When Free Code Becomes a Denial-of-Service Attack
Welcome to Cold Logic. Open-source software was built on an unspoken social contract: writing good code takes effort, so if someone submits a pull request, they probably read the codebase first. In late twenty twenty-six, that contract is in ashes. Maintainers across Linux utilities and Rust crates are drowning in superficially plausible, subtly broken LLM-generated pull requests—while projects like Asahi Linux are shifting components from MIT to GPLv2 to fight back against AI scraping. Tonight: the 'AI slop' DDoS on open source.

The Asymmetric Cost of Review vs Generation
House, generating a five-hundred-line pull request with an LLM takes ten seconds and costs two cents. Reviewing that pull request—checking edge cases, memory invariants, and ABI stability—takes a senior maintainer two hours! It is an economic denial-of-service attack on volunteer labor.

Why MIT Is Dying in the Age of AI Scraping
For fifteen years, permissive licenses like MIT were the default. Now frontier labs scrape every MIT repo and clean-room rewrite permissive code to strip attribution! Moving components from MIT to GPLv2 is a defensive firewall: if you ingest and redistribute our work, your obligations remain legally sticky.

Do Not Blame the Compiler for Bad Contributors
Spamming unverified PRs to farm GitHub green squares is human abuse, not an argument against AI-assisted engineering! Closing the gates on external contributors hurts legitimate newcomers when the real culprit is lack of automated CI gating.

Can CI Pipelines Filter Out AI Slop?
Maintainers are deploying AI-disclosure policies, proof-of-understanding tests, and automated PR triage bots. Amber, can automated CI catch subtle AI-generated logic bugs?

The Bots-Reviewing-Bots Trap
If a PR compiles and passes existing unit tests, a generic CI linter waves it right through! Using an LLM reviewer to grade an LLM submitter just burns twice the electricity to miss the same semantic flaw.

Provenance & Cryptographic Contributor Reputation
Watch how high-stakes repositories solve this: invite-only contributor tiers, cryptographic commit-signing reputation, and copyleft licenses that treat AI ingestion as derivative distribution.

The Forking Risk of Defensive Licensing
If foundational libraries lock down into restrictive copyleft or closed contributor clubs, corporate teams will simply fork the last permissive commit and starve upstream of real-world bug reports.

Make Contribution Require Skin in the Game
Good—let corporate forks pay their own engineers! If a company wants upstream maintenance, fund a dedicated maintainer instead of dumping drive-by AI diffs onto volunteers.

The Final Verdict
Code generation is now virtually free; verification and long-term maintenance are priceless. Open source will survive by replacing blind openness with strict provenance and funded maintainers. Cast your vote in AudiencePulse at two T interactive dot com slash watch. I am House Sentinel.