We measured the "AI review tax" across 5,388 repos. The median repo doesn't pay one.

The claim you hear from one side is that AI-written code is a review burden everywhere. The claim from the other is that it's free velocity. We read 5,388 public repositories - 444,225 merged pull requests - and both sides are wrong in an interesting way: the median repo pays no review tax at all, and a quarter pay a real one.

Disclosure up front: I built the scanner this data comes from, and I sell a paid version to teams. That's also why the headline is against my interest - a review tax that landed on everyone would be a better sales pitch. It's just not what the data says, and the data is re-checkable by anyone (see "Check us" below).

What we measured

For every repo, the last 100 merged PRs, divided into PRs carrying agent authorship and the rest of the same repo. Attribution is commit-level marks only - Co-authored-by trailers naming a known agent, agent commit identities, agent bot accounts. Nothing is inferred from diff shape, code style, or timing; that would be guessing dressed as measurement.

Because the comparison stays inside each repository - same reviewers, same conventions, same era - a multiple above 1× means the attributed side took more review; below 1×, less.

The headline numbers

Full population, backfill complete 2026-08-06.

• Of 1,228 repos with a readable time-to-merge comparison: 71% at or below 1×, 29% above. Median 0.47× - attributed work merges in about half the time. The 25th percentile is 0.17×. The 75th crosses 1.18× - the quartile that pays, genuinely pays.
• 56% of all repos read (3,018 of 5,388) show zero detectable agent authorship. Median detected share across the 2,353 attributed repos with enough PRs to compare: 2.9% - a floor by construction, and stated as one.
• 15% of attributed repos are agent-native (20%+ of merged work carries attribution).
• Review rounds - the measure everyone reaches for - stay unreadable even at this scale: 19 of 2,353 attributed repos request changes often enough to carry a ratio. That is a finding about how review actually works (friction rarely surfaces as "changes requested"), and we publish it instead of papering over it with a fabricated median.

Who pays it

By language, median time-to-merge multiple:

• TypeScript: 0.43× (442 repos)
• Python: 0.54× (361)
• Go: 0.54× (302)
• Rust: 0.70× (237) - the slowest-relative of the big five.

By project size the spread is flatter than expected:

• 50k+ stars: 0.43×
• 10k-20k: 0.39×
• 5k-10k: 0.51×

Size predicts far less than language does. The full cuts, with segments below the sample floor withheld rather than estimated, are on the live page.

What this does not say

Three limitations are load-bearing, and reading the numbers without them produces wrong conclusions:

• The detected share is a floor. Inline-completion work is invisible to repository artifacts, so "the rest" contains AI-assisted code. That narrows every gap here rather than widening it.
• The detectable set skews agentic. Tools that stamp attribution are disproportionately the agentic ones - read every multiple as "work delegated to a coding agent," not "AI code."
• Causation is not on offer. Teams hand agents the work that was already hardest to review, so a higher multiple is consistent with both "agents produce harder-to-review code" and "agents get pointed at harder problems." This measurement cannot separate those, and we don't claim it can.

The sample self-selects twice, too: these are repositories someone chose to scan plus a curated backfill of well-known projects - a population of repos people care about, not a random sample of software.

Check us

Every repo in the Index is public; every report is a permanent link anyone can re-read; the aggregate recomputes live from the same rows. The full method, signal by signal, including everything it can't see: forge.ambera.app/methodology.

You can place your own repo against this population at forge.ambera.app/review-tax-index - public repositories only, nothing installed, no account. For a private repo there's a local CLI that reads via your own gh auth and sends nothing.

The cadence

The Index republishes quarterly. Repos already read keep their history, so the next edition carries trend lines: not just