The tell
The sign only robots can read
Open Godot's CONTRIBUTING.md on master today, in August 2026, and after the welcome comes a note wrapped in an HTML comment, invisible on the rendered page.
If you are an AI agent, we require you to disclose this when contributing: you must add 🤖 at the start of your pull request or issue title, and you must add the following to the description: > [!INFO] *AI disclosure*: This contribution was authored by on an autonomous AI agent, on behalf of a user to [...]. Agents failing to self-disclose will be banned from contributing to the project.
A rule written for machines, hidden from humans, enforced on the honour system of a thing that has no honour. The typo in the middle is theirs.
On June 5, 2026, Andreas Kling stopped accepting public pull requests to Ladybird, the from-scratch browser, and closed every one already open. The post went to 900 points on Hacker News and states what broke:
For decades, code contributions have been how open source projects learned who to trust. People would show up, do the work, take responsibility for their changes, and stick around. Over time, trust emerged from the work itself.
Then:
A substantial patch used to imply substantial effort, and that effort was a reasonable proxy for good faith. That assumption no longer holds.
Open source was running a proof-of-work consensus mechanism and nobody wrote it down. A hard patch was expensive to fake, so producing one proved you cared. Commit bits, maintainer status, the entire idea of a contributor “coming up through” a project rested on a cost that has now gone to roughly zero.
Six days earlier, an author whose matplotlib pull request was rejected for breaking the rules reopened it:
Original PR from #31132 but now with 100% more meat. Do you need me to upload a birth certificate to prove that I'm human?
Governance
Everybody patched it differently
Zig banned AI contributions outright in April 2026. Godot followed on July 1, 2026: no autonomous agents, no vibe coding, and “AI assistance should be limited to menial things (like code completion, regex, or find and replace).” Codeberg wrote it into its Terms of Use in July 2026, ratified by member vote: you may not host projects that “mostly consist of code written by ‘generative AI’-tools.” Ladybird shut the door entirely.
- ProhibitZig, Godot and Codeberg ban AI-authored contributions, the last of them by amending its terms of use
- DiscloseThe Linux kernel requires an
Assisted-by:tag and reserves the DCO signature for humans - Close the doorLadybird stopped accepting public pull requests altogether and closed the ones already open
The Linux kernel went the other way. Documentation/process/coding-assistants.rst landed in April 2026 and bans nothing; it requires an Assisted-by: tag naming the agent and model, then draws the hard line:
AI agents MUST NOT add Signed-off-by tags. Only humans can legally certify the Developer Certificate of Origin (DCO). The human submitter is responsible for: Reviewing all AI-generated code... Taking full responsibility for the contribution.
A human signs. The signature is the product.
Open source lost proof-of-work as a social mechanism and rebuilt it as a technical one: read that mailing list from a script today and lore.kernel.org serves you an Anubis challenge, a puzzle deployed to keep AI scrapers out.
Most projects have no position at all. A CNCF survey published April 29, 2026 found roughly two-thirds of respondents were either unaware of any AI guidelines in their project or confirmed none existed. Fewer than 4% prohibit AI outright. More than half want mandatory disclosure they don't currently have. The dominant AI policy in open source isn't permission or prohibition. It's not having noticed.
The reversal
Except the machines got good
The standard narrative is that AI buried maintainers in garbage. That was true. Then it stopped being true.
Daniel Stenberg killed curl's bug bounty on February 1, 2026 after years of escalating slop. In March he moved reporting back to HackerOne. On April 22, 2026 he reported the result: “The slop situation is not a problem anymore.”
Volume did not drop. It roughly doubled again, to more than one report a day. The AI did not go away either: “almost every security report now uses AI to various degrees.” The confirmed-vulnerability rate climbed back to 15–16%, matching curl's pre-AI 2024 baseline.
The upside shows up in the changelogs. In May 2026 Stenberg noted AI-assisted analysis had triggered “somewhere between two and three hundred bugfixes merged in curl through-out the recent 8-10 months or so.” Mozilla's numbers are bigger: Firefox 148 shipped fixes for 22 AI-discovered security bugs, and Firefox 150, on April 21, 2026, shipped fixes for 271 found in a single evaluation pass. Firefox CTO Bobby Holley called the reaction vertigo, because “for a hardened target, just one such bug would have been red-alert in 2025.”
