When Coding Agents Touch Infrastructure: What a Causal PR Study Shows

Between 43.1% and 56.2% of AI-authored pull requests that touch both application code and deployment infrastructure merge with no human inspection at all, in a median of under 31 minutes. That is the author-reported headline from a new causal study of dual-scope pull requests posted on arXiv, and it should change how platform teams design review policy for agent PRs. Not by gating everything an agent writes: the same study finds dual-scope changes are rare, only 4.48% to 4.55% of agent contributions. The policy answer that follows from both numbers together is narrower and cheaper than blanket gating. Gate the infrastructure diff, not the agent.

Every number here comes from author-reported preprints, and none of it has been independently replicated.

What the causal study actually measured

The study evaluated 26,999 pull requests, built as a harmonized cohort from two existing datasets: AIDev v5 with 21,855 PRs and MOSAIC-3M with 5,144 (2,570 agent PRs against 2,574 human PRs). Six agent architectures were compared against an aligned human baseline, and the analysis was restricted to mature repositories with more than 100 stars (arXiv 2610.12849).

Two qualifications belong up front. First, “causal” is the authors’ own design claim; the paper is a single preprint and the causal identification has not been independently examined. Second, the cohort skews toward public, popular open-source repositories. If your agents work on private codebases with different review cultures, treat the effect sizes as a direction, not a calibration.

What the study isolated is what the authors call dual-scope PRs: pull requests that modify both application code and deployment infrastructure in one change. Think of a feature PR that also edits a Dockerfile, a CI workflow, or a Terraform module. The research question is whether that bundling carries an integration overhead beyond what either change would carry alone.

How often agents touch infrastructure, and why the number cuts both ways

The prevalence finding is the part that should calm anyone drafting a policy that treats every agent PR as a platform risk. The authors report that “dual-scope PRs represent only 4.48% to 4.55% of agent contributions” (arXiv 2610.12849), while pure maintenance tasks account for 17.70% to 25.41% of agent activity (arXiv 2610.12849). Their summary judgment: agents operate primarily as application coders or maintenance workers, not DevOps engineers.

That number cuts both ways, though. A 4.5% share (arXiv 2610.12849) is small enough that gating all agent PRs would spend review budget on the wrong 95%. It is also large enough to be a steady stream in any organization with real agent adoption. One PR in twenty-two touching deployment files is not an edge case you can leave to chance; it is a routing problem you can solve with a file-path rule.

The same paper adds a pointed observation about the maintenance share. The authors argue that organizations are deploying computationally expensive, non-deterministic LLMs for routine maintenance tasks already automated by deterministic tools such as Dependabot and Renovate, and recommend intake policies that “categorically flag or reject agent contributions that contain zero functional application code.” Whether or not you adopt that recommendation, the policies this paper recommends are categorical filters keyed on content (file paths, presence of functional application code), not blanket rules on authorship.

The silent-merge problem

Here is the finding that should drive policy. The authors report that “agent identity reduces the odds of human review by 63.7% compared to human peers” even for external contributors lacking repository write access (arXiv 2610.12849). Consequently, 43.1% to 56.2% of dual-scope PRs (arXiv 2610.12849) bypass inspection and merge silently in a median of under 31 minutes.

Read the mechanism carefully, because it is about reviewer behavior, not agent malice. A PR authored by a bot account attracts less scrutiny than an otherwise comparable diff from a human, at least for external contributors. Reviewers appear to treat agent authorship as a proxy for low risk, or triage agent PRs down the queue until automation merges them. Be precise about what this adds up to, because the superlative it invites is wrong: the paper does not show that dual-scope PRs are the least-scrutinized PRs in the queue. In AIDev v5, 79.27% of all agentic PRs merged silently versus 43.1% of dual-scope ones (arXiv 2610.12849); matched dual-scope modifications there actually increased human intervention, lowering the silent rate from 47.2% to 43.1% (arXiv 2610.12849). Only in MOSAIC-3M, where 56.2% of dual-scope PRs merged silently against 49.01% of all agentic PRs (arXiv 2610.12849), did dual-scope changes bypass review more than the rest. The authors’ own characterization is volatility, not uniform neglect: review of agent dual-scope PRs rose from 47.5% to 53.1% in AIDev v5 and fell from 52.5% to 36.2% in MOSAIC-3M (arXiv 2610.12849), while human dual-scope review held flat at 72.2% to 73.4%. For files that gate your deployments, volatility is still exposure: a large share of these PRs merges with no human inspection, and it happens fast. A sub-31-minute median merge time means the window for an infra owner to notice a change to a deployment manifest is shorter than most meeting invites.

