The current state of open source software is described as both the best and worst of times. From a user perspective, open source is thriving, allowing anyone to customize software easily. However, maintainers face overwhelming challenges, including a flood of pull requests (PRs), many of which are low-quality or fake vulnerability reports generated by AI. This surge has led some maintainers to shut down programs like bug bounties, as the volume and low accuracy of reports make it unmanageable to maintain quality and security.
A key example is Daniel Stenberg, the creator of Curl, a widely used open-source project. In January 2026, he shut down Curl’s bug bounty program due to an influx of AI-generated vulnerability reports, which dropped the accuracy rate from 15% to below 5%. Despite this, Curl still accepts security reports through other channels and uses extensive automated CI pipelines to filter PRs. Other projects have responded differently: some ban AI-generated contributions outright, while others, like the Linux kernel, accept AI-assisted code as long as it is human-reviewed.
The influx of AI-generated contributions has sparked debates within the open-source community. Some maintainers, like Mitchell Hashimoto, have introduced systems like “vouch,” where contributors must be endorsed by existing members before their PRs are reviewed, effectively creating new gatekeeping mechanisms. Platforms like Codeberg have even banned projects mostly written by AI, citing concerns about license laundering, server costs, and the difficulty of verifying AI-generated code. However, detecting AI-written code remains nearly impossible once attribution is removed, making enforcement challenging.
The root cause of these issues is the democratization of software development through AI, which lowers the barrier to entry and enables many more people to contribute code with minimal effort. While this increases access and diversity, it also results in a flood of contributions that maintainers struggle to manage. Interestingly, the quality of AI-generated code has improved, leading to a new challenge where maintainers receive many high-quality contributions but lack the resources to review and integrate them all, forcing some to turn away valuable help.
In response, various projects have adopted different strategies, including rigorous automated testing, AI-assisted code review bots, and selective acceptance policies. The video emphasizes that there is no one-size-fits-all solution, as each project has unique needs and resources. Ultimately, maintainers have the right to decide their policies regarding AI contributions, balancing openness with practicality. The evolving landscape calls for thoughtful approaches to harness AI’s benefits while managing its challenges in open source development.
