We scanned 133 public AI agent repos. 76% had a cost defect.

Rates are over the 51 repositories that call a provider directly or wire LangGraph nodes. Using all 133 would understate prevalence, because 82 of them reach providers only through a framework and are invisible to direct-call detection.

† System prompts built by interpolation

Counted over the 51 LLM-active repositories. Across all 133 scanned repositories the figure is 466 sites in 53 repos — the extra repos are framework-wrapped, where a system prompt was found by variable name without a scannable provider call.

† Volatile values interpolated straight into a prompt

A lower bound. The predicate matches a timestamp, UUID or random call inside the f-string itself; a volatile value arriving through a variable is invisible to it. Do not read this as a rate.

† Agents discovered

Median 2 and 8 at the 90th percentile, over the 42 repositories where agents were found. The distribution has a long tail — the largest repository contained 91.

A cost defect is a pattern in code that makes an LLM workload cost more than the same behaviour would cost if written differently. It is not a bug — the program produces correct output — and it is not a pricing problem. It is waste that only becomes visible when someone attributes spend to the line of code that caused it.

We looked for four, chosen because each is detectable statically and each has a mechanical explanation rather than a judgement call:

The sample was built from GitHub search across seven agent-related queries — langgraph agent, crewai, autogen agent, llm agent framework, ai agent openai, anthropic agent and multi-agent llm — restricted to Python repositories with more than 15 stars.

We excluded the framework and provider vendors themselves, whose own test fixtures would skew every result; and awesome-lists, courses, tutorials, cookbooks, and repositories over 200MB. After deduplication, 133 repositories remained.

Detection uses the same libcst scanner that powers Capsera’s auto-instrumentation, at commit 5dff5c4. It finds direct provider call sites — Anthropic messages.create, OpenAI chat.completions.create and embeddings.create, Google generate_content — gated on the file actually importing that provider, plus LangGraph nodes registered through add_node.

10,350 Python files were parsed. 7 files failed to parse and were skipped; there were no crashes.

Both Anthropic and OpenAI discount input tokens they have seen before, by matching a prefix of the request against a cache. The match is exact and it starts at the beginning, so a single character that changes between calls invalidates everything after it.

A system prompt built like f"You are a helpful assistant. Today is {today}." therefore has no reusable prefix at all. Every call pays full price, and nothing in the response says so — you have to look at the ratio of cache-read to input tokens to notice.

We found this pattern at 347 call sites across 39 repositories, which is 76% of the LLM-active sample. It is the single most common cost defect by an order of magnitude.

Read the bound on this carefully: interpolation is an opportunity signal, not proof of loss. Some of those 347 sites will be deliberately structured so the static part comes first and stays cacheable. The defensible claim is that these repositories build prompts in a way that defeats caching unless someone has thought about it — not that all 347 are losing money.

Five of the 51 LLM-active repositories — one in ten — reference an opus, gpt-4o or o1-class model inside a test file, 28 times in total. Tests run on every commit, and a test asserting that a function returns a string does not need a frontier model to do it.

The most quotable instance is an LLM observability company with premium models in its own test suite. We name it below not as a criticism but as the strongest available evidence that this is hard to see from the inside — if the companies building cost tooling have it, the pattern is structural rather than negligent.

The pattern most often cited in discussions of prompt caching — a timestamp or UUID interpolated straight into a system prompt, guaranteeing a unique prefix every single call — appeared in exactly one of 51 repositories.

We expected more, and we are publishing the number precisely because it is lower than the folklore suggests. It is also a lower bound: the predicate only matches a volatile call written inside the f-string, so a timestamp arriving through a variable is invisible to it. Do not read one-in-fifty-one as a rate.

Every figure above is bounded by the following. They are published here, at the same weight as the findings, because a statistic without its limits does not survive being checked.

1. Public GitHub skews toward demos, templates and course material. Production code may differ, and only data from real deployments can close that gap.
2. Only 4 repositories in the sample use Anthropic, so no prompt-caching adoption rate is publishable from it. The uncached-large-prompt count of 3 must not be expressed as a percentage.
3. 82 of 133 repositories call providers through a framework rather than directly, so the sample under-represents CrewAI — which routes through litellm internally — and the Qwen/DashScope ecosystem. qwen-turbo is the single most common model literal in the sample.
4. Interpolating a system prompt is an opportunity signal, not proof of waste. Some interpolation is deliberate and structured so the cacheable prefix stays stable. The honest claim is that these repositories build prompts in ways that defeat shared-prefix caching unless deliberately structured — not that all 347 sites lose money.
5. Static analysis only. No runtime data, no measured spend, no verified savings.

Public repositories, factual findings, stated neutrally. These are ordinary patterns in actively developed code — that is the point of including them.

The sample frame, the raw per-repository output, and the aggregation scripts are the record of this run. The scan is a shallow clone of every repository in the frame followed by the scanner and an aggregation pass.

Re-running against fresh clones will not reproduce byte-identical results, because the upstream repositories keep changing. The frozen record of the 2026-07-31 run is what every figure here refers to.

Next edition: a re-run at roughly 500 repositories once framework-level detection ships, which closes the 82-repository blind spot that currently limits coverage of CrewAI and similar frameworks.

If you are quoting a figure, this is the sentence to use, and it carries its own denominator:

According to Capsera's July 2026 scan of 133 public agent repositories, 76% of those making direct LLM calls had at least one cost defect.

Scan date 2026-07-31. Sample: 133 public Python repositories, 51 making direct provider calls. Static analysis only.