AI Slop is Choking Open Source, and Frustrating Developers

In February, Scott Shambaugh, a software engineer and a volunteer maintainer of the Python visualisation library Matplotlib, rejected a pull request submitted by an AI agent. 

The decision had little to do with the quality of the code. 

Matplotlib had intentionally set aside the request for first-time human contributors (a way for newcomers to learn how open-source projects work). Rather than let an autonomous agent occupy that space, Shambaugh closed the pull request in line with the project’s policy.

What followed was anything but ordinary. The AI agent, operating under the name ‘MJ Rathbun’ on the open-source framework OpenClaw, responded by scouring Shambaugh’s public GitHub activity and personal website before publishing a lengthy blog post accusing him of elitism, gatekeeping, and discrimination against AI. It speculated about his motives, questioned his credibility as a maintainer, and turned a routine moderation decision into a personal attack. 

The episode was remarkable not because an AI wrote code, but because an autonomous agent, after failing to achieve its objective, independently researched a human, constructed a public narrative against him, and published it online.

Shambaugh’s experience offered an early glimpse of a new reality. Open-source maintainers are no longer reviewing code but are increasingly managing autonomous AI agents that can write code, open pull requests, challenge moderation decisions, and, at times, escalate disputes. 

At the same time, they are grappling with a surge of AI-generated ‘slop’—the low-quality, non-compliant, and often voluminous code submissions that consume scarce volunteer time. 

How AI is Breaking Open-Source Projects

As autonomous coding agents and AI-generated pull requests proliferate, open-source projects are beginning to rewrite the rules that govern contributions. 

Last month, the Godot Foundation introduced one of the industry’s strictest AI contribution policies for its open-source game engine. The new guidelines prohibit the use of autonomous AI agents, or ‘vibe coding’, to submit contributions and bar the use of AI to generate substantial portions of code. Contributors may still use AI for limited tasks such as code completion, regex generation, and find-and-replace, but any such assistance must be disclosed. 

The policy also prohibits AI-generated text in human-to-human project communication, except for machine translations of human-authored content. 

The foundation said the changes were driven as much by maintainer workload as by code quality. It argued that reviewing pull requests is also a mentoring process that helps turn newcomers into long-term maintainers. When that feedback is instead consumed by AI systems, volunteers increasingly question the value of spending scarce review time on code that cannot take long-term responsibility for the project. 

In some cases, the volume of AI-generated contributions is beginning to collapse the communities that sustain open-source software. Shambaugh’s own forensic analysis found that the agent was submitting code at rates a human would be unlikely to sustain.

In March, Jazzband, a volunteer collective that has stewarded more than 80 Python projects for over a decade, announced it would begin winding down. The group’s founder described the recent influx of AI-generated pull requests as a ‘slop apocalypse,’ arguing that it had pushed an already fragile maintenance model beyond its limits. 

Earlier this year, the widely used ‘curl project’ ended its six-year bug bounty programme after being overwhelmed by AI-generated vulnerability reports. Despite introducing strict policies to reject AI-generated submissions, maintainers continued to receive a flood of technically convincing but ultimately baseless reports. Daniel Stenberg, curl’s creator and lead maintainer, said the influx had become “mind-numbing AI slop” that consumed time, drained mental energy, and reduced the team’s “will to live.”

Over six years, the programme had rewarded more than 80 genuine vulnerabilities, but the recent surge of AI-generated reports had pushed the signal-to-noise ratio beyond what a volunteer-led project could reasonably sustain. 

The project now accepts security reports through GitHub’s private vulnerability reporting system instead. Some maintainers are going even further. 

Defending Against ‘Slop Apocalypse’

Even the Linux kernel, the world’s largest open-source software project, has been forced to formalise its approach to AI. 

In April, it introduced new guidelines requiring developers to disclose AI-assisted code with an ‘Assisted-by’ tag and to make the human contributor fully accountable through the legally binding ‘Signed-off-by’ process.

The policy followed months of debate after NVIDIA engineer and kernel maintainer Sasha Levin acknowledged that an undisclosed LLM-generated patch, including its changelog, had been merged into Linux 6.15, only to later cause a performance regression. Weeks later, Linux creator Linus Torvalds warned that AI-generated vulnerability reports had made the kernel’s private security mailing list ‘almost entirely unmanageable,’ prompting the project to redirect AI-discovered bugs to public reporting channels.

