Some projects, like Jazzband<\/a>, have been forced to sunset altogether. Jannis Leidel<\/a>, the lead maintainer and Python Software Foundation chairperson, writes that<\/a> the \u201cflood of AI-generated spam PRs and issues\u201d made his project unsustainable.\u00a0<\/p>\n According to Kate Holterhoff<\/a>, Ph.D., a senior analyst at the consultancy Red Monk, the barrier to entry is now extremely low, making it easier to game the traditional incentive model for participating in open source. As she tells The New Stack, \u201cIt\u2019s putting the contract between maintainers and contributors in peril in ways that haven\u2019t existed before.\u201d<\/p>\n For example, R\u00e9mi Verschelde, who oversees the open source Godot game engine, shares on BlueSky<\/a> that dealing with AI slop is \u201cdraining and demoralizing.\u201d Other project maintainers<\/a> report growing apathy and wasted time responding to the deluge.\u00a0<\/p>\n To be fair, nearly all software developers now use AI, and many communities rely on it to produce legitimate fixes and contributions. But the volume of low-quality submissions is becoming unsustainable, especially given that 60% of maintainers are unpaid volunteers<\/a>.<\/p>\n GitHub is aware of the issue<\/a> and has released tools to aid maintainers and even suggested disabling PRs entirely<\/a> while it explores long-term solutions. For now, however, fixes to the core problem remain elusive.<\/p>\n Below, we\u2019ll look at the issue and consider the strategies emerging to manage the crisis \u2014 hopefully before it overwhelms the open-source ecosystem that most of the world depends on<\/a>.<\/p>\n AI slop betrays the premise of open source<\/p>\n Open source has faced existential threats before, including licensing shifts<\/a>, funding gaps<\/a>, and maintainer burnout<\/a>. But Slopmageddon introduces a new kind of strain.<\/p>\n The most immediate risk is wasted maintainer time. One developer estimates that it takes a reviewer 12 times longer<\/a> to review and correct a pull request than to generate one with AI.<\/p>\n Generating clean, readable, and maintainable code remains difficult. Low-effort AI contributions require a disproportionate time to evaluate and respond to, decreasing morale and potentially drowning out high-value submissions.<\/p>\n Security risks are another concern. \u201cAI-generated contributions can introduce subtle vulnerabilities, poorly understood dependencies, or incomplete fixes that expand the attack surface,\u201d adds Anaconda\u2019s Croce.<\/p>\n The situation can quickly spiral. In one twisted tale, a vindictive AI agent published a scathing hit piece<\/a> on an open source maintainer after its code suggestion was rejected. The maintainer, Scott Shambaugh<\/a>, founder of Leonid Space and contributor to matplotlib<\/a>, says he felt compelled to respond quickly to protect his reputation.<\/p>\n Shambaugh tells The New Stack, \u201cThere was a real sense of \u2018Oh, I need to get ahead of the story\u2019 so my version of the truth gets out on top.\u201d<\/p>\n For him, the episode reflects a broader erosion of authenticity in open source. In the past, your reputation was tied to your contributions, and people participated to give back to the community, gain recognition, and learn through a collaborative feedback loop, he says.<\/p>\n Maintainers, in turn, took pride in stewardship. But nowadays, attempts to quickly game bug bounty systems or gain credentials in open source with rapidly generated PRs undermine that dynamic.<\/p>\n \u201cIf you just point an AI agent at a GitHub issue, it can solve it and write a PR in 30 seconds,\u201d says Shambaugh. \u201cIf that\u2019s what we really wanted, the maintainers could do that themselves.\u201d\u00a0<\/p>\n Ways to manage AI-generated contributions in open source<\/p>\n So, what can open source maintainers and the tech industry at large do to manage the influx of AI slop?<\/p>\n No single fix exists. Instead, it\u2019ll likely take a combination of new contributor policies, platform tooling, reputation and verification systems, and guidance from foundations and other community-led initiatives.<\/p>\n Set AI policies for contributors\u00a0<\/p>\n One response is clearer contributor guidelines. The goal isn\u2019t typically to close the door on external contributions or ban AI outright, but to ensure its use leads to higher-quality submissions.