When Bots Join the Team: Bot Adoption and the Institutional Fabric of Open-Source Software Projects
Source: arXiv:2607.13679 · Published 2026-07-15 · By Yongren Shi, Wenyi Gong
TL;DR
This paper investigates how the adoption of automated bots as active participants influences the social organization and coordination capabilities of open-source software (OSS) projects on GitHub. Unlike prior work that views bots mainly as tools, this study treats bots as institutional participants and examines 2,991 projects over a five-year window centered on their first sustained bot adoption. The authors operationalize institutional coordination through three key behavioral capabilities: repeated engagement (stable participation), social memory (recognition and referencing of specific actors), and role differentiation (specialization of evaluative functions), and analyze two collective outcomes: conflict cascades (code overwrite conflicts) and output distinctiveness (novelty relative to peer projects).
The main findings reveal that bot adoption coincides with rapid, discrete increases in repeated engagement and social memory, along with greater recognition of specific bots in conversations. Role differentiation also strengthens. These capability improvements are associated with fewer conflict cascades and more distinctive project outputs, and the changes cluster tightly around the adoption event rather than evolving gradually, suggesting a structural institutional shift rather than project maturation. Importantly, the associations differ based on function: human-side repeated engagement explains the reduction in conflict, while bot-side inter-bot interactions drive increased output distinctiveness, highlighting a complementary human-bot institutional fabric. The paper carefully interprets these as precise associations rather than causal claims due to lack of untreated controls. Overall, it supports the view that predictable, rule-based bots become embedded as stable institutional participants in OSS communities, reinforcing social organization rather than eroding it.
Key findings
- After bot adoption, repeated engagement among human contributors rises from a pre-adoption mean of 0.224 to a post-adoption mean of 0.400 (Table 2), indicating more stable contributor overlap.
- Bot-directed social memory rises sharply post-adoption from 0.016 to 0.062 on average, showing greater human recognition and referencing of specific bots.
- Role differentiation scores increase after bot adoption, reflecting more specialized evaluative roles among contributors.
- Conflict cascade rates decline significantly after bot adoption, suggesting fewer destructive overwrite chains between contributors (Fig 3).
- Output distinctiveness among projects in the same subdomain increases post-adoption, indicating more innovative or non-redundant development patterns.
- Changes in capabilities and outcomes concentrate tightly around the adoption month, not progressing gradually over time (Fig 2 event-time trajectories).
- Controlling for repeated engagement and role differentiation indicators attenuates the association between bot intensity and conflict cascades to near zero (H5), suggesting human social organization mediates conflict reduction.
- Bot-to-human addressing predicts fewer conflicts while inter-bot interactions predict greater output distinctiveness, highlighting differentiated bot roles in coordination versus innovation.
Threat model
n/a — the paper does not address security threats or adversarial behavior, rather it analyzes the institutional role of bots as stable participants in collaboration.
Methodology — deep read
Threat Model & Assumptions: The study assumes a naturalistic setting with no explicit adversary; bots are treated as institutional participants rather than adversarial agents. The analysis focuses on whether the presence of rule-based, predictable bots changes the organizational fabric that sustains collaboration, not on security per se.
Data: The authors sample 3,000 GitHub repositories that adopted at least one bot between 2016 and 2025, drawn from a candidate pool of 657,115 (repo, bot) pairs identified in the GitHub Archive. After exclusions, 2,991 projects remain. These include three main bot categories: task-automating (78%), governance-participating (20%), and communication (2%). For each project, researchers extract 49 monthly snapshots spanning 24 months before adoption, adoption month T, and 24 months after.
Measures: They operationalize three key institutional capabilities with behavioral indicators: repeated engagement (measured by Jaccard similarity of active human contributors month-to-month and 3-month retention), bot-directed social memory (frequency of human comments referencing specific bots and their past behavior), and role differentiation (entropy deficit of contributors’ action types focused on review-state actions). Two outcomes are measured: conflict cascades (chains of line-level code overwrites within 30 days), and output distinctiveness (average pairwise distance in architecture, dependencies, comments, and review patterns vs same-subdomain projects).
Bot-side indicators capture bot-to-human directed interactions (mentions, assignments) and inter-bot interactions (bots acting on other bots’ outputs). Bot intensity metrics include bots’ thread participation share and bot events per active contributor month (ACM).
Architecture / Algorithm: The work is observational and empirical using event-study regression models centered on each project's adoption month (T). No new neural architectures or learning algorithms are introduced.
Training Regime: Not applicable—analysis is statistical over longitudinal behavioral data rather than supervised learning.
