Study: Most AI Coding Projects Run With No Rules at All
AI now writes code at work — but almost nobody is supervising it.
AI coding agents (software that writes and edits code for you) are spreading quickly through the working world. A new study from three Spanish researchers looked at 5,435 public project folders on GitHub — a giant website where programmers store and share code — pulled from a wider pool of 116,211. They searched for eight ways teams supervise AI workers: writing rule files, keeping shared notes, spelling out exactly what finished work looks like, running several AI helpers side by side, and giving the AI more freedom only after it earns trust.
What they found was thin. Just 21.7% of projects showed even one of those practices. Among the most-watched projects, the number jumped to 65.3% — popularity clearly tracks with discipline. But almost nobody combined several practices together. Where instruction files existed, they mostly told the AI what to do and set basic ground rules. Things like lasting shared knowledge, formal acceptance checks, or step-by-step trust-building appeared in only a minority of projects.
Why should you care if you never touch code? Because more of the software you use — banking apps, work tools, customer systems — is now partly written by AI. When AI writes code with no rules attached, mistakes ship. The paper's real value is that it names the habits likely to become standard, and quietly hints at a new kind of job: people who manage, review, and set limits for AI workers.
The honest catch: the study counts files, not results. Having a rule file doesn't prove the software is better or safer — nobody has measured that yet. It also uses GitHub "stars" as a stand-in for popularity, which is a rough measure, and it only sees code that's publicly visible. So treat this as an early map of a young practice, not proof that guardrails pay off. They probably do. We just don't know how much.
- Only about 1 in 5 AI-assisted coding projects include any written instructions or limits for the AI.
- Popular projects do much better: 65% have at least one safeguard in place.
- Most teams use a single practice rather than a full system, so guardrails stay rare and piecemeal.
Why It Matters
As AI writes more workplace code, missing rules mean more bugs, security holes, and costly rework.