Paper · AI agent tools

Inside the AI companies’ own agent tools: half a million statements (LLOC) in six months!

OpenAI’s Codex added 509,558 logical statements in six months, 399,199 of them Rust. Four fast-growing Rust projects that are not AI products added 36,005 to 65,979 statements of Rust over the same six months.

27 October 2026 · measured with CodeDelta 2.6.4 on the public repositories at their last commit before 27 April 2026 and their latest commit on 27 October 2026

The AI companies’ models are not public. The tools built around them are: the coding agents that run in a developer’s terminal and the software kits for building agents. Ten of them were measured, statement by statement, six months apart, beside a control group of five fast-growing projects that are not AI products.

What was measured

Company	Repository	What it is	Main language
OpenAI	openai/codex	Codex, the coding agent	Rust
OpenAI	openai/openai-agents-python	Agents SDK	Python
Google	google-gemini/gemini-cli	Gemini CLI, the coding agent	TypeScript
Google	google/adk-python	Agent Development Kit	Python
Anthropic	anthropics/claude-agent-sdk-python	Claude Agent SDK	Python
Anthropic	anthropics/claude-code	plugins, mods and examples for Claude Code	TypeScript
Anthropic	anthropics/sandbox-runtime	the sandbox Claude Code runs commands in	TypeScript
Anthropic	anthropics/claude-code-action	Claude Code’s GitHub Action	TypeScript
Anthropic	anthropics/skills	Agent Skills	Python
Microsoft	microsoft/autogen	AutoGen agent framework (archived)	Python

Claude Code itself is not in its repository: the program ships ready-built through npm, and the repository holds its plugins, mods and examples. AutoGen’s only commit since April, on 16 October, notes that it is archived and no longer maintained; its code did not change. Each repository was measured at the last commit on its main branch before 27 April 2026 and at its latest commit when measured on 27 October 2026; every commit is listed in the references.

Six months of growth

Repository	Files, April	Files, October	Statements added	of them in the main language
openai/codex	4,027	9,647	509,558	399,199 Rust
google/adk-python	1,647	3,036	306,523	217,169 Python
openai/openai-agents-python	1,300	1,696	189,692	137,499 Python
google-gemini/gemini-cli	2,751	3,037	45,792	30,546 TypeScript
anthropics/claude-code	191	1,601	10,858	7,903 TypeScript
anthropics/sandbox-runtime	63	378	9,233	7,277 TypeScript
anthropics/skills	390	445	4,613	3,980 Python
anthropics/claude-code-action	182	225	4,135	2,757 TypeScript
anthropics/claude-agent-sdk-python	122	160	8,567	7,182 Python
microsoft/autogen	1,837	1,837	0	0

LLOC counts statements, not lines: one statement split over three lines counts once, and three statements on one line count three times. Configuration and data files such as JSON and YAML count one statement per line, so the totals include them; the last column counts the main language only.

The control group, over the same six months:

Repository	What it is	Files, April	Files, October	Statements added	of them in the main language
biomejs/biome	web code formatter and linter	22,977	34,024	141,433	65,979 Rust
denoland/deno	JavaScript runtime	11,794	14,952	99,751	41,659 Rust
astral-sh/uv	Python package manager	1,284	1,881	173,113	38,131 Rust
astral-sh/ruff	Python linter	10,491	11,273	142,086	36,005 Rust
vitejs/vite	web build tool	2,613	2,910	6,402	1,932 TypeScript

Why the report shows 9,586 files and the growth table 9,647: the table counts every file in the repository, while CodeDelta measures only the project’s own code. It skips code copied in from other projects, hidden settings folders, pictures and empty files.

Codex added 6.1 to 11.1 times as many statements of Rust as any of the four Rust projects in the control group, and more than doubled its file count. Google’s Agent Development Kit added more Python than any control project added of its main language.

Low REWORK, and why it is not evidence of AI

REWORK is the share of churn made by editing existing statements in place, rather than deleting or adding them.* Established hand-maintained projects sit near 17% (paper C). Every AI company tool measured here is far below that in its main language:

AI company tool	REWORK	Control	REWORK
openai/codex (Rust)	2.4%	biomejs/biome (Rust)	3.2%
google/adk-python (Python)	2.6%	astral-sh/uv (Rust)	3.6%
openai/openai-agents-python (Python)	3.2%	denoland/deno (Rust)	3.7%
anthropics/claude-agent-sdk-python (Python)	6.5%	astral-sh/ruff (Rust)	13.0%
google-gemini/gemini-cli (TypeScript)	7.5%	vitejs/vite (TypeScript)	25.2%
anthropics/sandbox-runtime (TypeScript)	1.8%
anthropics/skills (Python)	3.4%
anthropics/claude-code-action (TypeScript)	4.9%

The control group is low too. Three of the four Rust projects sit between 3.2% and 3.7%, beside Codex’s 2.4%. When a project adds code fast, the added statements swell the total and the edited share shrinks, whoever or whatever writes the code. Codex edited 13,165 statements in place over the six months; against 509,558 added, that is a small share. Paper C found the same in projects measured before AI coding tools existed: esbuild 1.6%, deno 4.0%. A low REWORK figure alone proves nothing about how code was written.