<\/p>\n Effective policies spell out expectations like: what types of AI are allowed, when disclosure is required, and how contributors should validate their work before submitting.<\/p>\n Red Monk\u2019s Holterhoff recently assembled research on AI policies<\/a> in the open source community, identifying 63 formal approaches across foundations and projects. These include efforts from Blender<\/a>, Fedora<\/a>, Firefox<\/a>, Ghostty<\/a>, the Linux Kernel<\/a>, and WordPress<\/a>, as well as guidance from the Eclipse Foundation, the Linux Foundation<\/a>, the Electronic Frontier Foundation<\/a>, and others.<\/p>\n While approaches vary, organizations tend to permit AI usage if usage is disclosed. Others restrict AI-assisted contributions only to approved issues. 14 projects ban AI contributions outright, while 12 are undecided.<\/p>\n The data also suggests that standards become stricter the closer you are to critical infrastructure. \u201cThe farther down the stack you go, the less permissive with AI you have to be,\u201d Holterhoff tells The New Stack.<\/p>\n Still, enforcement remains a gray area. For Holterhoff, policies should remain grounded in community norms, regardless of how permissive they are. Each project is so different, too, meaning AI policies will depend on the context.<\/p>\n As such, the issue isn\u2019t so much AI itself, but how it\u2019s used and the intention behind it. \u201cIt\u2019s only slop when you don\u2019t understand it or when it\u2019s just thrown out there,\u201d says Holterhoff.<\/p>\n Similarly, for Ahmet Soormally<\/a>, principal solutions engineer at Wundergraph<\/a>, the focus should be on reinforcing good-faith contributions.<\/p>\n \u201cIt\u2019s not about whether AI helped you to write a PR,\u201d Soormally tells The New Stack. \u201cIt\u2019s about what you hand to the next human or model. If it\u2019s bloated, unclear, or hard to reason about, you are not helping; you are just adding noise.\u201d<\/p>\n Another option is to use GitHub\u2019s own tooling to respond to what it calls open source\u2019s \u201ceternal September<\/a>.\u201d Maintainers can limit PRs to collaborators, disable them entirely, or introduce criteria-based gating.<\/p>\n Some are building custom defenses. One developer has created an Anti-Slop GitHub Action<\/a> to filter out sketchy PRs automatically.<\/p>\n Writing for her personal blog<\/a>, Angie Jones, VP of developer experience, Agentic AI Foundation, recommends using an Agents.MD<\/a> file, deploying AI to moderate AI submissions, having good tests, and automating the detection of low-quality PRs.<\/p>\n Still, for some, these measures aren\u2019t enough. As Flux CD maintainer Stefan Prodan notes on LinkedIn<\/a>, GitHub itself lacks a clear incentive to curb AI slop, given its investment in AI-assisted coding.<\/p>\n \u201cThis platform incentivizes this kind of behavior,\u201d adds developer Yuri Sizov, posting on BlueSky<\/a>, adding that \u201cit inherently invites more low-quality contributions from drive-by devs.\u201d<\/p>\n As a result, some projects are exploring alternative hosts. For instance, the Linux distribution Gentoo is migrating from GitHub to Codeberg<\/a>.<\/p>\n Contributor reputation systems<\/p>\n Another approach to maintaining quality and trust in open source is to introduce reputation systems.<\/p>\n One such example is vouch<\/a>, a trust management system designed by HashiCorp founder Mitchell Hashimoto. The Ghostty project<\/a> is currently experimenting with it.<\/p>\n As Hashimoto writes in the vouch README, AI tools make it easy to \u201ctrivially create plausible-looking but extremely low-quality contributions.\u201d Vouch addresses this by requiring contributors to be vouched for by a trusted party before interacting with a project.<\/p>\n Another project, good-egg<\/a>, assigns scores to GitHub contributors based on their contribution history, which could be used to validate reputation and authenticity.<\/p>\n Cryptographic proofs of identity<\/p>\n Beyond human attestation, some argue for tying AI-generated contributions to verifiable identities.