Clone it or prompt it?
GitHub is flooded with new repos, and they keep getting bigger. A look at what changed in 2026, what code written by AI agents looks like, and when it's still worth pulling someone else's repo instead of having an agent write exactly what you need.
The question
I'm always trying to keep up with the latest releases and popular repos so I can apply them to my work and my personal projects. Lately I've been seeing so many new task-focused repos that I started to wonder: when does it make sense to keep cloning, and when should I just tell an agent to code exactly what I need?
Answering that turned into a rabbit hole. Before deciding whether to borrow from new repos, I wanted to know what's actually in them: how many there are, how big they are, who (or what) wrote them, and how tested they are. This page sums up five studies built on random samples of 170,000 public repos, plus my own Claude Code usage logs. The detailed reports have every number, chart and method.
Why now? OpenAI and Anthropic are coming out with their own version control for coding agents, which will start pulling projects away from Git. That makes this one of the last snapshots in which GitHub holds a good-quality amount of data to pull.
Key takeaways
- Repo creation sped up sharply. New public repos per month roughly tripled, from ~3.3 million in early 2024 to 10–11 million by autumn 2026: in all of 2024, in 2025 and in just the first ten months of 2026.
- And the repos got much bigger. After a decade at a median of ~300–450 lines of code, the median 2026 repo with code has lines. It isn't because 2026 repos are younger: compared at the same age (90 days), 2026 is still 2024.
- Two milestones. Size first steps up in November 2025 (Gemini 3 Pro, Claude Opus 4.5), then climbs steeply from February 2026, when Claude Opus 4.6 and GPT-5.3-Codex came out. That's timing, not proof of cause.
- Repos with a visible AI trace are huge, and removing them brings sizes back toward normal. of 2026 repos carry a clear AI-agent mark (in commits or agent instruction files), with a median of lines at 90 days. Without them, the 2026 median drops from to . That's still above the ~ of 2024, but many developers and agents leave no obvious mark.
- Agents write more, not always better. Given one shot at an ML exercise, agents wrote 1.6–2.3× as many lines as my worked-out 2022 solution, and neither scored higher. READMEs grew too: repos with a visible AI trace have a median README of ~3.8 KB, against ~450 bytes for 2024 repos.
- For most new repos, prompting is cheaper than vetting. One 5-hour Claude Pro window writes about as much code as of 2026 repos contain, and one Max window . Meanwhile only of new repos have tests and have a license.
- The catch is a chicken-and-egg. Cloning a new repo only beats prompting your own if that repo wasn't itself written by an agent. Otherwise you get the extra lines without the tailoring. Borrow mature, maintained libraries; generate small, tailored code, with tests.
1GitHub's 2026 flood
For each creation year from 2010 to 2026 I drew 10,000 fully random public repos (forks excluded) and estimated their lines of code; monthly counts come straight from GitHub search [1]. Two things changed at once: how many repos people create, and how much code is in each one.
Growth came in steps that held afterwards, rather than a smooth curve. The biggest are March 2025 (+15% on the month before, after Claude 3.7 Sonnet and the Claude Code preview), March 2026 (+24%, after Claude Opus 4.6, GPT-5.3-Codex and GPT-5.4) and September 2026 (+27%, the month of GPT-6 and Claude Opus 5.5).
The typical repo actually shrank for a decade, from ~530–610 lines in 2010–2015 to ~300–365 in 2019–2024, as GitHub filled with homework, tutorials and small experiments. 2025 ticked up to , and 2026 more than doubled it.
Two milestones
The monthly median sits at roughly 300–400 lines through mid-2025. Two moments stand out:
- November 2025, when Gemini 3 Pro and Claude Opus 4.5 came out: the first clear step up, to ~600 lines.
- February 2026, when Claude Opus 4.6 and GPT-5.3-Codex came out: the start of a steep climb through April (GPT-5.4, Claude Opus 4.7, GPT-5.5), after which the median has stayed around 1,000–1,300 lines.
Both line up with stronger coding models, but this can't prove they caused it: agentic tools like Claude Code and Codex were also spreading to more people at the same time.
Releases marked on the charts
Not just younger repos
A fair objection: 2026 repos are only weeks or months old, and young repos might simply be measured at a different stage. So for a subsample of ~4,250 repos I read the git history and measured every year's repos at the same ages: 7, 90 and 365 days after creation [4].
At 90 days old, repos from 2016–2025 had a median of lines. 2026 repos had , and they were already that big a week after creation. In every year, most repos reach close to their final size within 90 days. The jump is real.
