Key takeaways
- 13% of PRs come from background agents (Feb 2026) — among the highest company-wide figures publicly disclosed
- Work mix spans full-stack product features, security & infra patches, and agent/dev tools building themselves
- March 2026 engineering post details a Claude Code SDK planning CLI that generates all design reviews company-wide
FAQ
What percentage of Abnormal AI's PRs come from coding agents?
13% of pull requests at Abnormal AI come from internal background agents, as disclosed by VP of AI Shrivu Shankar in February 2026 — among the highest company-wide percentages publicly reported at the time.
What do Abnormal AI's coding agents work on?
Per the February 2026 disclosure, a mix of full-stack product features, security and infrastructure patches, and the agent/dev tools building themselves.
What infrastructure does Abnormal AI use for their agents?
Background agents execute phased PRs in containerized environments, driven by a Claude Code SDK-based planning CLI. The February 2026 announcement thread reportedly described a migration from GitHub Actions to Modal; that migration has not been independently confirmed as of June 2026.
Executive Summary
Abnormal AI (cybersecurity company) disclosed in February 2026 that 13% of their pull requests come from internal background agents — among the highest company-wide percentages publicly reported at the time.[1] The disclosure came from Shrivu Shankar, VP of AI at Abnormal AI, who described the work as "a healthy mix" of full-stack product features, security & infra patches, and "the agent/dev tools building itself."[1][2]
Since then, Abnormal launched an engineering Substack ("Abnormal Builders") and published architectural detail in March 2026: a Claude Code SDK-powered planning CLI, markdown system files (ARCHITECTURE.md, SECURITY.md, LEGAL.md, PLAN.md) in a .ai-dev/ directory, a Zoom bot that feeds design-review meetings into weekly system-file updates, and background agents that execute phased PRs in containerized environments.[3]
| Attribute | Value |
|---|---|
| Company | Abnormal AI |
| Industry | Cybersecurity |
| Adoption | 13% of PRs (as of Feb 2026) |
| Work Mix | Product features, security/infra patches, agent tooling |
| Infrastructure | Claude Code SDK CLI + containerized background agents; reported GHA → Modal migration (unverified) |
Product Overview
Abnormal AI's background agents pair a high disclosed adoption rate with an unusually spec-driven workflow. The March 2026 engineering post describes a system where design docs, not prompts, are the primary interface: engineers invoke a planning CLI (locally or via Slack/Jira), organizational constraints are enforced through markdown system files before any code is generated, and background agents then execute the plan as phased PRs.[3] The self-improving aspect — agents building their own dev tools, and a weekly pipeline that updates the system files from meeting recordings, Slack threads, and PR comments — suggests a maturing internal platform.[1][3]
Key Capabilities
| Capability | Description |
|---|---|
| Spec-driven planning | Claude Code SDK CLI generates design docs/plans from markdown system files |
| Self-improvement | Agents build their own dev tools; system files updated weekly by agents |
| Full-stack features | Complete feature development via phased background-agent PRs |
| Security patches | Security and infrastructure fixes |
| Review annotation | PR annotator agent posts inline comments on non-obvious decisions and spec deviations |
Work Categories
| Category | Example |
|---|---|
| Full-stack product features | New product capabilities |
| Security & infra patches | Security fixes, infrastructure maintenance |
| Agent/dev tooling | The platform building itself |
Note: an earlier version of this profile described these as three distinct user personas (engineers, security analysts, MLEs); the verbatim disclosure describes them as categories of agent-authored work, not user groups.
What We Know
| Aspect | Known | Unknown |
|---|---|---|
| Adoption rate | 13% of PRs (Feb 2026) | Total PR volume; merged-vs-opened basis |
| Work mix | 3 categories of agent work | Volume per category |
| Planning layer | Claude Code SDK CLI, .ai-dev/ system files, Zoom bot pipeline | Model mix, cost |
| Execution | Containerized background agents, phased PRs | Sandbox provider (GHA → Modal migration reported but unverified) |
| Self-improvement | Agents build own tools; weekly system-file update PRs | Specific mechanisms |
Public Announcement
From Shrivu Shankar (VP of AI, Abnormal AI), February 11, 2026 — verbatim:[1]
"% of prs by background agents is clearly the new metric for ai-native engineering — pulled ours for Abnormal AI -- 13%! a healthy mix of: full-stack product features, security & infra patches, the agent/dev tools building itself"
March 2026: Design-Doc Pipeline Disclosed
The Abnormal Builders post "Our Design Docs Write Themselves" (March 2, 2026) is the most detailed public look at the system. Per the post, all design reviews and technical plans company-wide are generated through the planning tool, and:[3]
"What used to be a multi-week design-review-implement cycle is now something engineers on our team do in a day."
Adoption Comparison
Abnormal AI's 13% was among the highest company-wide figures when disclosed, though it is no longer the top reported number:
| Company | Metric | Value | Source |
|---|---|---|---|
| Ramp | % of merged PRs | >50% (as of 2026) | Blog post |
| Abnormal AI | % of PRs | 13% (Feb 2026) | X/Substack announcement |
| Coinbase | % of PRs | 5% | X announcement |
| Stripe | PRs/week | 1,000+ | Blog post |
Note: Repo scope differs across companies — Ramp's figure may be scoped to specific repos, while Abnormal AI's 13% appears to be company-wide.
