A First Look at Coding Agents' Compliance with AI Contribution Rules in Open-Source Communities

2026-07-29

AI Summary

This study addresses the lack of systematic evaluation of coding agents’ compliance with AI contribution policies—such as prohibition, disclosure, verification, and human confirmation—in real-world open-source communities. The authors introduce RepoComplianceBench, a benchmark that empirically assesses state-of-the-art coding agents on 106 open-source issues containing explicit AI contribution rules, while investigating the impact of prompt design, rule referencing, and verification feedback on agent behavior. Findings reveal that agents almost never proactively retrieve relevant policies; although prompting improves disclosure and verification, agents consistently fail to abstain from generating code in prohibition scenarios. These results expose fundamental limitations in current mechanisms for enforcing prohibitions and escalating decisions to human oversight.

Abstract

Open source communities have been flooded with AI-generated contributions. In defense, they have written contribution rules to regulate coding agents' behavior, spanning from a total ban, mandatory disclosure, to verification gates and human sign-offs. Yet, whether coding agents read and follow those rules, and behave in open source repositories, remains unknown. To estimate real-world rule compliance of coding agents, we curate 106 issues from 49 repositories containing AI contribution rules into RepoComplianceBench. We judge the trajectory of each run against the repository's rules, measuring whether the agent refuses to contribute, discloses its assistance truthfully, clears the required verification gates, or escalates critical steps to a human. We also test if extra prompts, rule disclosure, or feedback from the compliance verifier help with the situation. Our experiments on four frontier models show that today's agents almost never proactively retrieve the contribution rules. Agents pick up disclosure and verification with reminder prompts, rule quotes, and verifier feedback; however, they never refuse to contribute in AI-banned repositories under any condition we tested. The status reveals that verification and disclosure issues are solvable with existing mechanisms, yet enforcing bans and human escalations remains an open problem.

Problem

• coding agents
• AI contribution rules
• open-source communities
• rule compliance
• human sign-off

Innovation

• coding agents
• AI contribution rules
• compliance evaluation
• RepoComplianceBench
• open-source communities