Your First Pull Request Used to Be a Coin Flip
How to become a contributor on an open-source AI project — measured across 143,000 pull requests
Can a stranger still get into an open-source AI project? In early July 2026 I set out to find out — both by trying it myself and by measuring it at scale. I had Claude fetch the complete PR history of the GitHub repositories for eighteen major open-source AI projects and analyze every pull request across their whole history. Claude found roughly 143,000 PRs opened by external engineers who aren’t members of the project teams. Everything below is reproducible from the raw data; the method and its caveats are at the end, because a claim you can’t check is just a vibe with a decimal point.
For those who don’t know, pull requests — PRs — are how software engineers contribute to open source projects. Each PR represents a proposed change: a new feature, a bug fix, a documentation improvement. Getting one merged is how you become a contributor at all. And the headline finding, before any of the detail, is that landing your first one used to be close to a coin flip — but in 2026, on most projects, it’s now worse. Even so, I managed to get my first PR merged into a major AI project in less than a day.
Of those PRs, roughly 84,000 were merged. That number matters more than any other in this piece, because a merged PR is the currency an open source contributor is judged by — each one is a decision by the team to keep your change in their product. A PR that doesn’t merge ends in one of two other states: closed — shut without merging, which lumps together maintainer declines, authors withdrawing their own PRs, and procedural closes — or still open, meaning no decision has been made at all. GitHub has no reject button; those three states are the entire record.
Why I was the one knocking
A word on why a product manager was running this experiment on himself, because it shapes why one specific mechanism — the pull request — mattered so much to me.
I have a CS degree from MIT and had been a software developer early in my career, but I transitioned to product management over 20 years ago. At Facebook, I initially ran the Notifications team within their storied Growth org and later ran their Mobile App Install Ads team, which contributed $6 billion in annual revenue to the company. Coding had always been my first love, though — ever since I programmed my first BASIC adventure game on my TRS-80 in the fifth grade.
In 2019, my career got derailed by a stroke that left me with left-sided paralysis and a severe speech disability. Since then I’d been mostly absent from the workforce — it’s very difficult to imagine running a product team when you can’t even speak clearly. But in May 2026 I found my way back to coding. I discovered a way to develop software using a two-agent AI setup: the Claude app on my Mac to write detailed specs, and Claude Code on the server to implement them. (See my walkthrough of the two-agent Claude workflow for how it works.) With Claude’s help, I felt I could deliver software I’d have been proud to ship at Facebook.
This is exactly why open-source contribution — and the pull request specifically — was the right mechanism for me. Almost all of the work can be done asynchronously, without meetings. I can still type with one hand, and every part of it is communication in writing, without my needing to speak. The judgment I’d built over decades of shipping software hadn’t been touched by the stroke; the PR is a way to put that judgment to work through a channel my disability doesn’t block. Given the seven-year gap in my résumé, contributing to a project I could get noticed on — by the project’s own team, and potentially by recruiters at AI companies — looked like the most direct way back.
So I set out to find the right projects, and enlisted my Claude agents to help. It was important to find projects that are genuinely receptive to new contributors — which turns out to be the whole question, and a measurable one.
The four rungs: outsider, contributor, collaborator, insider
Before reviewing the rest of the numbers, here’s the ladder they’re measuring. Getting from the outside of an open source project to the inside is not one rung in the ladder — it’s four rungs, and almost everyone stops on the first.
An outsider is anyone in the project’s orbit who hasn’t landed a change: someone who uses the tool, files an issue, stars the repo, maybe opens a pull request that never merges. Most of a project’s audience never climbs past here — they were never trying to.
A contributor has cleared the first real bar: at least one merged pull request. Their code is in the product. This is the rung this whole article is about.
A collaborator has been handed write access — they can merge other people’s work, not just submit their own. This is what “getting noticed” actually means in measurable terms: a maintainer decided you’re trustworthy enough to hold the keys. It is far rarer than a merged PR. Across all eighteen repos, roughly 22,500 people have landed at least one merged PR, and at most about 1 in 80 of them was ever granted write access — and the true rate for a genuine outsider is lower still, because some of those grants just formalize people who already belonged to the project, rather than outsiders who climbed their way in.
