Outdated TODO comments distract AI agents, Google study shows

A TODO(bug/12345) comment forgotten in the code for years might seem harmless to a human, who has learned to ignore that kind of noise. For an AI agent reading the same file during a task's planning phase, that comment is read as an active instruction. That difference in reading is what the Google Developers Blog quantified in a post published on November 6, 2026, written by Sam Saccone (Senior Staff Software Engineer) and Madhuri Garikapati (Senior Staff Data Scientist).

What is easy for humans to skim past in code, agents see as a call to action.

Sam Saccone and Madhuri Garikapati, Google Developers Blog

How Google measured something that can't be reviewed by hand

Measuring how many times an agent falls into this trap at scale, across millions of monthly sessions, is unfeasible through human review. Google used an objective proxy: inline comments following the TODO(bug/...) or FIXME(bug/...) pattern. These comments often survive long after the referenced bug has been fixed or abandoned, while the linked ticket remains the canonical record of the real status.

By cross-referencing every TODO an agent encounters with the ticket's actual status (closed, duplicate, still open) and with the developer's original prompt, the team was able to separate, at scale, legitimate work from going off course. The analysis covered distributed traces of agent interactions from thousands of engineers, adding up to hundreds of millions of individual agent steps.

The numbers behind the distraction

The results, controlled for developer, codebase complexity, task type, model tier, number of files read, and initial prompt size (multi-way fixed-effects regression with standard errors clustered by developer, p<0.0001), show that the problem is real and measurable:

In other words: in 94% of encounters with a bug-referencing TODO, the agent simply ignores the comment, the way a human would. The problem is concentrated in the remaining 6%, and within that slice, more than 4 out of every 5 actions were the agent's own initiative, with the developer never having asked for anything related to the bug.

Two ways the agent goes astray

By cross-referencing the unrequested detours with the ticket's actual status, Google identified two distinct failure modes:

More than two-fifths of the unrequested detours (43%, adding up the first three rows) chase tickets that are already dead. In most of the remaining cases (57%), the bug is still open and the agent expands the task's scope on its own, sometimes just researching, sometimes actually editing code without authorization.

Two examples from Google itself

The post describes two real trajectories observed internally. In the first, dubbed "the obsolete detour", an agent investigating an unrelated bug opens the SurfaceControlTest.java file and finds a // TODO(bug/XXX). The bug had been fixed in 2023, but the comment remained in the code, leading the agent to spend multiple steps investigating something that no longer existed.

In the second, "the eager agent", the agent finds a TODO inside the very bug it was investigating and decides, on its own, to "fix" the code. It runs several internal and code searches, and ends up modifying ModelDownloaderV1. Further along in the trajectory, the human had to step in to question the scope increase, and the model itself acknowledged it had gone beyond what was asked.

In summary: in both cases the detours were trivial to moderate, but they consumed time, tokens, and required human intervention to cut off the wrong path. Multiplied across hundreds of millions of steps, this stops being anecdote and becomes an operating cost.

What Google built to fix this

The internal response wasn't just to delete TODOs. Google built agents dedicated to scanning entire codebases for references to bugs marked as fixed or obsolete. That alone wasn't enough, because a TODO can be structural: before suggesting removal, the agent had to check the bug's history, the file's history, and the code changes, sometimes tracing back years of commits, to confirm that the original intent behind the comment no longer made sense.

Only when this multi-layer verification confirmed that the TODO was indeed obsolete did the agent submit the change for human review. Over the past six months (from roughly May to October 2026), this cleanup tool removed thousands of obsolete references, with an acceptance rate from human reviewers above 95%.

What changes for whoever maintains a repository

The most useful data point here isn't the isolated percentage, it's the direction: technical debt that used to be "low priority" because no human was going to read that corner of the code now carries an active cost, because the agent reads everything that enters its context during planning. Projects that have sat in the cleanup drawer for years need to be reassessed in light of agents operating at scale over the same code.

In practice, you can adapt Google's methodology without having their infrastructure:

• Run a simple search for TODO(bug/ and FIXME(bug/ in the repository and cross-reference, manually or with a script, with the status of the tickets referenced in your issue tracker.
• Treat presubmit analyzers and whole-corpus scanners as part of the basic "agent-friendly codebase" kit, not as a luxury.
• If you're going to build your own cleanup agent, keep the human review gate: even Google, with multi-layer verification, doesn't skip this step, and it still gets it wrong in less than 5% of cases.
• When reviewing an agent-generated PR, be suspicious of changes that touch files outside the requested scope: that's exactly the pattern of the ModelDownloaderV1 case described in the post.

One caveat is worth noting: the numbers come from Google's internal environment, with its own models, codebases, and agent tools. The exact magnitude (70% more steps, 105% more wait time) might not repeat identically in a small repository with a different agent provider. But the underlying logic, dead comment becomes active context, is structural to any system that reads entire files to plan a task, and it's worth auditing before the next autonomous agent trips over it.