* CRN_LLOC = CHG_LLOC + DEL_LLOC + ADD_LLOC. REWORK = CHG_LLOC ÷ CRN_LLOC, here counted over the repository’s main language only.

How much of it carries an AI signature

Some AI coding tools add a line such as Co-Authored-By: Claude to the commits they make. Counted over the same six months:

Repository	Commits	With an AI co-author line
anthropics/claude-agent-sdk-python	448	90 (20.1%)
google-gemini/gemini-cli	613	76 (12.4%)
anthropics/skills	29	3 (10.3%)
anthropics/claude-code-action	268	23 (8.6%)
openai/openai-agents-python	1,162	40 (3.4%)
anthropics/sandbox-runtime	648	19 (2.9%)
openai/codex	6,929	128 (1.8%)
google/adk-python	2,433	0 (0.0%)
biomejs/biome (control)	1,512	104 (6.9%)
astral-sh/uv (control)	2,286	100 (4.4%)
vitejs/vite (control)	640	13 (2.0%)
denoland/deno (control)	1,740	32 (1.8%)
astral-sh/ruff (control)	2,766	32 (1.2%)

These lines are voluntary and easy to remove, so the count is a floor, never a total. On that floor, the AI companies’ tools are not visibly more agent-written than the control group: Codex, at 1.8%, sits beside deno.

Two of the repositories are not where the work happens. Every one of the latest 300 commits in Google’s Agent Development Kit was committed by Copybara-Service and carries a PiperOrigin-RevId: the code is exported from Google’s internal system. Every one of the latest 300 in Codex was committed by an export account named copyberry. The commits still name their individual authors. Their co-author lines show what the export keeps, not how the code was written.

What the Agent Scan found

CodeDelta’s Agent Scan read every file of the ten repositories as they stand today. It found no CRITICAL result in any of them: no model output passed to a command or to eval in the pattern the scan treats as rogue. The HIGH and ELEVATED results mark files that call an AI model, which is what these tools are for:

Repository	Files scanned	CRITICAL	HIGH	ELEVATED	Credential matches
openai/codex	9,597	0	4	183	94
google/adk-python	3,036	0	299	1,139	8
google-gemini/gemini-cli	3,033	0	3	235	26
microsoft/autogen	1,837	0	40	236	0
openai/openai-agents-python	1,697	0	166	377	0
anthropics/claude-code	1,601	0	0	3	0
anthropics/claude-agent-sdk-python	160	0	74	21	0
anthropics/skills	445	0	3	15	0
anthropics/sandbox-runtime	328	0	0	0	2
anthropics/claude-code-action	225	0	0	12	42

Credentials. The scan looks for the formats of real keys and tokens wherever they sit, and names each match with its file and line. It found 172 in five of the ten repositories, and every one, checked by hand, is a test value: placeholders such as ghp_xxxx… and sk-proj-fedramp-synthetic-test-key in OpenAI’s and Google’s code; a key inside Codex’s test code that signs test sign-in tokens; made-up tokens in the part of Claude Code’s GitHub Action that strips tokens from output, and in the tests that prove it works; and in Anthropic’s sandbox, a test certificate authority committed on purpose and a deliberately broken key file containing only AAAA.

Hidden calls in encoded text. AI-driven malware can hide its calls to a model inside base64, where a plain text search never finds them. The Agent Scan decodes base64 and reads what is inside. In Codex it decoded seven such strings, in six files, to the address of OpenAI’s service and reported each with its file and line. All seven turned out to be sample sign-in tokens in Codex’s tests, for made-up accounts such as [email protected]: checked and cleared in minutes, exactly as a reviewer should be able to.

What this does not show

One six-month window cannot say whether these rates last. File counts include every file in the repository, not only source. The AI co-author count is a floor, and a project that squashes or rewrites commits can lose those lines entirely. Nothing here measures quality: a statement added is a statement added.

Disclaimer. Every figure here was measured from public data gathered on GitHub and npm on 27 October 2026, at the commits listed below. That data was taken to be current, true and reliable as published; CodeDelta did not verify it independently and cannot vouch for it. The figures describe the code in those repositories at those commits, nothing more: they are not a statement about any company, its staff or its practices, and no company named here took part, endorsed or reviewed this paper. Product and company names belong to their owners. Corrections are welcome and will be published with a dated revision note.