What Developers Say
Public practitioner commentary is thin. The primary voices are Abnormal's own builders:
- Shrivu Shankar (VP of AI), on the metric itself: "% of prs by background agents is clearly the new metric for ai-native engineering"[1]
- From the engineering team's March 2026 post: "What used to be a multi-week design-review-implement cycle is now something engineers on our team do in a day."[3]
Absence note: As of June 11, 2026, there is no substantive independent practitioner discussion — the Hacker News submission of "Our Design Docs Write Themselves" drew 2 points and zero comments, and no third-party engineers have publicly corroborated the 13% figure or the workflow.
Strengths
- High disclosed adoption — 13% of PRs (vs. Coinbase 5%) demonstrates significant production impact
- Spec-driven workflow — Design docs and markdown system files as the agent interface, with constraints enforced pre-generation[3]
- Self-improving — Agents build their own tools; system files updated weekly by an automated pipeline
- Broad work mix — Product features, security/infra patches, and platform tooling all agent-authored
- Now documented — The promised architectural detail arrived via the Abnormal Builders Substack (March 2026)
Cautions
- Limited independent validation — All public detail comes from Abnormal's own posts; no third-party corroboration of the 13% figure as of June 2026
- Infrastructure uncertainty — The reported GHA → Modal migration has not been confirmed in subsequent posts; the March 2026 post says only "containerized environments"
- Metric ambiguity — Whether 13% counts merged or opened PRs is not specified in the verbatim disclosure
- Cybersecurity domain — Patterns may include domain-specific elements not transferable
- Not for sale — Internal tooling only
Competitive Positioning
vs. Other In-House Agents
| System | Differentiation |
|---|---|
| Stripe Minions | Stripe measures volume (1,000+/week); Abnormal measures percentage |
| Ramp Inspect | Ramp at >50% (scope unclear); Abnormal at 13% company-wide |
| Coinbase | Coinbase at 5%; Abnormal ~2.5x higher |
What Makes Abnormal's Approach Notable
- Company-wide metric — Not limited to specific repositories
- Spec-first — Design docs generated and enforced before code, unusual among disclosed systems
- Self-improving — Platform builds itself, compounding gains
Ideal Customer Profile
This is internal tooling, not a product for sale. The pattern is worth noting if:
Relevant indicators:
- Want a spec-driven (design-doc-first) agent workflow rather than prompt-driven
- Interest in self-improving agent infrastructure
- Cybersecurity or similar domain with compliance requirements (markdown
SECURITY.md/LEGAL.mdconstraint files) - Want a company-wide adoption benchmark to target
Limited applicability:
- Need full architecture specifications (sandbox provider, model mix, and cost remain undisclosed)
- Pure prompt-to-PR workflows (see Stripe/Ramp for simpler patterns)
Viability Assessment
| Factor | Assessment |
|---|---|
| Public Documentation | Improving (X/Substack announcement + Abnormal Builders engineering post) |
| Adoption Metrics | Strong (13% of PRs as of Feb 2026) |
| Architecture Detail | Partial (planning layer documented; execution layer mostly undisclosed) |
| Spec-driven Design | Unique differentiator |
| External Validation | Limited |
The 13% metric and the spec-driven planning pipeline provide useful benchmarks; execution-layer details (sandboxing, orchestration) remain undisclosed.
Bottom Line
Abnormal AI's 13% PR adoption (February 2026) remains one of the highest company-wide figures publicly disclosed for background coding agents, though Ramp has since reported >50%. The distinctive contribution is the spec-driven workflow documented in March 2026: design docs generated by a Claude Code SDK CLI against enforced markdown system files, with background agents executing phased PRs and an annotator agent explaining deviations in review.
Key metric: 13% of PRs from background agents (as of February 2026).
Key insight: Treating design docs — not prompts — as the agent interface, with self-updating system files, compounds adoption gains.
Recommended reference for: Organizations exploring spec-driven agent workflows, teams with compliance constraints to encode, companies benchmarking company-wide agent adoption.
Not recommended for: Teams seeking full execution-layer architecture guidance (see Stripe/Ramp).
Outlook: The Abnormal Builders Substack (launched ~March 2026) is now the channel to watch; the design-docs post suggests more architectural disclosure is coming.
Research by Ry Walker Research • methodology
Disclosure: Author is CEO of Tembo, which offers agent orchestration as an alternative to building in-house.
Sources
- [1] Shrivu Shankar Substack note: % of PRs by background agents (Feb 11, 2026)
- [2] Abnormal AI Background Agents Announcement (X/@ShrivuShankar)
- [3] Our Design Docs Write Themselves (Abnormal Builders Substack, Mar 2, 2026)
- [4] Shrivu's Substack (VP of AI at Abnormal AI — coding agents and LLM systems)