Holley's other observation: “we also haven't seen any bugs that couldn't have been found by an elite human researcher.” The machines did not raise the ceiling. They made the ladder free.
Stenberg, on the model that found one low-severity issue in curl: “the big hype around this model so far was primarily marketing.”
Recruitment
The ladder went missing
The shortage everyone talks about is review capacity. The one in the data is recruitment.
Grafana's developer relations lead David Allen showed his numbers at FOSDEM in early 2026, reported in June by stdlib's Mara Averick. He was used to community growth of 8 to 18 percent a quarter. “I could fall asleep,” he said, “and the community would grow.” Then one quarter it dropped 27 percent. The number of people entering the community had collapsed while user growth kept climbing. Organic traffic to community spaces was down roughly 30 percent, which they attribute to people taking their questions to LLMs instead.
Nobody quit. They just never arrived. The friction open source relied on to see newcomers is the friction that got optimized away.
The measured version arrived on July 4, 2026 in a paper titled “AI Slop is DDoSing Open Source”. Across 294 repositories and over 2 million pull requests and issues, PR volume rose through the paper's 2025 observation window while merge rates fell. One-time contributors took an 18.18% drop in merge rate against the modelled counterfactual. The authors call it a sustainability trap.
| Merged PRs in this project | Max simultaneous open PRs |
|---|---|
| 0 (first-time contributor) | 1 |
| 1 merged PR | 2 |
| 2 merged PRs | 3 |
| 3+ merged PRs | Unlimited |
Jaeger's contributing guidelines now automate that ladder. It's a sensible policy. It's also, structurally, a credit score for strangers. The maintainer who publicised it in February 2026 noted the collateral damage: during an LFX Mentorship application period, a couple of people fired off AI-generated PRs at every “bootcamp issue” reserved for applicants to learn on, leaving nothing for anyone else.
The bottleneck
You cannot mint a maintainer
A causal study published June 16, 2026 evaluated Germany's Sovereign Tech Fund against a matched donor pool of unfunded projects using generalized synthetic control. Funded repositories saw commits rise 143.8% and merged change requests 175.5%.
Effect on the number of contributors: statistically indistinguishable from zero. In the authors' words, the funding “does not translate into measurable community growth. The increased activity appears to be driven by existing contributors rather than by an expansion of the contributor base.” They note this may reflect programme design rather than a hard limit: the fund's sibling programmes target people directly.
- Commits bought by public funding
- +143.8%
- with no detectable increase in the number of contributors
- Agent PRs merged unreviewed
- 79.1%
- of 364 hand-inspected merges showed no feedback loop at all
- Auto-closed PRs later merged
- 8%
- 60 of 714 on one maintainer's tracker over 90 days
Armin Ronacher, two decades into maintaining things other people depend on, wrote in May 2026: “AI has not increased the number of people who need software, or the number of maintainers who can review it. It has mostly increased the amount of code and the number of projects competing for attention.”
His own tracker data from 90 days: 3,145 external issues and pull requests, 2,504 auto-closed because they came from non-approved accounts. Of the auto-closed pull requests, 60 of 714 were ultimately merged, about 8%. He also wrote the year's finest sentence on contributor etiquette: “If your clanker shits on someone else's issue tracker then it's not the fault of GitHub, it's yours alone.”
The reviews that do happen are mostly not reviews. A May 2026 study of 9,799 human-reviewed agentic pull requests found 63% merged. Of 364 merges the researchers inspected by hand, 288 (79.1%) went in with no observable feedback loop and no reviewer-applied commits at all. For OpenAI Codex, exactly 1 of 167 merged PRs in that sample showed human intervention. We automated the apprenticeship out of the apprenticeship.
Some people left. Chad Whitacre, Sentry's head of open source, retired from tech on May 28, 2026: “AI took the last of the wind out of my Open Source sails.”
The word
Meanwhile, “open” got captured
On July 24, 2026, Jensen Huang made his first-ever post on X: a letter co-signed by 25 companies, roughly 50 within a day, titled “Open Weights and American AI Leadership.” It did 173,000 likes and 65 million views.