An insider is on the team — an employee or core maintainer. For most of these repos this rung isn’t a promotion you climb to; it’s a hiring decision, and at some projects it’s the only way in.
I’d love to tell you exactly what moves someone from contributor to collaborator. The honest answer is that the data can’t say. I can see that it’s rare, and I can see a few correlates — at some repos the promoted had reviewed other people’s PRs first; at others they were simply fast, reliable shippers whose work maintainers had already started fast-tracking before the formal grant. But the things that most plausibly drive a maintainer’s decision — private relationships, a human’s judgment of code quality, timing and need — are invisible to data from GitHub. Anyone who sells you a formula for getting promoted is extrapolating past what can be measured.
So this article focuses on the one rung you can control and that the data can measure cleanly: getting your first pull request merged. Even that turns out to be a coin flip.
Look at that shape before you read another number, because it reframes what one merged PR is worth. The single most common outcome, everywhere, is exactly one merged PR and never again. Landing one PR doesn’t put you at the bottom — it puts you at the median. But one merged PR is the contributor bar, not the collaborator one: the people who were handed write access had merged many more than one — well into the double digits, not a single lucky PR. The first PR gets you in the door; it doesn’t get you the keys. Which sets up the finding that surprised me most, later on: coming back is rarer than getting in.
Your first pull request used to be a coin flip
Not all projects are equally open to newcomers. The table below ranks the eighteen by the rate at which they’ve historically merged first-time PRs — an author’s very first PR — across each project’s entire history. Pooled across all of them, your first PR was essentially a coin flip. But the per-project spread was enormous.
Read the spread before the average: the same act — a stranger’s first pull request — merged 25.6% of the time at one project and 74.5% at another, nearly a 3× difference depending on whose door you knocked on. Pooled, a first PR that gets a verdict is merged 52.5% of the time — essentially a coin flip.
Two caveats keep this honest. These are outcomes, not pure receptiveness — projects attract different first PRs, and a drive-by typo fix is not the same bet as a thousand-line feature. And the ranking is historical: the top of this table is partly a museum. LlamaIndex and LangChain earned their high all-time rates in an era that has ended, which is exactly where the story goes next.
In 2026, the coin is loaded
The rates in the previous section are from each project’s entire history — not the coin you’d flip today. Split every author’s first PR by when it was opened, and the game changes dramatically:
Before 2026, a newcomer’s first PR across all repos merged 35–83% of the time — collectively a coin flip, often a favorable one. In 2026 almost all repos merge first PRs at less than 50%, and the spread has stretched downward: a cluster in the thirties, and five projects now in the teens or single digits. Three of those are worth understanding individually, because each shut its door by a different route — and because these are the projects a newcomer should think twice about:
LangChain collapsed from a historical 55.8% first-PR rate to 7.1% in 2026. Its monorepo door closed around its v1.0-era restructuring, which reorganized the project and pushed outside contribution toward separate partner packages. Those partner packages still merge at 77–90%, but at a fraction of the volume and unevenly — some thrive while others fade. The main repo, where most newcomers still instinctively knock, is essentially closed to them.
open-webui fell to 4.0%, the lowest in the survey. Over 2025 it restructured toward a model that concentrates decisions with a small core and gives outside PRs a fast no — 73.5% of first PRs ever opened were closed, the highest closed-rate anywhere.
crewAI fell furthest of anyone: 35.7% all-time to 5.6% in 2026, a collapse of thirty points. I can see the fall clearly and I can’t explain it from the data. It arrived with the 2026 wave, in the same year most other doors narrowed, and the mechanism isn’t visible from outside. What’s left is a door that shut hard, for reasons the data won’t name.
Two more projects belong in the avoid column, but for a different reason — and the difference is worth a paragraph of its own.
Ollama and aider are a different problem wearing the same number. The three above shut their doors decisively, whatever the reason. Ollama’s 16.0% and aider’s 9.4% don’t come from that. They come from silence. At Ollama, 71% of 2026 first PRs are still waiting for any verdict at all; at aider it’s 78% — the deepest silence in the survey. These aren’t doors that say no. They’re doors nobody is answering.
