AI code rot in open source: 8 repos, 12 months

25 October 2026

In October 2026, 81% of the pull requests merged into VS Code carry a signal that an AI agent worked on them. A year earlier it was 4%. In Aspire it’s 70%, in Langfuse 57%.

Is that code aging worse? We ran coderot, the tool we’re building, on 12 months of git history in eight open-source repos: four where AI signals are on about half the merged PRs or more, three where AI barely shows, and one in between. Every number below comes from the summaries behind our live demo, as of 25 October 2026, so you can check each one there.

The short version

• The AI-heavy repos got more complex. The others mostly didn’t. In VS Code, Aspire, Langfuse and n8n, cognitive complexity per 1,000 lines of code rose 11–24% in a year. In Bitwarden, Jellyfin and Excalidraw, where AI signals are on 1–4% of the year’s merged PRs, it moved between −1% and +5%.
• That doesn’t prove AI did it. The AI-heavy repos also grew 2–3.8× in a year, against 1.2–1.5× for the others, and much of what they built is brand new. Outline, with AI signals on 21% of its PRs, rose 19%.
• The rise sits in a few places. In VS Code, 88% of the complexity added since agents took over is in three folders, the agent host, agent sessions and chat, where 76–80% of the merged PRs carry an AI signal. The editor itself barely moved.
• Where AI code looks fine: in the five repos with hundreds of AI PRs, those get fixed within 30 days about as often as the rest (at most 4 points more), though they’re bigger. The code added this year has fewer copies per line than the code it joined. Some folders where agents do most of the work got simpler, such as Aspire’s core hosting library.
• AI PRs are bigger. The median AI PR is bigger than the rest in every repo with at least 10 to compare: 1.1× in n8n, 2.5× in VS Code and Outline, 3.5× in Aspire, 14× in Excalidraw. More of them are over 400 lines.

How we measured

• History. For each repo, coderot walks the default branch over the last 12 months and measures a snapshot each week. It only reads git, so it’s the same CLI you’d run in CI on a private repo.
• Complexity is cognitive complexity, from SonarSource’s specification: +1 for each break in the flow (if, loops, catch, chains of &&…), more when nested. We add it up over every function in C#, TypeScript and JavaScript code and divide by lines of code (blank lines and comments not counted), so a repo doesn’t look worse just for growing. Tests are left out, and so are generated and vendored files. Where a repo checks those in without saying so, our config for it leaves them out, and its demo page says what.
• Duplication is lines inside copies of 50 tokens or more, per 1,000 lines of code, measured once a month.
• A merged PR is a commit on the default branch’s first-parent line: a squash, a merge or a direct push, each counted once.
• An AI signal is something a tool recorded: a co-author trailer (Co-authored-by: Copilot, Claude, Cursor…), a bot as author, an agent’s branch name (copilot/…, claude/…) or a Git AI note. No signal means unknown, not human.
• Agents took over in the month the share of merged PRs with an AI signal passed 50% and stayed above it.
• Fixed later: a PR whose lines a later PR or push titled fix, bug, hotfix or revert changed or deleted within 30 days, found with git blame, test files left out. Counted over the last six months, for PRs merged at least 30 days before the data.

The eight repos

The rest of this post goes repo by repo. Each one ends with where our dashboard says to look first: the folders whose complexity per 1,000 lines rose most since agents took over, or over the year when they didn’t. They’re ranked by the complexity added beyond the folder’s old rate, so a folder that only grew doesn’t top the list.

Where agents write most of the code

microsoft/vscode

Agents took over in August 2026. Since then, 71% of merged PRs carry an AI signal, nearly all of them Copilot CLI’s co-author trailer: 1,465 of October’s 1,489. That trailer first appears in February 2026. Until January, the 4–6% a month was all the Copilot coding agent, and git can’t say how much other AI use went unrecorded.

Complexity per 1,000 lines rose 3% in the ten months before August and 7% in the three months since. The year’s three biggest weekly rises are its last three weeks, and the PRs that drove each of them carry Copilot CLI’s trailer.

