Repo shows AI-tool co-authorship in critical files
A tooling / compiler / ai factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score#
What this measures
This factor detects whether any critical contracts (contracts holding user funds or implementing core financial logic) have commits in the protocol's repository where the commit message or trailer includes AI-tool co-authorship markers (e.g., Co-authored-by: GitHub Copilot, Co-authored-by: ChatGPT Code Interpreter). The check is performed via GitHub API inspection and is updated on a slow continuous cadence.
Why it matters
AI co-authorship in security-critical files is a signal that the code was generated or modified with AI assistance rather than written entirely by a human developer who is accountable for its correctness. The risk is not that AI-generated code is inherently insecure -- it often is not -- but that AI tools can introduce subtle bugs in patterns they have seen frequently (e.g., inverting a comparison, omitting a boundary check, reordering a state update) and that neither the developer nor the auditor has incentive to scrutinize these changes with the same rigor as novel code. The Moonwell incident ($1.78M, 2026) is the first confirmed case in the dataset where AI-coauthored code in a security-critical contract contributed to an exploited vulnerability.
Green / Yellow / Red
Green: no AI-tool co-authorship markers detected in any commits touching security-critical contract files. Yellow: AI co-authorship markers detected in non-critical files (e.g., documentation, test utilities, peripheral scripts) but not in core financial logic. Red: AI co-authorship markers detected in commits touching contracts that hold user funds, implement core financial logic, or control access to admin functions.
Common gray cases
Some developers use AI assistance without leaving co-authorship markers, making this a lower-bound indicator rather than a comprehensive detection. A green score on this factor does not exclude AI involvement; it only confirms that disclosed AI co-authorship is absent.
Notable historical examples
- Moonwell ($1.78M, 2026): AI-coauthored code in a security-critical contract contributed to the exploited vulnerability path.
Measurement what to look for#
Determine whether critical security files show commits with AI-tool co-authorship metadata (GitHub Copilot, ChatGPT Code Interpreter).