Two scope limits matter before you generalize. The 63.7% figure was measured on external contributors without write access; the study does not establish the same discount for agent PRs inside a trusted team with branch protections. And these are mature, 100-plus-star repositories (arXiv 2610.12849), where reviewer attention is scarce and bot accounts are common. A small internal monorepo may behave differently in either direction.

Blast radius: conflicts, PR size, and the rollback argument

The causal study measures review and integration overhead; it does not measure what happens after a dual-scope PR lands badly. For that, the closest evidence in this research set is AgenticFlict, a dataset of merge conflicts in agent PRs. Its authors processed 142K+ agentic PRs from 59K+ repositories, ran 107K+ through deterministic merge simulation, and found 29K+ PRs with conflicts, a 27.67% conflict rate, across 336K+ fine-grained conflict regions (arXiv 2604.03551). One scope condition frames that rate: the simulation covers open and closed-unmerged PRs only, because Git does not preserve a merged PR’s pre-merge conflict state, so conflicts resolved before merging never enter the dataset.

Two findings from that dataset connect to the bundling question. First, integration difficulty scales with change size: larger PRs are more likely to collide with concurrent development and produce textual merge conflicts. A dual-scope PR is by construction larger and wider than a single-scope one, touching directories owned by different teams. Second, agent choice matters: the authors report that OpenAI Codex shows both a higher conflict rate and a broader spread of conflict severity than other agents in their pipeline, though that is a comparative result within one simulation setup, not a verdict on the tool.

Now the honest inference. The claim that bundling code and infra changes raises rollback cost is argued from coupling, not measured in these papers. No study in this set reverted dual-scope PRs and timed the recovery. But the mechanism is not exotic. If a feature regression forces a revert of a PR that also changed the CI pipeline or a Dockerfile, the revert takes the infrastructure change with it, or forces an emergency partial revert under pressure. Either way, the rollback of a code problem becomes a platform problem. Splitting the infra diff into its own PR keeps the two blast radii independent, and the conflict data says smaller PRs are also less likely to hit merge friction on the way in. That is inference from two adjacent findings, and it is labeled as such, but it is the kind of inference review policy is allowed to act on.

What a gate costs

A gate that reviewers cannot trust is just a queue. The most useful pricing data here comes from a pilot study of delegation contracts for coding agents: structured agreements that force the agent to declare scope and produce verifiable evidence of what it did. Across 64 runs, the authors report evidence sufficiency rose in 22 of 30 paired comparisons and fell in none (+0.83 on a 5-point scale, p < 0.0001). The cost: “Contracts cost +13% agent tokens and +38% wall-clock time” (arXiv 2606.17099), with a larger effect for the weaker model tier.

The counter-evidence matters as much as the price. The same pilot reports that all 64 runs passed hidden acceptance checks with zero authority-boundary violations, and the authors say contracts “did not reduce scope violations (there were none to reduce), did not change accept/reject decisions on correct work, and never triggered the repair-required flag.” Their conclusion: on small, well-specified tasks with capable models, contracts buy reviewability, not correctness.

That is the right frame for infra gating. You do not gate because the agent is more likely to be wrong about a Dockerfile than a human is; this evidence does not establish that. You gate because a dual-scope PR that slips past review removes your chance to catch the change at all. Scrutiny has its own price, and the causal study measures it: dual-scope PRs that do get reviewed stall, adding a median +13.13 hours and multiplying time-to-merge by 3.24 in AIDev v5, with reviewed contributions waiting 15.59 to 49.80 hours in the queue (arXiv 2610.12849). A contract or structured evidence requirement makes the gate fast instead of theatrical, at roughly +13% tokens and +38% wall-clock time on small tasks (arXiv 2606.17099). Whether those overheads hold on large dual-scope changes is unmeasured; the pilot’s tasks were small and well-specified, and the authors say so.

One more bounded finding rounds out the reviewer side. A study of 33,596 PRs from five agents (GitHub Copilot, OpenAI Codex, Claude Code, Devin, and Cursor) found that more structured PR descriptions are associated with faster reviewer responses and shorter completion times, but do not guarantee merges; code quality remains central. Presentation improvements lubricate review. They are not a substitute for an owner actually reading the infra diff.

