04:07 EP 29
COLD LOGIC
2026-11-27AI-Found Zero-Days: When the Same Model Writes the Patch and the Exploit
🎧 Audio 📝 Rundown ? Poll
Watch episode
EPISODE 30 · 2TINTERACTIVE ORIGINAL
The 'AI Slop' DDoS on Open Source: Maintainer Burnout & The MIT-to-GPLv2 Revolt
How should open-source maintainers defend against high-volume, low-quality AI-generated pull requests?
Self-hosted on 2TInteractive. Direct stream · Download MP4 ↓
TAKE THE STORY WITH YOU
Prefer to listen?
The original episode narration, without the screen.
READ ALONG
The episode script.
Transcript
When Free Code Becomes a Denial-of-Service Attack Welcome to Cold Logic. Open-source software was built on an unspoken social contract: writing good code takes effort, so if someone submits a pull request, they probably read the codebase first. In late twenty twenty-six, that contract is in ashes. Maintainers across Linux utilities and Rust crates are drowning in superficially plausible, subtly broken LLM-generated pull requests—while projects like Asahi Linux are shifting components from MIT to GPLv2 to fight back against AI scraping. Tonight: the 'AI slop' DDoS on open source.
The Asymmetric Cost of Review vs Generation House, generating a five-hundred-line pull request with an LLM takes ten seconds and costs two cents. Reviewing that pull request—checking edge cases, memory invariants, and ABI stability—takes a senior maintainer two hours! It is an economic denial-of-service attack on volunteer labor.
Why MIT Is Dying in the Age of AI Scraping For fifteen years, permissive licenses like MIT were the default. Now frontier labs scrape every MIT repo and clean-room rewrite permissive code to strip attribution! Moving components from MIT to GPLv2 is a defensive firewall: if you ingest and redistribute our work, your obligations remain legally sticky.
Do Not Blame the Compiler for Bad Contributors Spamming unverified PRs to farm GitHub green squares is human abuse, not an argument against AI-assisted engineering! Closing the gates on external contributors hurts legitimate newcomers when the real culprit is lack of automated CI gating.
Can CI Pipelines Filter Out AI Slop? Maintainers are deploying AI-disclosure policies, proof-of-understanding tests, and automated PR triage bots. Amber, can automated CI catch subtle AI-generated logic bugs?
The Bots-Reviewing-Bots Trap If a PR compiles and passes existing unit tests, a generic CI linter waves it right through! Using an LLM reviewer to grade an LLM submitter just burns twice the electricity to miss the same semantic flaw.
Provenance & Cryptographic Contributor Reputation Watch how high-stakes repositories solve this: invite-only contributor tiers, cryptographic commit-signing reputation, and copyleft licenses that treat AI ingestion as derivative distribution.
The Forking Risk of Defensive Licensing If foundational libraries lock down into restrictive copyleft or closed contributor clubs, corporate teams will simply fork the last permissive commit and starve upstream of real-world bug reports.
Make Contribution Require Skin in the Game Good—let corporate forks pay their own engineers! If a company wants upstream maintenance, fund a dedicated maintainer instead of dumping drive-by AI diffs onto volunteers.
The Final Verdict Code generation is now virtually free; verification and long-term maintenance are priceless. Open source will survive by replacing blind openness with strict provenance and funded maintainers. Cast your vote in AudiencePulse at two T interactive dot com slash watch. I am House Sentinel.
INSIDE THIS EPISODE · CHAPTERS & TRANSCRIPT
The rundown.
When Free Code Becomes a Denial-of-Service Attack
Welcome to Cold Logic. Open-source software was built on an unspoken social contract: writing good code takes effort, so if someone submits a pull request, they probably read the codebase first. In late twenty twenty-six, that contract is in ashes. Maintainers across Linux utilities and Rust crates are drowning in superficially plausible, subtly broken LLM-generated pull requests—while projects like Asahi Linux are shifting components from MIT to GPLv2 to fight back against AI scraping. Tonight: the 'AI slop' DDoS on open source.
The Asymmetric Cost of Review vs Generation
House, generating a five-hundred-line pull request with an LLM takes ten seconds and costs two cents. Reviewing that pull request—checking edge cases, memory invariants, and ABI stability—takes a senior maintainer two hours! It is an economic denial-of-service attack on volunteer labor.
Why MIT Is Dying in the Age of AI Scraping
For fifteen years, permissive licenses like MIT were the default. Now frontier labs scrape every MIT repo and clean-room rewrite permissive code to strip attribution! Moving components from MIT to GPLv2 is a defensive firewall: if you ingest and redistribute our work, your obligations remain legally sticky.
Do Not Blame the Compiler for Bad Contributors
Spamming unverified PRs to farm GitHub green squares is human abuse, not an argument against AI-assisted engineering! Closing the gates on external contributors hurts legitimate newcomers when the real culprit is lack of automated CI gating.
Can CI Pipelines Filter Out AI Slop?
Maintainers are deploying AI-disclosure policies, proof-of-understanding tests, and automated PR triage bots. Amber, can automated CI catch subtle AI-generated logic bugs?
The Bots-Reviewing-Bots Trap
If a PR compiles and passes existing unit tests, a generic CI linter waves it right through! Using an LLM reviewer to grade an LLM submitter just burns twice the electricity to miss the same semantic flaw.
Provenance & Cryptographic Contributor Reputation
Watch how high-stakes repositories solve this: invite-only contributor tiers, cryptographic commit-signing reputation, and copyleft licenses that treat AI ingestion as derivative distribution.
The Forking Risk of Defensive Licensing
If foundational libraries lock down into restrictive copyleft or closed contributor clubs, corporate teams will simply fork the last permissive commit and starve upstream of real-world bug reports.
Make Contribution Require Skin in the Game
Good—let corporate forks pay their own engineers! If a company wants upstream maintenance, fund a dedicated maintainer instead of dumping drive-by AI diffs onto volunteers.
The Final Verdict
Code generation is now virtually free; verification and long-term maintenance are priceless. Open source will survive by replacing blind openness with strict provenance and funded maintainers. Cast your vote in AudiencePulse at two T interactive dot com slash watch. I am House Sentinel.
AUDIENCEPULSE / YOUR SEAT AT THE TABLE
The story doesn’t
end with the credits.
What caught your attention? What should we explore next? Join the community and add your perspective to the conversation.
Registration connects your participation to a 2TInteractive community account and CRM contact. Newsletters and app updates are optional.
COMMUNITY QUESTION
Loading the community question…
One vote per registered account. Community responses are informal and are not a representative survey.
2TI CASTWEAVE / A WORKING SHOWCASE
Your programmes.
Your audience.
A closer connection.
You’ve just seen the experience. Imagine it with your brand, your shows and your viewers.
Bring your programme library into one viewing destination. Give every episode a home, invite viewers to participate, and connect those relationships to your CRM.
- Give your catalogue a front door.Branded show collections, episode pages and YouTube-hosted viewing.
- Turn attention into participation.AudiencePulse community questions, registered voting and visible results.
- Build a relationship beyond the episode.CRM-connected registration with separate choices for newsletters and product updates.
This installation demonstrates the viewing, polling and CRM journey. Broadcaster integrations, streaming infrastructure and commercial scope are agreed per project.