Most of the flood is noise
More repos doesn't mean more useful repos. Of everything created in 2026:
So the repos most people would ever find, let alone clone, are a thin slice of the flood. The language mix also moved toward the web and Python: HTML, Python and TypeScript grew as primary languages while JavaScript and Java shrank.
| Primary language (share of all new repos) | 2020 | 2024 | 2026 |
|---|
How lines of code were measured
Downloading 170,000 repos wasn't an option, so lines of code are estimated: GitHub's languages API reports how many bytes of each language a repo contains [2], and dividing the code bytes by 41 bytes per line gives the line count. I calibrated that ratio by cloning 250 repos and counting their lines directly, then validated it on 306 more from 2010, 2020 and 2024. A typical estimate is off by about 26% either way, slightly undercounting, and the error is similar in every year, so the trend holds even if any single number is approximate. GitHub's own repo size field is useless for this: it includes git history and assets, and overestimated code size about 12× on random repos. Details in the calibration report.
2What agent-made code looks like
Visible AI traces
Some AI tools leave fingerprints. For every repo in the age-matched subsample I checked the last 100 commits for agent signatures (for example the Co-Authored-By: Claude line Claude Code adds by default [6], or commits from Copilot's coding agent, Codex, Jules, Devin, Lovable or v0), and the file tree for agent instruction files such as CLAUDE.md, AGENTS.md [5], .cursor/ or Copilot instructions.
Repos with a visible trace are about eight times bigger than the rest. Taking them out brings 2026 back toward normal, from to lines at 90 days, but not all the way: that's still about twice 2024. The likely reason is that many developers and agents leave no obvious mark. Code pasted from a chat, Cursor without a rules file, an agent whose commits carry the user's name: none of these show up. So is a floor for AI involvement, not an estimate of it.
Most common traces in 2026: . A repo can have several. For years before 2026 only traces present by day 90 are counted, so older repos touched by agents recently don't inflate the past.
The README hunch
Going in, I had a hunch from browsing: agents write long READMEs, even for tiny repos. The data backs it up.
The median README was ~220–270 bytes in 2016–2020, a title and a line or two. It reached in 2025 and in 2026. In repos with a visible AI trace the median is ~3.8 KB, against ~1.4 KB in 2026 repos without one, and 46% have a README of 3 KB or more (20% without a trace).
An ML exercise, three ways
To see the "more lines" pattern up close, I took a small tabular machine-learning exercise from a written brief (predict how a product's sales respond to a price cut) and did it three ways: once myself, back in April 2022, before ChatGPT was even released (so no AI help at all), worked through the way a finished repo would be. Then twice with agents in 2026, one shot each, which is what you get when you prompt a script instead of cloning one: once running freely from the brief, and once given light guidance to match my approach (the same list of models to try).
| Solution | Lines of code | Best model | R² (test) | Mean abs. error |
|---|---|---|---|---|
| Me | 197 | Random forest, default settings | 0.887 | 0.864 |
| Agent, guided | 310 (1.6×) | Random forest, tuned | 0.856 | 1.007 |
| Agent, free run | 444 (2.3×) | Blend of a linear model and gradient boosting | ~0.80* | 1.094 |
Lines exclude blanks and comments. * Estimated from its error, as it reported R² on a different scale. The agents also chose a stricter test split (holding out whole products), which makes their task somewhat harder; the point here is the amount of code, not a leaderboard.
I'm not claiming to be better than Opus. For one shot and a few minutes, what the agents produced is more than I could ever have done in that time. But it isn't better than a problem someone has already worked out, which is what a good repo gives you. It also shows the pattern from the GitHub data at small scale: for a similar task, agents add more lines, and more lines doesn't automatically mean better code. More code is more to read, review and maintain, whoever wrote it.
On the other hand, traced repos are tested more often: of 2026 repos with an AI trace have test files, against without one (CI: vs ). Agents write tests when asked to build something properly, which is a point for generating your own code, as long as you ask for tests.
3Clone it or prompt it?
Back to the original question. Two things decide it: how much code an agent can write for you in a sitting, and how trustworthy the alternative is.
One window of code
Claude's paid plans have a rolling 5-hour usage limit, published only as multiples of the Pro plan [7]. Using a third-party measurement of what a window is worth at API prices (~$12 for Pro, ~$60 for Max) [8], and my own Claude Code logs for how much code a dollar buys (~ lines of code per dollar with Claude Opus 5.5, about output tokens per line written), a single window is worth roughly:
| One 5-hour window | Lines (midpoint) | 2026 repos that fit | Range | 2024 repos |
|---|
In other words, more than half of what people publish today is small enough for one Pro window, and more than four in five for one Max window. The comparison is generous to the agent (a window counts every line written, including rewrites, while a repo's size is only what survived), so read the low end of the range as the safer figure. Ultra has no 5-hour limit at all, and OpenAI's Codex meters messages rather than usage, with a similar ballpark on its Plus plan [12].
How tested are new repos?
For the repos with code in the age-matched subsample (~1,800 from 2020 and 2024–2026, 570 of them from 2026), I looked for test files, CI configuration, a license file and dependency lockfiles.
| 2026 repos with code | Repos | Any tests | CI | Tests and CI | License |
|---|
Small repos, the kind you'd most likely find and want to borrow, are the least tested: of 2026 repos under 1,000 lines have any test file, and have a license. Without a license you have no right to reuse the code at all [13].
