AgenTag paper: attributing AI coding agents from behavioral fingerprints

What happened on this date

At 03:35 UTC on 2026-08-02, arXiv received v1 of "AgenTag: Attribution of AI Coding Agents from Behavioral Fingerprints" (primary category cs.SE). The starting problem is that AI coding agents often open pull requests under a developer's own account, which blurs who actually produced a change. The paper evaluates on the AIDev dataset, with 33,580 PRs from five AI coding agents and 6,618 human-authored PRs, representing each PR through textual, behavioral and code-based features and comparing conventional classification with supervised contrastive learning. The abstract reports a weighted F1 of 0.96 (macro F1 0.84) for naming the authoring agent, a balanced F1 of 0.89 for separating AI from human PRs, and an AUC of 0.84 for detecting previously unseen agents. The more interesting finding is that PR descriptions and commit messages carry nearly all of the attribution signal, while code diffs contribute little, and that the fingerprints persist after explicit self-disclosure markers are removed.

Why it matters for people protecting app logic

The study looks at pull requests in repositories, not at binaries or cloned apps, so it does not show that AI-rewritten clones can be recognized. It does offer a useful boundary: in this dataset the distinguishing traces of an agent sat mostly in the prose around a change, not in the code. Read from the other side, if someone uses an agent to rewrite your core logic, the resulting code may carry no dependable "AI style" signal, and building a takedown or evidence case on style detectors is likely to be weak. Inside your own team the result points the other way: agent-authored changes are traceable when the surrounding metadata is kept, which matters when you need to know who touched obfuscation settings, keep rules or signing scripts. The paper covers only five agents, and the abstract makes no promise that the results transfer to other agents or private repositories.

Concrete checks

First, agree on how AI-assisted changes are labeled in your own repositories, such as a fixed commit trailer or PR label, instead of relying on inference after the fact. Second, treat obfuscation configuration, keep rules, signing and notarization scripts and the build pipeline as sensitive paths whose changes always need human review, whoever or whatever authored them. Third, if cloning is a concern, keep your own provenance evidence ready: signed release artifacts, build logs, internal commit history and dates are far stronger than an argument that something looks AI-written. Fourth, walk through the release process once and confirm that agent sessions cannot reach signing keys or store credentials directly.

Your checklist

• Agree on a fixed label for AI-assisted commits (trailer or PR label)
• Make obfuscation config, keep rules and signing scripts require human review
• Keep signed release artifacts and build logs as provenance evidence
• Confirm agent sessions cannot reach signing keys or store credentials