What 264,000 Scans Say About AI-Generated Code Quality
Most AI-generated code scans clean. A steady minority of agent edits make the file worse, and at agent volumes that minority adds up.
In August 2026, about 4 in 10 repository scans found at least one AI-slop pattern. About 1 in 8 agent edits that we could compare before and after left the file scoring worse.
Both come from 264,290 aislop scans that month. Most code was fine; the risk is how much of it goes unread.
Most repository scans find something small
17,434 developers ran 110,941 full repository scans. About 6 in 10 surfaced at least one issue, and 40.1% found a pattern typical of coding agents: narrative comments that restate the code, swallowed exceptions, unsafe casts or duplicated helpers. About 1 in 6 (15.5%) had a security finding.
A finding is one flagged line, not a broken feature. The median repository still scored 99 out of 100.
About 1 in 8 agent edits left the file worse
Agent hooks are scans that run automatically each time a coding agent finishes editing a file, before anyone has read it. We call them agent-edit scans.
Of 153,349 agent-edit scans, 56,482 had an earlier score for the same file to compare against. Of those, 12.3% scored worse after the edit and most of the rest were unchanged. The median edit scored 100.
The other scans were usually a file's first scan, so they cannot show a change. Counting them would cut the rate to 4.5%, understating it by more than half.
Volume outruns review
Just 121 developers produced those agent-edit scans, a median of about 230 each in one month. Nobody reads that many edits line by line, so a small share of bad edits builds up unnoticed.
The figures
| All scans, August 2026 | 264,290 |
| Repository scans / developers | 110,941 / 17,434 |
| Repository scans with any issue / AI-slop pattern / security finding | 59.7% / 40.1% / 15.5% |
| Agent-edit scans / developers | 153,349 / 121 |
| Agent-edit scans with an earlier score | 56,482 |
| Of those: worse / unchanged / better | 12.3% (6,934) / 85.3% / 2.5% (see correction) |
| Agent-edit scans with no earlier score | 96,867 |
| Agent-edit scans from the most common agent | 144,192 |
| Share from the single heaviest developer | 10.1% |
Limits
Everyone here chose to run a code quality tool, so the sample likely skews toward people who already care. Agent-edit scans cover only the edited file, so they describe edits, not codebases. One agent produced most of them, so agents cannot be compared fairly. A score counts named, deterministic patterns; it cannot tell you whether a feature works or should exist.
Method
All figures are from anonymous aislop CLI telemetry for August 2026. It records a score, a finding count, a file-count range and an anonymous per-installation identifier, never source code, file names or repository names. It is on by default and can be turned off with AISLOP_NO_TELEMETRY=1 or DO_NOT_TRACK=1, so the totals are a floor.
Correction, 14 October 2026: an earlier version said agent edits were about five times more likely to make a file worse than better. That comparison is withdrawn: aislop versions before 0.14.1 almost never recorded an improvement, so the 2.5% figure mostly reflected the version people ran. The 12.3% rate stands as measured. Details in the September 2026 report.
Run the same scan on your repository with npx aislop@latest scan, or read how the score is computed.
Frequently asked questions
How often does AI-generated code contain quality issues?
In August, about 4 in 10 repository scans (40.1%) found at least one AI-slop pattern, and about 6 in 10 found an issue of any kind. The sample is people who chose to run a code quality tool, not all software.
Do AI coding agents make code worse?
Usually not: the median agent edit scored 100 out of 100. Of the edits we could compare before and after, 12.3% left the file scoring worse; see the September 2026 report for how scoring has changed since.
What are the most common AI slop patterns?
Narrative comments that restate the code, swallowed exceptions, unsafe type assertions, duplicated helpers and dead imports.
Where does this data come from?
Anonymous aislop CLI telemetry, which records a score, a finding count and a file-count range, never source code, file names or repository names. Turn it off with AISLOP_NO_TELEMETRY=1 or DO_NOT_TRACK=1.