Risks of cloning a new repo
- Unknown quality: three in four have no tests and almost none have users.
- No license: nearly nine in ten can't legally be reused [13].
- Supply-chain attacks: 149,329 malicious open-source packages were logged in Q3 2026 alone [14].
- Someone else's problem: you inherit their assumptions, and code you don't need.
Risks of prompting your own
- Security gaps: AI-generated code passed security tests only ~56% of the time in 2026 [15].
- Invented packages: models recommend dependencies that don't exist 5–22% of the time [16].
- Maintenance is yours: every generated line is one you own.
- Untested unless you ask: generated code becomes trustworthy only once you've seen its tests run.
Rule of thumb
The chicken-and-egg problem is the deciding factor. A new repo's value used to be that a person had already thought the problem through. If an agent wrote it, cloning gets you a generic version of something you could have prompted for yourself, tailored to someone else, and usually untested. So:
| Situation | Better choice | Why |
|---|---|---|
| Small tool, script, glue code or UI for your own workflow | Prompt your own, with tests | Fits in one window or less and is tailored to you. A random new repo of that size is usually untested, unlicensed and possibly agent-written anyway. |
| Security-critical or standards-heavy: auth, crypto, parsing, payments, protocols | Use an established library | Its value is years of edge cases and bug reports from real users, which no single session reproduces. |
| Big, mature project: many users, regular releases, tests, CI, a license | Clone or depend on it | Others have already tested it in production, and maintenance is shared. |
| New repo that does almost what you want, with a license | Use it as a reference | Have the agent read it and write your version, keeping the ideas and the attribution the license asks for. |
| New repo with no license | Don't copy it | You have no right to reuse it. Build your own from the idea. |
Before cloning a new repo, check: a license; tests and CI that actually run; more than one contributor or some real users; commits after the first week; dependencies you recognise. Under 10% of 2026 repos with code pass even the first two.
Limitations
- Lines of code are estimated from language bytes (±26% for a typical repo), not counted. The error is similar across years, so trends hold better than single values.
- AI traces are a floor. Only tools that leave a signature or an instruction file are detected.
- Timing isn't cause. Model releases line up with the jumps, but other things changed at the same time.
- Lines per window come from one person's logs: about six weeks of my own mixed work, almost all on Opus 5.5, so the Sonnet figures are scaled rather than measured. The value of each plan's window is a third-party measurement, and Anthropic adjusts limits.
- The ML exercise is a single comparison: one shot per agent against my worked-out solution, and the agents used a stricter test split than I did.
- Monthly counts are what GitHub search returns today, so repos deleted or removed as spam since are missing. That undercounts older months slightly, not enough to explain a tripling.
- Some 2026 model release dates come from a single source (notably GPT-5.3-Codex).
- Not measured yet: whether repos tripled because more people publish, or the same people publish more. That needs GitHub user growth, and is a good follow-up.
Detailed reports
Every number above comes from these, with full methods, confidence intervals and data.
Sources
- Understanding the search syntax, GitHub Docs:
created:date-range search used for sampling and monthly counts. Data collected 2026-11-02. - List repository languages, GitHub Docs: bytes of code per language.
- Linguist: Overrides, GitHub Linguist: which files count toward language statistics.
- Get a tree, GitHub Docs: Git trees API, used to read each repo as it was 7, 90 and 365 days after creation.
- AGENTS.md: an open format for instructions to coding agents, used by Codex, Cursor, Jules and others.
- Claude Code settings, Anthropic Docs: the co-authored-by attribution Claude Code adds to commits.
- What is the Max plan?, Claude Help Center, and Claude pricing, Anthropic: plan limits as multiples of Pro, and API prices. Accessed 2026-11-03.
- Claude Usage Limits (November 2026), Measured, Wokey: API value of subscription limits on real accounts, updated 2026-11-02. Third-party.
- Claude (language model), Wikipedia: Claude release dates. Accessed 2026-11-03.
- OpenAI GPT Model Release Timeline, Hidekazu Konishi, updated 2026-10-20; cross-checked with Wikipedia's GPT-6 page. GPT-5.3-Codex from third-party trackers only.
- Gemini (language model), Wikipedia: Gemini release dates. Accessed 2026-11-03.
- ChatGPT Work and Codex pricing, OpenAI: Codex messages per 5 hours by model. Accessed 2026-11-03.
- Licensing a repository, GitHub Docs: without a license, default copyright applies.
- Q3 2026 Open Source Malware Index, Sonatype, 2026-10-08.
- 2026 GenAI Code Security Report, Veracode, July 2026.
- We Have a Package for You! Package Hallucinations by Code Generating LLMs, Spracklen et al., USENIX Security 2025.