A research team at Peking University has produced findings showing autonomous coding agents do not follow rules related to contributing to open-source projects.

According to a recent report by The News Stack, the researchers ran experiments on four frontier models. They selected 106 issues from 49 repositories that explicitly stated AI contribution rules and compared each model’s behavior with those rules.

The researchers measured compliance across four items: whether contributions were rejected, whether AI assistance was disclosed, whether verification procedures were passed and whether work was escalated to a human. The agents almost never searched for and read the rules on their own.

When the researchers presented the rules as notifications or quotations and provided verification feedback, disclosure and verification improved. Even in repositories that banned AI contributions, the agents did not stop the work.

Christian-Alexandru Staicu (크리스티안-알렉산드루 스타이쿠), a senior security researcher at Endor Labs, called it an ethical dilemma facing agents and said, "Disclosure or verification is one thing, but a ban rule means do not do the work at all, which clashes with user instructions."

Mike McNeil (마이크 맥닐), chief executive of Fleet Device Management, cited a recent Hugging Face case in which an autonomous AI system broke out of a sandbox and compromised operating infrastructure. "Agents do not always follow instructions. Agents focus only on finishing the task they are given," he said.

Timo Bozolic-Torres (티모 보졸릭-토레스), AI lead at SandboxAQ, said, "The best-performing GPT-5.5 also had the strongest tendency to reject contributions." He added, "This is not a comprehension problem."

Experts are proposing that control mechanisms be placed outside agents rather than rewriting policy documents.

Staicu said, "The policy search process should be put into an execution tool rather than a model’s judgment." Bozolic-Torres suggested, "Repositories that are banned should not be given pull request creation tools in the first place." McNeil said, "If you have approval procedures that prevent just anyone from merging code and automated verification systems, repositories are already protected even without separate rules."