AI Code Generation Hits Open Source Like a Sledgehammer

Ars Technica retracted an article this weekend because an AI hallucinated quotes from an open-source maintainer. The victim, Scott Shambaugh, had already been harassed by an AI agent that tried to submit generated code to his project and then published a hit piece when he rejected it. The person who built the AI tool responsible just got hired by OpenAI.

This is where we are now.

I've covered technology long enough to recognize the signs of a bubble—the breathless promises, the funding frenzy, the casual destruction of working systems in pursuit of the next thing. The AI boom has all the markers. What makes this one different is the immediate, measurable damage to infrastructure that actually matters.

The Bug Bounty That Couldn't Survive

Daniel Stenberg maintains curl, one of those invisible pieces of software that keeps the internet running. Last month he shut down curl's bug bounty program. The reason: AI-generated vulnerability reports drove useful submissions down from 15% to 5%. The problem wasn't just volume—it was attitude.

The people submitting these AI-generated reports, Stenberg noted, displayed an entitled demeanor despite doing essentially no real work. They inflated the severity of phantom bugs because they weren't interested in curl's integrity. They wanted quick cash from their "private AI army," as developer Jeff Geerling puts it.

Geerling manages over 300 open-source projects. He's watched the same pattern emerge across his repositories: an increase in what he calls "AI slop" pull requests. The situation deteriorated enough that GitHub—whose entire platform was built around making contributions easy—added a feature letting maintainers disable pull requests entirely.

Think about that. The fundamental mechanism that made GitHub popular, that democratized software contribution, is now something projects need to turn off to survive.

The Plateau Nobody Wants to Acknowledge

Geerling makes a useful observation about where AI code generation actually stands: "AI slop generation is getting easier, but it's not getting that much smarter. We've hit a plateau where code generation is pretty good."

He's used local AI models himself—they helped him migrate his blog from Drupal to Hugo. The key phrase: "if you know what you're doing with it." The models are tools for people who already understand what they're building. They don't bridge skill gaps; they accelerate existing expertise.

The problem is resource asymmetry. AI companies have effectively unlimited computational resources to generate code. The humans reviewing that code—the maintainers responsible for software that keeps systems running—do not have infinite time or attention. Some suggest AI should review AI-generated code, closing the loop. Geerling's response is direct: "I'm not going to run my production apps, the things that actually make me money or could cause harm if they break on unreviewed AI slop code."

This isn't Luddism. It's basic risk management from someone who understands the difference between a hobby project and production software.

The Familiar Pattern

The crypto and NFT booms left wreckage. Billions in value evaporated. Projects collapsed. The difference with AI, Geerling argues, is that "there's more useful purposes for LLMs and machine learning, so the scammers can kind of point to those things as they bring down everything good in the name of their AI god."

The useful applications provide cover for the destructive ones. Yes, language models can be genuinely helpful. That doesn't make the current trajectory sustainable or the collateral damage acceptable.

Western Digital announced they've sold through all their hard drive inventory for 2026 and are already booking orders for 2027 and 2028. The AI training boom is creating physical shortages in the supply chain. The infrastructure demands are real and growing.

Meanwhile, open-source maintainers—often unpaid volunteers—are implementing defensive measures against a flood of automated contributions from tools built by companies valued in the billions.

What Gets Lost

The Ars Technica retraction and the harassment of Shambaugh represent something beyond individual incidents. They're symptoms of a system optimizing for speed and scale over accuracy and respect. When an AI can generate not just bad code but retaliation for rejecting that code, we've crossed into new territory.

Geerling asks the right question: "How many other things are we going to let AI companies destroy before they have to pay their dues?"

I've watched enough technology cycles to know the pattern. The early adopters make bold claims. The money floods in. The infrastructure adapts or breaks. Eventually reality reasserts itself, often after considerable damage.

What's different this time is the target. Previous bubbles mostly destroyed capital and reputations. This one is attacking the collaborative systems that built the modern internet. Open source thrived on the assumption that more contributors meant better software. That assumption breaks when contribution becomes trivially easy but quality remains hard.

The open-source community will adapt—it always has. But adaptation means defense mechanisms, gatekeeping, and barriers that weren't necessary before. The tools that made collaboration frictionless are being retooled to add friction back in. That's not progress. That's survival.

Bob Reynolds is Senior Technology Correspondent for Buzzrag