Split, gate, or reroute: a decision framework

The evidence supports a three-way routing decision applied at the PR level, keyed on file paths and scope rather than authorship.

The principle underneath the table: the exposure concentrates in the minority of PRs that cross a boundary, so the control should too. This is a bounded inference from the observed risk distribution, and I would apply it with one condition. If your agent setup produces dual-scope PRs at rates far above 5% (arXiv 2610.12849), the rarity assumption in row one stops holding, and broader gating deserves a fresh look.

Detection levers and their gaps

A gate only works if you can tell which PRs are agent-authored and which files count as infrastructure. The file-path half is available in major forges such as GitHub; the causal paper’s own recommendation is “path-based CODEOWNERS configurations coupled with repository rulesets” that disable auto-merge when a PR touches sensitive infrastructure directories (arXiv 2610.12849). The attribution half is not.

An exploratory study of harness configuration found context files are the most-adopted mechanism for steering agents: depending on the tool, 61.5% to 100% of configured repositories use files like CLAUDE.md or AGENTS.md (arXiv 2602.14690). Among 2,853 repositories with a configuration artifact, 2,058 (72.1%) also contained AI-authored commits (arXiv 2602.14690). The authors are explicit that 72.1% is a lower bound on attribution coverage. Nearly three in ten configured repositories had agent configuration but no detectable AI-authored commits, which means either the agent never committed or its commits were unattributable. Any gate keyed on “agent-authored” will miss some unknown fraction of the traffic it exists to catch. The study also notes practical divergence worth knowing: Claude Code repositories use the broadest range of configuration mechanisms, and Claude Code did not yet support the emerging AGENTS.md standard at the time of writing, so a policy built only on AGENTS.md will miss Claude Code’s native config.

The workload is also growing into the gate. Anthropic’s internal survey of 132 engineers and researchers reports that about 27% of Claude Code-assisted tasks were work that would not have been attempted without the tool. That is one vendor’s self-reported internal survey, so treat it as directional. But if agent activity is partly additive rather than a speedup of existing work, some of that new work will produce novel infra-touching PRs that no historical baseline predicts.

Limits and open questions

Everything quantitative in this article comes from author-reported preprints, none independently replicated, and the headline study is a single paper. Its cohort is 26,999 PRs from mature, 100-plus-star public repositories across six agent architectures (arXiv 2610.12849); whether the 63.7% review-odds reduction or the 43.1%–56.2% silent-merge rates hold in private codebases, smaller projects, or internal-contributor settings is unverified. The 27.67% conflict rate (arXiv 2604.03551) comes from a different dataset and is not specific to infrastructure files, so merge conflicts and infra drift are related but distinct failure modes; it was also measured only on open and closed-unmerged PRs, because a merged PR’s pre-merge conflict state cannot be recovered. The delegation-contract overheads were measured on small, well-specified tasks, and no study here measured rollback cost directly, defect rates of agent-authored infra changes, or whether splitting PRs actually reduces conflicts. The 72.1% attribution figure (arXiv 2602.14690) is a measured lower bound, not a ceiling.

None of that overturns the central decision. The narrow, author-reported finding is that a small share of agent PRs crosses the infrastructure boundary, and that whether those PRs get human review is volatile rather than guaranteed, with a large share merging unreviewed. Routing deployment-file changes to an infra owner, or splitting them out, is a cheap categorical fix matched to the observed shape of the risk. It does not require trusting or distrusting agents in general. It requires not letting a bot account’s diff to your deployment pipeline merge in under 31 minutes because everyone assumed someone else was watching.

Frequently Asked Questions

What percentage of AI-authored pull requests touching both code and infrastructure merge without human review?

Between 43.1% and 56.2% of AI-authored pull requests that touch both application code and deployment infrastructure merge with no human inspection at all, in a median of under 31 minutes.

How common are dual-scope pull requests among agent contributions?

The authors report that “dual-scope PRs represent only 4.48% to 4.55% of agent contributions” (arXiv 2610.12849), while pure maintenance tasks account for 17.70% to 25.41% of agent activity (arXiv 2610.12849).

What is the cost of using delegation contracts for coding agents?

The cost: “Contracts cost +13% agent tokens and +38% wall-clock time” (arXiv 2606.17099), with a larger effect for the weaker model tier.