The code doubled over the year (1.05M → 2.14M lines), mostly in AI features: extensions/copilot/ appeared in one week of April 2026 with 229k lines (245k now), chat grew from 62k to 300k lines, and src/vs/platform/, home of the new agent host, quadrupled.

The rise is narrow. Since August, 88% of the added complexity is in three folders, src/vs/platform/ (44%), src/vs/workbench/contrib/chat/ (27%) and src/vs/sessions/ (18%), where 76–80% of merged PRs carry an AI signal. The repo’s four hottest files, by changes in 90 days weighted by complexity, are all agent-host and sessions code. agentService.ts went from 2,092 to 4,356 cognitive complexity since 20 September, over 170 commits, 141 of them with an AI signal. Meanwhile src/vs/editor/, with 26% AI PRs, went from 197 to 198 per 1,000 lines over the year.

AI PRs have a median of 147 lines against 59 for the rest, and 27% of them are over 400 lines, against 15%. They were fixed within 30 days about as often: 9% against 8%.

Where to look first: since August, src/vs/platform/ went from 204 to 236 per 1,000 lines (+16%), src/vs/sessions/ from 162 to 209 (+29%) and src/vs/workbench/contrib/chat/ from 214 to 232 (+9%). Consider splitting agentService.ts and copilotAgentSession.ts (1,394 → 2,879 since 20 September), and telling the agent where new code goes, before more lands in them.

microsoft/aspire

AI was there all year: 44% of merged PRs in October 2025, past 50% for good in March 2026, 75% in the last three months, mostly Copilot CLI (1,255 commits) and the Copilot coding agent (535). So “before the takeover” isn’t a human baseline here.

Complexity per 1,000 lines rose 8% in the five months before March and 15% in the eight since, about the same pace per month. The code grew 3.8× (125k → 475k lines), the tests 5.6×.

The C# core got simpler. src/Aspire.Hosting/, with 63% AI PRs and 2.2× the code, went from 142 to 137 per 1,000 lines over the year, and src/Aspire.Hosting.Azure/, with 79%, from 173 to 143. The rise is around it: the VS Code extension, the CI scripts and the playground.

AI PRs have a median of 261 lines against 75, and 42% are over 400 lines, against 23%. This is where fixed later differs most: 11% of AI PRs against 7% of the rest.

Where to look first: since March, extension/ (mostly new: 214 per 1,000 lines against the whole code’s 135 then, 89% AI PRs), .github/ (also new: 222, 88% AI PRs) and playground/ (36 → 87). .github/ includes auto-sec.js, new at a complexity of 1,415 from one PR (#20693). Consider a closer look at the extension’s test and debugger code: its three hottest files had 24–26 commits each in 90 days, nearly all with an AI signal.

langfuse/langfuse

The share of merged PRs with an AI signal went from 11% in October 2025 to 57% in October 2026, mostly Claude Code (1,378 commits) and Cursor (541). It passed 50% in August (54%) and dipped to 49.6% in September, so the takeover month is October, three weeks before this data.

Over the year, complexity per 1,000 lines rose 21% while the code grew 3.6× (184k → 664k lines) and the tests 6.9×. The biggest single jump came in November 2025, from a score analytics page written with Claude Code (#10063). Not everything got worse: web/src/features/evals/ grew 7.6× with 41% AI PRs and went from 92 to 90 per 1,000 lines, and web/src/features/widgets/ (43%) from 163 to 130.

AI PRs have a median of 186 lines against 103. Langfuse fixes a lot either way: 29% of AI PRs and 25% of the rest were fixed within 30 days.

Where to look first: in the three weeks since 2 October, worker/ went from 113 to 125 per 1,000 lines (+10%), 17% of the code’s rise, with 58% AI PRs, and web/src/features/public-api/ from 79 to 86 (+9%). Consider a closer look at worker/ before the next feature lands there.

n8n-io/n8n

The only repo here with line-level attribution: n8n records which lines each agent wrote in Git AI notes, a few a month since March 2026 and thousands a month since June. AI signals went from 2% of merged PRs in October 2025 to 52% in August 2026, then 45% and 41%, mostly Claude Code (3,043 commits), Cursor (380) and Codex (33). It never stayed above half, so there’s no takeover month.