That distinction matters for what you do about it. A rejected PR is information: you learn the project doesn’t want your contribution, and you move on. An unanswered PR is a bet with no closing date. Either project’s true merge rate could be meaningfully higher than the decided-only number suggests, if that backlog were ever triaged — or the queue is the answer, delivered slowly. Either way the newcomer experience is identical: you write the code, you open the PR, and nothing happens.
So what changed across the board? I went looking for the cause and didn’t find one. External PR volume in 2026 is running at roughly two to three times 2025’s pace at most of these repos, while the pool of people who can merge has stayed roughly flat — and that felt like the obvious answer until I checked whether it sorted the declines. It doesn’t: the two highest-volume repos in the survey, vLLM and sglang, fell the least of anyone, while continue’s volume of opened external PRs dropped by half and its first PR merge rate fell over thirty percentage points. Commercialization doesn’t sort them either — solo, unfunded aider fell further than every venture-backed project except one. What’s left is a broad, industry-wide level-shift that arrived at the year boundary and hit projects of every size, every governance form, and every funding status. I can measure that it happened. I can’t tell you why, and I’d rather say so than pick the tidiest available story. There’s also more machinery standing between a newcomer and a human than there was in 2023: when I opened my own first PRs, a wall of automated checks and AI code reviewers ran before any person engaged. The bots don’t reject you, but they’re a longer first mile than they used to be.
And here’s the part worth holding onto if your first PR didn’t land this year: the most likely explanation is the year, not you. The return data says so directly. At LiteLLM, contributors whose first PR merged came back for a second at 41.9%; contributors whose first PR was rejected came back at 41.4% — identical. A first rejection predicts nothing about whether you should keep going. It is not a verdict on your work.
But step back to the full population and a starker shape appears. Remember the pooled coin flip from earlier — a first PR that gets a verdict merges 52.5% of the time. Turn that around: nearly half of all external authors who ever open a PR never merge anything at all. Whether you land on the merged side or the never-merged side is the actual flip. And once you know which side someone landed on, the same thing happens on both: the first PR turns out to be very nearly the whole game.
On the winning side, of the contributors who ever merged, 84% got that merge on their very first PR. Not their third after two rejections — their first. The image of the persistent newcomer who grinds through knock-backs until the door opens is, in the data, mostly a myth: people who get in almost always get in immediately.
On the losing side, the mirror holds — but read the denominator carefully, because it’s a different group from the returners above. Among the authors who never merged anything at all, and whose PRs have all been decided, about 80% opened exactly one PR and never came back. That’s not the same as saying rejection ends careers: plenty of rejected first-timers do come back, and some of them go on to merge — those people are counted as winners here, just not first-try ones. The 80% describes only the people for whom nothing ever landed. One swing, no merge, gone.
Which is the honest thing the data will let me say about persistence, and it cuts against the motivational version: almost nobody comes back. Only about 1 in 6 contributors ever merges a second PR. Coming back is the price of getting anywhere further — every rung above contributor requires it — but the data can’t promise it pays off. It can only tell you that not coming back guarantees it doesn’t.
The one lever you actually control: choose the right repo
A note on who this is for. If you already love one specific project and want to contribute to that, nothing here tells you to abandon it — it just tells you what terrain you’re walking onto. But if you’re here the way I was, wanting to become a contributor to build a credential and open to picking where, then the single most important decision you can make is which project you pick.
Here is the finding that outlasts all the others. You cannot control how a maintainer feels about your code, or whether a project just pivoted, or how many other PRs landed in the queue the morning you opened yours. But you can choose which door to knock on — and that choice moves your odds more than almost anything about the pull request itself. The gap between a 4% repo and a 67% repo dwarfs the difference good craft makes on a single PR.
So I did the checking. I sorted every one of the eighteen projects by the state of its door to a newcomer — which meant first deciding what a door’s state actually is.
Doors have three states, not two
The idea that open source is closing to newcomers flattens three genuinely different situations into one, and the difference between them is exactly what decides where your effort as a new contributor should go:
Open — your work gets read and decided, and merges at reasonable odds. The door works the way the folklore says open source should.
