AI Coding Agent Instruction File Adoption Report — Q3 2026

What the GitHub match counts mean

The headline numbers come from GitHub's public code-search API at one point in time. A repository can contain more than one matching file, generated copies can be indexed, forks may be present, and GitHub does not expose the total number of eligible repositories for these queries. For those reasons, dividing a match count by a guessed repository total would create a false adoption rate.

Use the counts as a reproducible search-visibility snapshot: they show how many indexed files matched the exact query when collected. Use the sample analysis to form hypotheses about instruction quality, then validate those hypotheses in a random or stratified study before making population claims.

What the 400-file sample found

All 100 AGENTS.md and CLAUDE.md sample files were readable. The Copilot query produced 99 readable files and the Cursor query produced 100. Every query also produced 99 or 100 unique repositories within its own sample, reducing—but not eliminating—duplicate-repository effects.

Explicit verification and security guidance were often absent. In the AGENTS.md sample, 68% lacked a detected security or approval rule and 53% lacked detected verification or completion criteria. In the Cursor rule sample, 87% lacked a detected security or approval rule, 83% lacked detected completion criteria, and 75% lacked an explicit test command. These are deterministic text detections, not judgments about repository quality.

Test commands and security patterns

The most frequently detected test command in sampled AGENTS.md files was pytest at 11%, followed by cargo test at 10% and go test at 7%. The top detected AGENTS.md security category was secrets and credentials at 24%. CLAUDE.md most often named npm test at 12%, while production restrictions appeared in 36% of its sample.

A missing text pattern does not prove that a repository lacks tests or security controls; the rules may live in CI, contributor documentation, policy tooling, or another instruction file. The report measures whether the sampled file itself gives an agent an explicit, recognizable command or boundary.

How to use this report

Benchmark your own instruction file against five practical categories: setup, explicit test commands, completion criteria, scope or precedence, and security or approval rules. Copy only controls that are true for your repository, and run each command from a clean checkout before publishing it to an agent.

For research or citation, download the JSON to preserve the query totals, methodology, summaries, limitations, and raw rows together. Use the CSV when you need repository URLs and detected signals for independent analysis. Always cite the snapshot date and the best-match sampling limitation next to any percentage.

How to cite and verify this release

Preferred citation: KyenAI. (2026). AI Coding Agent Instruction File Adoption Report — Q3 2026 (Version 2026-Q3) [Data set]. https://www.kyenai.com/guides/ai-coding-agent-instruction-file-adoption-report-2026

This release has no DOI, so use the canonical report URL as its stable identifier. Download the BibTeX or Citation CFF record for a reference manager; use the manifest and SHA-256 file to verify the JSON, CSV, and published generator before analysis or redistribution.

Execution steps

Common pitfalls

Implementation checklist

• Name the exact GitHub query and snapshot date.
• Separate indexed file matches from unique sampled repositories.
• State that GitHub best-match ordering is not random.
• Keep sample percentages tied to readable-file denominators.
• Describe regex detections as signals, not quality judgments.
• Link the downloadable raw rows and methodology.
• Regenerate before citing the figures as current.