究聚焦于‘整合摩擦’——即一个贡献在其他开发者同时修改时被集成的成本。通过对超过93万条由代理生成的拉取请求分析发现，在控制贡献者、大小、代理类型等变量后，约一半的摩擦仍属于特定代码库，且在全面控制后依然存在。在同一代码库中，代理提交引发的整合摩擦强度是人类的两倍（组内相关系数0.30对比0.16），这一差距在控制代码库规模、年龄、任务形态、流程成熟度及合并路径后依然显著。因此，风险本质上属于生态系统，而非个体代理。这意味着，对以AI为核心的软件应以生态系统为单位进行评估与治理，而非逐个代理进行。
原文摘要 · Abstract (English)
Autonomous coding agents now open and merge pull requests in shared repositories at scale, and the field evaluates them the way it has always evaluated components, one agent at a time, on isolated benchmark tasks. Yet agents that each pass their own tests still leave repositories that accumulate problems no single contribution accounts for. We ask whether this problem belongs to the individual agent or to the repository where it accumulates. We study integration friction, the cost of integrating a contribution into a codebase that other contributors are concurrently changing. Across more than 930,000 agent-authored pull requests, we measure how much of the variation in friction stays with the repository after the contribution, its author, its size, and its agent are accounted for. About half does, and it survives full controls. In the same repositories, agent-authored contributions concentrate this repository-level friction roughly twice as much as human ones (intraclass correlation 0.30 versus 0.16), a gap that holds after controlling for codebase size, age, task shape, process maturity, and merge path. The risk is a property of the ecosystem, not the agent. AI-native software is therefore better measured and governed at the ecosystem level than one agent at a time.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。