Complexity per 1,000 lines rose 18% as the code doubled (852k → 1.66M lines). The biggest jump came in February, with a code-based workflow builder written with Claude Code (#24535). n8n’s PRs are big either way: a median of 236 lines with AI signals and 211 without, 38% and 35% over 400 lines. Fixed later: 18% against 17%. Its editor UI is written in Vue, which coderot doesn’t measure yet, so packages/frontend/ below is its TypeScript only.

Where to look first: over the year, packages/@n8n/instance-ai/ (new: 197 per 1,000 lines against the whole code’s 104 a year ago, 47% AI PRs), packages/cli/src/modules/ (mostly new, 131) and packages/frontend/ (96 → 122, +27%). Consider a second look at Instance AI while it’s new: its two service files in packages/cli/src/modules/instance-ai/ are the repo’s two hottest, at complexities of 988 and 922 after more than 100 commits each in 90 days, about half of them with an AI signal.

In between

outline/outline

AI signals appear in December 2025, first from the Copilot coding agent, then mostly Claude Code from April. They’re on 20–46% of merged PRs a month from February to August 2026, then 15% in September and 2% in October, when Outline merged more PRs than in any other month. Git can’t say whether the agents stopped or only their trailers did, so from September on, Outline’s AI share is unknown.

Complexity per 1,000 lines rose 19%, as much as in the AI-heavy repos, while the code grew 1.5×. AI PRs have a median of 78 lines against 31, and 17% are over 400 lines, against 8%. Fixed later: 10% against 8%.

Where to look first: over the year, shared/editor/ went from 126 to 152 per 1,000 lines (+20%), 22% of the code’s rise, server/models/ from 87 to 109 (+24%) and plugins/ from 69 to 84 (+21%), each with 27–31% AI PRs. Consider a closer look at shared/editor/ before the next feature lands there.

Where AI barely shows

excalidraw/excalidraw

AI signals are on 4% of the year’s merged PRs and 11% of the last three months’, all but one from Claude Code. Those few are big, though: 12 AI PRs in the last six months with a median of 2,462 lines, against 177 for the other 143. Since July they’re 4–18% of the PRs and 28–56% of the new lines.

Complexity per 1,000 lines rose 4% while the code grew 1.3×. The files that got most complex since mid-September are App.selectionTool.ts, App.text.ts, App.selection.ts and App.clipboard.ts: code moved out of App.tsx (complexity 1,897), which coderot marks as moved rather than counting it as new.

Where to look first: over the year, the files directly in packages/element/src/ went from 183 to 194 per 1,000 lines (+6%), 36% of the code’s rise, components/TTDDialog/ from 93 to 133 (+42%) and actions/ from 121 to 128 (+6%). Consider a closer look at packages/element/src/ before the next feature lands there.

jellyfin/jellyfin

AI signals are on 1% of merged PRs. Complexity per 1,000 lines rose 5% while the code grew 1.15×. The biggest jump, between 29 April and 9 May 2026, was mostly one PR, “Query Performance Improvements” (#16062), with the largest rise in BaseItemRepository.TranslateQuery.cs (+385).

Where to look first: Jellyfin.Server.Implementations/ went from 138 to 167 per 1,000 lines (+21%), 20% of the code’s rise, Emby.Server.Implementations/ from 164 to 174 (+6%) and Jellyfin.Server/ from 129 to 148 (+15%). Consider a closer look at Jellyfin.Server.Implementations/ before the next feature lands there.

bitwarden/server

AI signals are on 2% of merged PRs. Complexity per 1,000 lines fell 1% while the code grew 1.5× and the tests 2.6×: the steadiest repo of the eight. Its Entity Framework migrations are left out, since Bitwarden generates each one three times, once per database.