Tightening — still gettable, but materially harder than it was. The tell isn’t a low rate, it’s a big drop: LlamaIndex fell from 74.5% all-time to 33.4% in 2026; transformers from 59.8% to 35.8%. The door still opens; it opens less.
Closed — rarely opens, in one of two flavors. Some closed doors decide fast and mostly say no (open-webui: 4% merged, but only 3% left waiting — you get a quick answer, and it’s usually no). Others barely decide at all (Ollama, aider — a first PR most likely just sits). Both are shut to a newcomer; the second is worse, because you don’t even get the no.
How I sorted them. The signal isn’t a project’s current merge rate — it’s what happened to it. A project is open if its 2026 first-PR rate is roughly where its all-time rate has always been; tightening if it dropped materially from that all-time rate; and closed if it merges almost nothing, or if most newcomers never get a verdict at all. That last clause is why Ollama reads closed rather than tightening: its 16% looks like the low end of tightening until you notice that 71% of its 2026 newcomers are still waiting, which makes it a shut door by the median newcomer’s experience. And it’s why ComfyUI sits in open at 29.7% while llama.cpp sits in tightening at 36.6% — ComfyUI’s rate hasn’t moved at all, while llama.cpp’s fell from 56.5%. (ComfyUI’s first-timer rate has been flat near 30% in both eras; its established contributors have done better over time, but that’s a different population than this table measures.) The boundaries are judgment calls at the margins; Dify, down twelve points but still merging just under half of first-timers, is the closest case.
Here is that map. If you only take one thing from this piece, take this table — it’s the part you can act on tomorrow.
The one distinction worth internalizing from that table is the closed-door split, because it’s the easiest to misread: a silent queue is data. A project where most newcomer PRs sit undecided for months isn’t being selective — it’s not answering. aider’s 9.4% and Ollama’s 16% aren’t “hard to impress”; they’re 78% and 71% never-answered. From the outside that can look like a high bar. It’s closer to an unattended one. The “still waiting” column is in the table precisely so you can tell those apart before you spend a month finding out the hard way.
The signals that mislead — and the ones that don’t
Before you try to read a door yourself, clear away the two most tempting signals that don’t work — because each is what people reach for first, and the survey happens to disprove each with a matched pair: two projects alike in one obvious respect, opposite in outcome.
Ownership doesn’t tell you. Hugging Face owns both diffusers and transformers. diffusers is open (67% of 2026 first-timers merged); transformers is tightening (59.8% all-time down to 35.8%). Same company, same brand, opposite trajectories. Look at the specific repo, not the parent.
Governance form doesn’t tell you. aider and textgen are both solo-maintainer projects — the setup people most expect to choke off contribution. aider is closed hard (9.4% in 2026, a queue clogged with year-old PRs); textgen is one of the most open in the set (56% → 60%). Same structure, opposite results. “One person holds the keys” is not, by itself, a closed door.
What actually determines the state of a project’s door is a different list, and all of it is visible before you submit your first PR:
The drop in the first PR merge rate, not its all-time or current levels. A healthy-looking all-time rate means nothing alone — it averages in years that have nothing to do with today. What separates open from tightening is how far the 2026 rate fell from the all-time one: diffusers barely moved (69 → 67); LlamaIndex more than halved (74.5 → 33.4). Read the two rate columns as a pair.
The age and fate of the open queue. A queue full of year-old undecided PRs (aider, Ollama) is the tell that separates a genuinely shut door from a merely selective one. If nothing is getting a verdict, the door isn’t picky — it’s not answering. This is the single most reliable way to catch a non-answering project before you wait on it.
What I did with my own read
I picked my own repo — LiteLLM — before I had any of these numbers, on diligence and instinct. The data turned out kinder to that choice than I deserved. It reads as tightening now, like most of the field (48.6% all-time, 33.6% in 2026), but it still merges strangers’ work every day, its ladder is one of the faster ones, and its median merge lands in under a day. It also handed me a calibrated clock: its open queue’s median age is around 46 days, so the silence my own open PRs are sitting in right now is the system working, not a verdict on me. That distinction — between a door that’s deciding slowly and one that’s stopped deciding — is exactly what the table is built to let you see.