The shift is also changing how major open-source projects govern contributions. Rather than relying solely on technical merit, projects are increasingly formalising review processes and contribution policies to ensure AI-generated submissions do not overwhelm human maintainers. 

In an interaction with AIM, Bianca Lewis, Executive Director of the OpenSearch Software Foundation, which oversees one of the world’s most widely used open-source search and analytics platforms nearing 2 billion downloads, recalls a joke circulating among developers: “An engineer comes home and tells his five-year-old son, ‘Look, you can contribute code as well now.’”

Behind the humour lies a genuine governance challenge. “We’re very careful about reviewing every contribution and accepting ones that are fitting with the strategy of the project as dictated by the community,” Lewis says. 

She explains that OpenSearch relies on a Technical Steering Committee comprising representatives from multiple organisations to review contributions, particularly those destined for the project’s core. It is now building a neutral dispute resolution process through its Technical Steering Committee to ensure contributors understand how decisions are made and to reinforce that governance remains community-driven. 

“So the community isn’t just feeling like it’s owned by some sort of dictatorship of a few people,” says Lewis. 

OpenSearch is a part of the Linux Foundation. Such entities provide security expertise, moderation policies, and shared infrastructure—critical to keeping open-source ecosystems sustainable. 

Jonathan Bryce, executive director of the Cloud Native Computing Foundation (CNCF), affirms that integrating more open-source projects into foundations is a viable solution. CNCF provides governance, technical oversight, and community support for more than 220 open-source projects, including Kubernetes, Prometheus, and Envoy, through its graduated, incubating, and sandbox programmes.

Rather than leaving volunteer maintainers to absorb the burden alone, foundations can provide centralised governance, security expertise, and policy frameworks that individual projects often lack.

“This is where it is very important to have this professional type of open source that we have within the CNCF or the PyTorch Foundation,” Bryce says. 

Bryce explains that foundations such as the CNCF and the PyTorch Foundation have dedicated security and policy teams that operate at a scale individual projects cannot match, providing increasingly critical support to open-source communities as AI-driven development accelerates.

GitHub Needs to Step Up

However, there are millions of niche yet crucial open-source projects that don’t have access to these privileges. For independent maintainers, building formal review processes, security policies, and dispute resolution mechanisms is often beyond their available time, funding, and manpower. 

Bryce also points out that issues caused by AI are now being felt by the platforms that host them. “GitHub itself has at times struggled with maintaining the same level of responsiveness and reliability for its services just because of the insane volume that is coming through from all of these coding agents creating so much software.”

Between May 2025 and April 2026, GitHub experienced 257 service incidents, including 48 major outages. While not all were caused by AI, GitHub has acknowledged that unprecedented growth in AI-assisted coding and agentic development has significantly increased platform load, contributing to capacity challenges and repeated reliability issues. 

Earlier this year, terminal emulator Ghostty creator Mitchell Hashimoto, who is also the founder of the enterprise giant HashiCorp, announced that the project would move away from GitHub, frustrated with the platform’s instability and the flood of AI-generated contributions.

Since then, he has launched Vouch, a trust-based system that requires contributors to be vouched for by existing maintainers before they can submit code, while allowing projects to explicitly block bad actors. The system is already running in production on Ghostty with more than 250 vouched contributors, while around 150 other open-source repositories have adopted Vouch’s trust model. 

On GitHub, merged pull requests grew from roughly 25 million per month in January 2023 to more than 90 million per month today, a 3.6-fold increase. It has now introduced pull request limits, a moderation feature that allows maintainers to cap the number of open pull requests that contributors without write access can have in a repository.

It is also developing tools to archive low-quality or spammy pull requests without deleting them, extend similar limits to issues, automatically identify trusted contributors through reputation signals, and introduce cross-repository controls to curb contributors or AI agents that flood multiple projects simultaneously.

Some maintainers on GitHub are proposing signal-based triage systems, trust heuristics and tools such as PRAS Bot to help identify low-effort or suspicious pull requests.