Repo shows AI-tool co-authorship in critical files

Methodology how we score #

**What this measures** This factor detects whether any critical contracts (contracts holding user funds or implementing core financial logic) have commits in the protocol's repository where the commit message or trailer includes AI-tool co-authorship markers (e.g., Co-authored-by: GitHub Copilot, Co-authored-by: ChatGPT Code Interpreter). The check is performed via GitHub API inspection and is updated on a slow continuous cadence.

**Why it matters** AI co-authorship in security-critical files is a signal that the code was generated or modified with AI assistance rather than written entirely by a human developer who is accountable for its correctness. The risk is not that AI-generated code is inherently insecure -- it often is not -- but that AI tools can introduce subtle bugs in patterns they have seen frequently (e.g., inverting a comparison, omitting a boundary check, reordering a state update) and that neither the developer nor the auditor has incentive to scrutinize these changes with the same rigor as novel code. The Moonwell incident ($1.78M, 2026) is the first confirmed case in the dataset where AI-coauthored code in a security-critical contract contributed to an exploited vulnerability.

**Green / Yellow / Red** Green: no AI-tool co-authorship markers detected in any commits touching security-critical contract files. Yellow: AI co-authorship markers detected in non-critical files (e.g., documentation, test utilities, peripheral scripts) but not in core financial logic. Red: AI co-authorship markers detected in commits touching contracts that hold user funds, implement core financial logic, or control access to admin functions.

**Common gray cases** Some developers use AI assistance without leaving co-authorship markers, making this a lower-bound indicator rather than a comprehensive detection. A green score on this factor does not exclude AI involvement; it only confirms that disclosed AI co-authorship is absent.

**Notable historical examples** - **Moonwell** ($1.78M, 2026): AI-coauthored code in a security-critical contract contributed to the exploited vulnerability path.

Measurement what to look for #

Determine whether critical security files show commits with AI-tool co-authorship metadata (GitHub Copilot, ChatGPT Code Interpreter).

Data & output #

Scored protocols 80 carry this factor #

Linked hacks 1 historical incident #