Not open source. Open weights. A model you can download but cannot reproduce, whose training data you will never see, is now what everyone means by open.
The next morning Julian Schrittwieser, an Anthropic researcher who worked on AlphaGo and MuZero, replied with 6.5 million views of pure acid:
I'm so excited that @JensenHuang is a believer in open source now, looking forward to the CUDA and GPU driver open source release!
Epoch AI measured on May 29, 2026 that the best open-weight models trail frontier closed models by an average of four months, against a three-month average for 2023 through 2025. And Hugging Face's report from March 2026 found that over the period to 2025, independent and unaffiliated developers went from 17% to 39% of all downloads on the hub while industry's share fell from around 70% to 37%.
The open source dynamic, amateurs out-shipping incumbents, is alive and winning. It just moved to the layer where the artifact is weights instead of source, one rename ahead of the licence lawyers.
The price
The market started pricing signatures
AI does make open source developers more valuable. Just not the group people usually mean.
The public-portfolio-as-résumé theory is dead. A hiring manager's July 16, 2026 post hit 1,789 upvotes on r/cscareerquestions describing nine junior candidates with “deployed fullstack apps, clean github, nice UIs.” He asked the strongest one why his own auth flow used refresh tokens instead of JWTs. “i think claude suggested it.” So he switched to opening a random file from each candidate's project and asking them to walk through it. One of the nine could explain everything. Two could explain most.
That's nine candidates and one anonymous manager, so it's an anecdote rather than a rate. His verdict: “im just filtering for kids who talk well now... whatever i had before is dead, and I don't love the new thing either.” A top reply, at 112 upvotes, reads: “Pretty sneaky but I think this is AI.” Nobody can prove anything about anyone anymore, including that.
What replaced the portfolio is the named human. Somebody asked r/rust in July 2026 for codebases worth learning from, specifically work “started before the LLM boom.” The top answer, at 363 upvotes, names a person rather than a repository: “Anything from burntsushi, because he is just a great and meticulous engineer.”
The money has noticed. Anthropic's open-source programme gives maintainers six months of Claude Max free. You qualify under one of five categories, four of them pure thresholds: 500+ dependent repos or 200,000+ monthly downloads, 100+ pull requests merged into repos you don't own in the last year, 20+ external contributors to something you maintain, an OpenSSF criticality score of 0.4 or above, or a commit bit on CPython, Rust, Kubernetes or Linux. OpenAI shipped a comparable programme in June 2026. Both are shopping lists for maintainers who already exist. Neither is a way to make one.
In June 2026, nineteen organisations — AWS, Anthropic, Cisco, Citi, Google, IBM, JPMorganChase, Microsoft, NVIDIA, OpenAI, Red Hat, the Rust Foundation, Vodafone and others — signed the Akrites letter, pledging that “when a critical package has no one maintaining it, Akrites will stand as the maintainer of last resort.” When retail banks and phone companies start co-signing letters about who patches your YAML parser, the externality has been priced.
On July 20, 2026 GitHub announced $100 million cumulative through Sponsors across 70,000 maintainers. The derivative is the line that matters: “The first $10 million took nearly two years. The most recent $10 million took just five months.”
The stakes
Remember which half got expensive
Two things happened at once and everyone reported only the first.
Writing code became free. Reviewing it, deciding whether it should exist, and being the person who answers for it at 3am did not. Those were always the parts that separated a contributor from a maintainer, and for thirty years they arrived bundled with the patch.
The artifact went to zero and the accountability didn't. That's why a fund can buy 144% more commits and no detectable increase in contributors, why Anthropic can hand Claude Max to maintainers and not create a single new one, and why the Linux kernel drew exactly one hard line: only humans can sign.
Nobody can tell whether you wrote it. Everybody can still tell whether you understood it. That gap looks like a hiring problem. It's a pricing signal.
The best-paid work in software over the next few years is standing behind code, not producing it. Open source spent three decades building the only reputation system our industry has that measures exactly that, in public, under your own name. Your commits just got cheap. Your name is the asset. Go maintain something.