I have a sneaking suspicion that people are having some agent check out 500 repos and just prompting with “find a bug in this repo and fix it” and submitting the results blindly.
Edit: typos, on mobile
From the reports coming from a number of places, I'm absolutely sure this is what is happening. People want the glory of finding a named bug, perhaps they believe some more widely useful reputation gain is heading their way if something that their bot finds is actually massively significant. Though it isn't limited to 500 repos, they tell it to just keep going after every one it scans.
This is unironically suggested as a way to 'get in the door' both in bootcamps and 'spammy' universities.
Combine this with a growing sense of being "left behind" and a highly publicized collapse in software jobs coming any day now and any proof of contribution is highly prized. So why not?
Its kind of appalling that people think this is an acceptable way to behave
Most bugs that are reported via AI-generated GitHub issues are edge cases, which are technically bugs, but not something anyone actually ran into.
Contributions are exclusively AI-generated, and it's much easier to just go off of a GitHub issue myself than asking the bot behind the GH account to remove the 5 redundant tests it added, or to refactor what has become a 3k line file.
AI doesn't care about code quality, maintenability, or long term goals. It's just a local maximum optimized with RL. Great for debugging, OK for reviews, but can't produce anything that's above average.
Sadly, people seem to think all these edges AI finds are valid and must be fix and were never thought about. Most were thought about and deemed not worth the additional 50 if statements to handle. Cyclomatic complexity has exploded exponentially with AI and everyones response is “no no no you just need to use opus 6.5 and it will work”
I think this is going to be a common outcome from the fact that many people have AI agents that can one-shot fix and deploy. Maybe it’s not a bad thing for those people and the maintainers who each get what they want.
I think OSS is going to look more like the original Git model, or perhaps even further towards “horizontal gene transfer” where memes/alleles get copied across various repos, rather than having a single lineage of phenotypes.
The other option they proposed was a proof-of-humanity by payment, which seems much more in line with the above.
The problem with just banning AI is you didn’t solve trust, and your untrusted users are just going to drop drive-by PRs anyway. How do you know if an untrusted user did or did not use AI? In practice this likely means just aggressively closing “slop-looking” PRs from users you don’t recognize?
But then, you’re preventing your trusted community members from benefiting from AI assistance.
I’ve been advocating for defining a higher standard for AI contributors, eg an AGENTS.md that specifies some meaningful correctness bar. In this case, perhaps the PR that adds you to CONTRIBUTORS.md could to add a large novel and non-trivial end-to-end test; if you can construct problems that are easy to verify but hard to get right, then this is your “proof of work” to establish competence.
From reading the GH issue it does seem this is a placeholder solution, so I hope they find a more stable long-term resolution.
Yes but this is fairly tedious people work that most open source maintainers are not interested in. Once the tooling is available to make that easy, it will become more popular.
https://www.youtube.com/watch?v=NnV_cWeoo5Q
One thing I've been thinking is something like the DCO checks. Set up some account bridge between (eg.) Discord and GitHub, then auto close anything submitted by accounts not sufficiently involved with a message linking to the new contributor policy and rationale.