Where to look first: src/Core/AdminConsole/ went from 82 to 95 per 1,000 lines (+15%), src/Core/Billing/ from 89 to 100 (+12%) and src/Infrastructure.EntityFramework/ from 64 to 72 (+13%), all with 1–5% AI PRs. Billing alone took 15% of the code’s rise. Consider a closer look at src/Core/AdminConsole/ before the next feature lands there.

Where AI code looks fine

Three findings don’t fit “AI code rots”:

1. AI PRs don’t get fixed much more often. Of the PRs merged at least 30 days before the data, 9% of VS Code’s AI PRs were fixed within 30 days, against 8% of the rest. n8n: 18% against 17%. Outline: 10% against 8%. Langfuse: 29% against 25%. Aspire: 11% against 7%. AI PRs are bigger, so a fix has more of their lines to hit, and the gap is still at most 4 points. The other three repos have too few AI PRs to compare (Bitwarden: 2 of 14 fixed).

   

2. Duplication fell. Copy-paste is the most common worry about AI code. Duplicated lines per 1,000 lines fell 46% in Aspire, 38% in Langfuse and 36% in n8n, and stayed flat in VS Code (+1%). They fell in the other four too, by 6–16%. It’s dilution, not cleanup: duplicated lines grew in every repo, but the code added this year came with fewer copies per 1,000 lines than the code it joined. About 48 against 133 in Aspire, 47 against 101 in Langfuse and 78 against 309 in n8n, and the same in VS Code (88 against 87).

3. Some folders where agents do most of the work got simpler. Aspire’s src/Aspire.Hosting/: 63% AI PRs, 2.2× the code, 142 → 137 per 1,000 lines. src/Aspire.Hosting.Azure/: 79%, 173 → 143. Langfuse’s evals: 41%, 7.6× the code, 92 → 90. A high AI share alone doesn’t predict a rise, and the repo-wide number hides both directions.

What this can’t tell you

• Eight repos aren’t a sample. We picked them for visible AI activity, plus three C# and TypeScript repos where AI barely shows. The AI-heavy ones also grew fastest and are building new products (agent hosts, AI workflow builders, a VS Code extension), and new code under heavy development gets more complex whoever writes it. Eight repos can’t separate the two.
• Commit-level attribution overestimates. A PR counts as AI when any of its commits carries a signal, and all its lines count as AI lines. A trailer means an agent helped, not that it wrote every line. n8n’s Git AI notes are the only line-level data here.
• No signal means unknown, not human. Copilot CLI’s trailer, behind 98% of VS Code’s AI signals in October, first appears there in February 2026. Outline’s AI signals fall from 120 PRs in August to 8 in October, while it merged more PRs than ever. The baseline repos may use AI without recording it.
• One false signal is filtered out. From 15 April 2026 until VS Code 1.119, its git.addAICoAuthor setting added Co-authored-by: Copilot to commits by default, even when no AI was used (The Register). coderot ignores that trailer on commits dated 15 April to 19 May 2026, two weeks past the release, for updates to roll out.
• Complexity per line is one lens. It doesn’t see architecture, naming or test quality. Code in Vue and other markup files isn’t measured yet (n8n’s editor UI), and generated or vendored files that a repo doesn’t mark are left out by rules we wrote per repo, listed on each repo’s demo page.
• Fixed later goes by commit titles (fix, bug, hotfix, revert) and git blame. It misses fixes that only add lines, such as a missing null check, and counts fixes to the build along with shipped bugs.
• Snapshots are weekly, so a rise is traced to the commits between two snapshots, not to one PR.

If you maintain one of these repos and something here looks wrong, tell us at [email protected] and we’ll correct it.

See it for yourself

Every number above is in the live demo, refreshed daily: pick a repo, hover a month, and follow a jump to the PRs behind it. coderot runs as a CLI in your CI, and your code never leaves it. Join the waitlist to see your own repo.