Evaluation Protocol: Event-time trajectories and difference-in-differences-style models compare pre- and post-adoption windows controlling for project fixed effects and bot categories. Outcomes are normalized by active contributors for comparability. No untreated control group exists, so estimates are interpreted as timed associations.
Reproducibility: Raw data from public GitHub Archive and GitHub APIs; no mention of released code but data provenance is clear. Bot identity lists and stratified samples are specified.
Example: For one project, authors identify the month T when a bot's activity becomes sustained (active that month plus 2 of following 6 months). They compute repeated engagement by measuring contributor set overlaps pre- and post-T, calculate conflict cascade rates from version control blame data, and extract bot-directed references from pull request comments. Event-study models then characterize shifts coincident with bot adoption, pooling results across 2,991 projects for robust inference.
Technical innovations
- Operationalizing AI-enabled bots as institutional participants with measurable social capabilities in OSS communities rather than passive tools.
- Developing behavioral indicators for institutional capabilities—repeated engagement, social memory, and role differentiation—derived from rich, public GitHub interaction data.
- Introducing bot-side trace indicators (bot-to-human addressing and inter-bot interactions) to distinguish bots’ contributions to coordination versus innovation.
- Using an event-study design centered on each project’s bot adoption month to isolate temporal associations between bot participation and shifts in social organization metrics.
- Linking fine-grained version-control line-level overwrite cascades as a novel behavioral proxy for collaboration conflict.
Datasets
- GitHub Archive 2016-2025 monthly data — 2,991 public GitHub repositories adopting bots — public source
Baselines vs proposed
- Pre-adoption repeated engagement: mean = 0.224 vs post-adoption mean = 0.400
- Pre-adoption bot-directed social memory: mean = 0.016 vs post-adoption mean = 0.062
- Conflict cascade rate declines significantly from pre- to post-adoption (exact metrics not provided; see Fig 3)
- Role differentiation score improves from pre- to post-adoption (exact values partially truncated but significant)
- Output distinctiveness increases post-adoption compared to pre (Fig 3 shows positive effect size)
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.13679.
Fig 1: displays the pooled event-time trajectories by bot category for all four constructs. Three
Fig 2: Event-study coefficients (relative to et = −1, with 95 percent confidence intervals) for
Fig 3 (page 18).
Limitations
- No untreated control group; bot adoption is endogenous to project conditions, so causal claims cannot be made.
- Indicators capture behavioral proxies of institutional capabilities rather than full institutional mechanisms like power, legitimacy, or identity.
- Bots studied are rule-based, domain-specific, non-conversational agents; findings may not generalize to more advanced AI.
- Bot categories differ in prevalence and function, but category-specific heterogeneity is not deeply analyzed here.
- Output distinctiveness measure may conflate innovation with idiosyncrasy or poor maintenance; external validation is recommended.
- Some data truncation and irregularities in measuring bot references and social memory create interpretive ambiguity.
- Focus on coordinative dimension ignores other institutional aspects relevant to governance or social hierarchy.
Open questions / follow-ons
- Do these institutional shifts translate to improvements in project quality, sustainability, or developer satisfaction?
- How do more cognitively capable or conversational AI agents influence institutional coordination compared to rule-based bots?
- To what extent do the findings generalize to other collaborative domains beyond OSS with different social and technical structures?
- What are the causal mechanisms by which bot adoption reorganizes human social processes—e.g., changes in norms, sanctions, or trust?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners, this work highlights that automated agents integrated visibly into team workflows can strengthen rather than weaken social organization. Bots with stable identities that repeatedly interact and specialize can become functional members of social institutions, reducing conflict and facilitating differentiated innovation. This suggests that distinguishing between automated participants as institutional actors versus background tools may be important in detecting coordination patterns. Behavioral indicators like repeated engagement, social memory from references, and role specialization could inspire anomaly detection features for automated versus human participant roles. However, the study focuses on cooperative, rule-based bots in open collaboration, so adversarial or evasion-focused bots may behave differently. Understanding these subtle social roles of bots may inform nuanced bot-detection techniques beyond raw volume or timing, considering interaction patterns and role diffusion in communities.
Cite
@article{arxiv2607_13679,
title={ When Bots Join the Team: Bot Adoption and the Institutional Fabric of Open-Source Software Projects },
author={ Yongren Shi and Wenyi Gong },
journal={arXiv preprint arXiv:2607.13679},
year={ 2026 },
url={https://arxiv.org/abs/2607.13679}
}