The research results changed my plan in two concrete ways, however. First, I stopped tracking what I put out and started tracking what comes back — a maintainer who merges my PR, a human who comments on my PRs or issues. Second, to increase the chances of getting a merged PR, I decided to contribute to a second project, Dify, by picking it from the table above rather than from instinct: it reads open at 47.0%, only a quarter of its 2026 newcomers are still waiting, and its contributor infrastructure — labeled issues, a maintained good-first-issue queue, real contributing docs — is the best I looked at.
Then something happened that I want to report carefully.
I installed Dify locally and started building something in it. Configuring five model providers by hand, I hit a hard authentication failure on one of them — a plugin whose API endpoint field defaulted to the wrong region, and a key obtained from the platform the plugin’s own documentation pointed you to got rejected with no explanation. I filed an issue with the repo. I built the obvious fix, discovered it would break the system for every existing user of that plugin, threw it away, and built a smaller one that breaks nobody. A maintainer merged my PR in less than 24 hours after I submitted it.
The rest is still open. LiteLLM still hasn’t merged anything of mine. The thing I said I’d watch — whether a repo starts treating me differently — hasn’t moved. I’ll keep reporting it.
Method, receipts, and caveats
All pulls are authenticated queries against the GitHub API (full PR history, all states); external/internal classification is best-effort per repo with the rules and confidence brackets documented per dataset. Every analysis here — volume, funnel, histogram, era rates, and door state — covers the same eighteen projects (roughly 143,000 external PRs). Promotions (write-access grants) are dated by the first PR an author opens from a branch inside the canonical repo, which requires write access at that moment. Everything person-adjacent is reported as aggregates. First-PR merge rates throughout are decided-only (merged ÷ merged+closed), so first PRs still awaiting a verdict are excluded rather than counted as failures; about 14% of first PRs across the survey are still waiting — which is why the door-state table carries a separate “still waiting” column, since a rate built on a thin decided slice describes only the PRs lucky enough to be judged. Where a project’s decided rate lands in the low-tightening band but its waiting share runs very high (Ollama: 16% decided, 71% waiting), the waiting share governs and the project reads closed. The merged-PR distribution histogram pools contributors per (author, repo), so a contributor active in several repos is counted once per repo. The casual-contributor phenomenon itself is well studied (Pinto et al. 2016; Steinmacher et al.) — what’s new here is the bot-era, AI-repo, decision-facing cut.
Key caveats. Rates over recent windows are floors, not finals: PRs opened recently and still waiting are invisible to decided-only rates, and they skew toward eventual merges. Hugging Face diffusers’ 2026 first-PR rate rests on barely half its intake and should be read as an unusually rough estimate; the same thinness flags continue and, to a lesser degree, the other high-waiting cells in the table. The paired first-PR finding above carries the same denominator discipline as the rates: the 84% is conditional on ever-merging (not 84% of all first-timers), the ~80% one-and-done figure is among decided non-mergers only, and both sit against the anchor that only about 54% of external authors ever merge at all. The collaborator counts behind the “1 in 80” funnel are bracketed on both sides: they’re a floor on total write-access grants (access granted but never used to open a canonical-branch PR is invisible), and simultaneously a ceiling on genuine community conversion, because on company-owned repos the instrument counts the owning company’s own staff alongside community members who earned their way in — so the true outsider-to-collaborator rate is lower than 1.25%. The histogram’s 50+ bucket carries the same caveat. Small-n repos in the classifier (Agenta, aider, textgen, ~0.9–1.3k external PRs) support shape findings, not precise rates. The commercial-pivot comparison rests on seven repos whose commercial events could be dated from public announcements; the before-and-after windows sit inside the same industry-wide decline that hit uncommercialized projects too, so they cannot separate a pivot’s effect from the year’s. Base rates are priors, not your personal odds. And classification tails at the largest repos are medium-confidence, with the newcomer-facing numbers robust across variants.
I’m documenting this experiment — betting a month of sustained open-source work on major AI projects, with my two-agent Claude workflow doing the heavy lifting and every decision receipted in git — live on this Substack. Subscribe if you want the next measurement, and the honest account of whether the month works.