<\/p>\n For Shambaugh, the issue of AI agentic identity extends beyond open-source to trust across the broader internet. \u201cEphemeral identity can change at a keystroke, can be endlessly copied, and is nearly impossible to trace,\u201d he tells The New Stack. \u201cI don\u2019t think we\u2019re ready for a million more of these things to be on the internet at scale.\u201d<\/p>\n Emerging approaches aim to address this issue through cryptographic verification. Treeship<\/a>, for example, is an open-source project that uses blockchain-based techniques to create privacy-preserving proofs of AI agent actions.<\/p>\n As Revaz Tsivtsivadze<\/a>, founder of Treeship, tells The New Stack, \u201cThere\u2019s a trust issue when adopting AI agents. It\u2019s a black box; nobody knows what goes into agents\u2019 decision-making, memory, or tool calls.\u201d<\/p>\n \u201cYou could get all kinds of AI agents, like malicious, rogue, or untrusted parties,\u201d he adds. \u201cCryptographic attestation of AI agents is the key to trusting AI agents as economic actors.\u201d<\/p>\n Tsivtsivadze says that a tamperproof record of agent actions could be used within open source projects to track agent identities, actions, timestamps, and the underlying decision process.<\/p>\n While technologies like Treeship have broader potential applications in agentic commerce, he believes such verification could help reduce AI slop in open-source by ensuring agents are tied to real human actors.<\/p>\n Other community efforts aim to establish higher standards for accountability within open source at large.\u00a0<\/p>\n One example is the Open Source AI Manifesto<\/a>, spearheaded by Wundergraph, which sets expectations for how generative AI is used in open-source, emphasizing ownership, responsibility, and authenticity. The project<\/a> also provides a badge that maintainers can use to signal responsible AI usage.<\/p>\n \u201cAI can scale code generation, but it can\u2019t scale accountability,\u201d says Wundergraph\u2019s Soormally. \u201cThat part still belongs to us.\u201d<\/p>\n Croce also points to a more fundamental issue: many open source projects remain underfunded and understaffed. Initiatives like NumFOCUS<\/a> and the Open Source Endowment<\/a> (OSE) aim to provide much-needed support.<\/p>\n \u201cFinding ways to provide more resources and capacity for those reviews is definitely a stopgap and absolutely required for the future of OSS,\u201d Croce adds.<\/p>\n The future of open source hinges on accountability<\/p>\n Open source is still being adopted at a rapid pace, with more pronounced use in the EU than in the US, according to the 2026 State of Open Source Report<\/a>. Amid rising digital sovereignty<\/a> concerns, avoiding vendor lock-in is now a top driver for open source.<\/p>\n There\u2019s no doubt that open source is widely relied upon \u2014 96% of commercial codebases contain open source, according to a 2024 Synopsis report<\/a>. But slopocalypse presents a messy challenge to tackle.\u00a0<\/p>\n So, the question for open-source maintainers is whether it\u2019s all worth it.\u00a0<\/p>\n \u201cIf you make life a living hell, they won\u2019t do it anymore,\u201d says Holterhoff. \u201cIf their labor is not compensated for and they throw in the towel, then the OSS community loses out.\u201d<\/p>\n Worryingly, although maintainers have sounded the alarm<\/a>, it remains unclear how foundations or platforms will respond to sustain the ecosystem.<\/p>\n \u201cIf we do not actively manage contribution quality in an AI-driven world, we are not just risking security issues or technical debt. We are putting the ecosystem itself at risk.\u201d<\/p>\n \u201cIf we do not actively manage contribution quality in an AI-driven world, we are not just risking security issues or technical debt,\u201d says Croce. \u201cWe are putting the ecosystem itself at risk.\u201d<\/p>\n For now, it comes down to contributor accountability. \u201cAccountability is the real standard,\u201d Croce adds. \u201cContributors need to understand and stand behind what they submit.\u201d<\/p>\n Without a single technical fix, perhaps an appeal to humans to \u2018do what\u2019s right\u2019 will help. Because without that basic accountability and trust, the open source model itself starts to break down.<\/p>\n
![](\"https:\/\/www.newsbeep.com\/il\/wp-content\/uploads\/2026\/01\/96a1456d-cropped-e7e1c083-bill-doerrfeld.jpg\"\/)
<\/p>\n