Research
As AI systems take on more of the work, how much do the people responsible for it still understand and check? We study that where it is furthest along: software, where coding agents now write, test and ship code with a person in the loop.
Measuring how much people engage with and oversee the work of coding agents, from public transcripts of real sessions.
When a coding agent delivers something, what does the person do? Read it? Run it? Ask why? Wave it through? And when the agent claims more than it did, or does something it should not have, does the person notice?
Every Claude Code session in the public SWE-chat dataset (SALT-NLP, arXiv 2604.20779), pinned to one release covering January 15 to April 19, 2026: several thousand sessions in all. The sessions were recorded and released by their users, and we add nothing private. User identifiers are hashed on ingest, and per-user figures are published only as distributions.
An episode: the agent delivers something the person could review (a finished edit, a claimed completion, a summary of changes, a request for approval), and the person responds, or the session ends. A correction loop is several episodes. Most metrics score episodes; sessions aggregate them.
| Metric | What it asks | Scored per |
|---|---|---|
| M1Response to delivery | How did the person respond to what the agent delivered: substantively, by verifying it, by accepting it, by moving on, or not at all? | Episode |
| M2Verification actions | How often did the person ask to see a diff, run the tests or the program, or run a command themselves? | Session |
| M3Overclaim caught | When the agent claimed more than it did (tests passing that never ran, a feature "done" that is absent), did the person challenge it? | Overclaiming delivery |
| M4Misbehavior addressed | When the agent did something risky or out of bounds (weakened a test, ignored a constraint, hid an error), did the person name it, reverse it or constrain the agent? | Misbehavior instance |
| M5Direction versus delegation | Is each human turn a direction, a question, an approval, or something else? And how long does the agent run between two turns that are not approvals? | Human turn |
| M6Expressed understanding | When the person responded substantively, did their words refer to specific behavior, files or consequences, or stay generic ("still broken, try again")? | Episode |
| M7Questions asked | How often did the person ask why or how, rather than what next? | Human turn |
| M8Time lag | How long did the person take to respond after the agent's last message, and were they running other sessions at the same time? | Human turn |
The metrics measure oversight behavior that is visible in the transcript. Comprehension itself is inferred only where a person's own words show it (M6), and the paper says so. Reading a diff in an editor leaves no trace in the transcript, so verification counts are a floor, not a ceiling.
Comprehension Audits to Mitigate Risks from Automated AI Research, by Ronald J. Bodkin, Bahrad A. Sokhansanj and Gillian K. Hadfield. Posted to arXiv on October 7, 2026 as 2610.10064.
AI already writes most of the code at frontier labs. When the people responsible for a contribution can no longer explain it, the oversight that safety depends on has quietly stopped. The paper proposes a way to detect that and to pace development by it: comprehension audits, in which the responsible people explain their R&D contributions to independent auditors to demonstrate understanding.
An audit covers one contribution (an experiment, a training change, a dataset integration), chosen by importance, by risk cues, at random or for stratified coverage. The contributors are notified at short notice and answer questions in a roughly 90-minute, non-adversarial meeting without AI assistance, something like a thesis defense or a design review. The auditors are technically qualified, independent and embedded with deep access, rotate periodically, and never audit work they contributed to. An audit review board oversees them and hears appeals.
A contribution passes, passes conditionally, fails, or cannot be assessed. On a failure, release of anything that depends on the contribution pauses until remediation is verified; repeated or critical failures can suspend a unit's release authority and require a rollback. Failures are not disciplinary, and anti-retaliation protections apply. Selective audits can also show whether understanding is declining across a lab as a whole.
The paper includes a short version of our analysis of public GitHub activity at 224 leading AI organizations: 1,278 repositories from 179 prominent AI developers and 857 AI-topic repositories from 45 larger organizations, in Q1 2024 and from Q4 2025 through Q2 2026. Q1 2024 is the control period: none of the AI detection techniques matched any pull request.
All rates are floors: only traceable AI use is counted, and local command-line use leaves no trace. The organizations are prominence-selected, so the findings describe practices at these organizations, not open source at large. The full analysis is not yet published; the paper carries the short version.
A short survey for R&D leaders on how their teams review code that agents wrote: who reads it, what gets checked, and what has changed in the last year. It takes a few minutes, and results are published only in aggregate.
Google Form · about five minutes · results published only in aggregate
A framework paper proposing a move from self-governance to a licensing regime for the largest AI developers, with approval required at defined stages of a model's life and requirements that scale with capability. It is offered to advance the conversation and invite refinement, not as a statutory draft.
Safety-critical licensing regimes approve when the evidence supports the safety case and decline when it does not. The FAA issues a type certificate on a structured safety analysis, the FDA approves a drug when the evidence meets the standard, and a reactor is licensed on its probabilistic risk assessment. Whole categories of designs sit unapproved in each regime while the engineering matures. The path to approval is to produce the evidence, not to negotiate the standard.
The paper applies the same logic to frontier AI. Stringency rises with capability because the potential harm does. Where the science needed to demonstrate safety is still immature, the most capable systems are not approvable today and become approvable as the science advances, which gives developers a direct reason to fund that science.
Its second tier turns on a measurable quantity: whether a model at least doubles end-to-end AI research productivity. The open-source analysis in Comprehension Audits is a first measurement of it: code submitted by regular contributors at leading AI organizations rose by a median of 183% between early 2024 and mid-2026.
Data and ethics
SWE-chat data is used under its ODC-By license and credited as SALT-NLP/SWE-chat, arXiv 2604.20779. Third-party material is identified wherever it appears.
We report counts, never user names, emails, repository names or session identifiers. User identifiers are hashed on ingest, and per-user figures are published only as distributions.
Every publication is reviewed for what it could teach a bad actor before it goes out. Code, prompts and labels are released only after that review, and some may be withheld.