▶ YouTube Summaries

• YT :: https://www.youtube.com/watch?v=qazhWj8kYLo
• Original title :: AI Has Broken Open Source

A walk through 2026's open-source closures — curl's bug bounty, Cal.com going closed, Codeberg banning mostly-AI projects — arguing that the real crisis is not slop but volume. AI collapsed the effort asymmetry that made contribution triage viable: reports and PRs now cost minutes to produce and still cost maintainers hours to evaluate. Forrest's position is that quality has already recovered, detection is impossible, and the answer is pipelines and vouching rather than blanket AI bans.

The effort asymmetry that broke

Daniel Stenberg shut down curl's bug bounty in January 2026. Over six years it had paid out $100k+ for 87 real vulnerabilities at a ~15% accuracy rate — a workable ratio when producing a report took days of genuine exploitation work and triage took an hour or two. AI inverted it: reports now take a minute to generate, triage still takes an hour, and with money on the table accuracy fell below 5%. Stenberg was reading twenty reports to find one real bug, so he removed the incentive to fabricate. curl kept accepting security reports via GitHub and email, just without payment; the PR pipeline was left alone because 200+ CI jobs already filter bad PRs before any human looks.

The 2026 timeline

• January — curl's bounty closes. Ghostty allows AI-assisted contributions but permabans anyone submitting slop. tldraw auto-closes all outside contributions. NetBSD had already banned AI-generated commits back in 2024, on provenance grounds rather than quality: nobody knows what the model was trained on or whose license applies.
• February — Mitchell Hashimoto ships vouch: your PR gets looked at only if an existing contributor vouches for you.
• March — HackerOne pauses the Internet Bug Bounty entirely after submissions nearly doubled with almost none being real.
• April — Cal.com closes its repo after five years open, reasoning that "code is no longer just read, it is scanned, mapped, and exploited at near zero cost. Transparency becomes exposure" — the direct inversion of Linus's Law.
• May onward — the Linux kernel's private security list goes from 2–3 reports a week to more than double that per day; Linus calls it unmanageable, despite 80–90% of kernel contributions coming from salaried engineers at Intel, Microsoft and similar.
• July — Codeberg members vote 358–144 to ban mostly-AI-written projects.

Linus is not anti-AI

Despite having arguably the worst report load in open source, Linus stated the kernel "is not one of those anti-AI projects" and that objectors can fork or walk away. AI-assisted code is accepted provided a human reviewed it and takes responsibility. The statement was triggered by pushback against Sashiko, an AI bot reviewing kernel patches since March.

Democratization vs. dictatorship

DHH argues maintainers reject AI contributions out of envy and status games rather than slop. Forrest concedes gatekeeping is real in this industry — Stack Overflow being the canonical example — but rejects the framing: open source is not a democracy, it is a dictatorship. An author chooses open or closed, chooses the license, and chooses whose PRs to read. Maintainers are within their rights to ban AI whether or not he agrees with the call. He also notes vouch-style policies just swap one gate (no AI) for another (you must know someone).

Codeberg's real motive is hardware cost

License laundering — running an AI over a licensed codebase until the copyright is stripped — is one stated worry, but Forrest thinks money drives it. Codeberg runs on donations, not Microsoft's balance sheet, and AI demand pushed a disk that cost €700 a few years ago to €3,700 today. Meanwhile contributors can generate tens of thousands of lines a day and scrapers hammer the servers. GitHub itself had Actions down for hours on August 6th, with vastly more resources.

Detection doesn't work

Strip the Co-authored-by trailer, the slop README and the giveaway comments, and there is no reliable way to tell AI code from human code. Anti-AI policies are deterrents, not filters, and plenty of anti-AI repos almost certainly contain AI code that passed the Turing test. Forrest's stance: let the code stand on its own — good code in regardless of author, bad code ignored, utter slop earns a Ghostty-style permaban.

The slop era is over; the flood isn't

The controversial claim. Models got better, so incoming AI code is no longer reliably garbage — Stenberg himself is the evidence. After moving curl's reports to GitHub, he judged it a mistake and returned to HackerOne; with still no money offered, volume came back higher than before and accuracy climbed back above 15%. Maintainers are now turning down help that is actually good, purely for lack of review capacity, while many still operate under the old no-AI-whatsoever mindset.

What actually works

• Vouching — Ghostty's model: gate on social proof, then allow AI under that condition while banning slop.
• Heavy CI — curl, Ghostty and Bun run 200+ jobs on a PR before a human spends a minute on it.
• Fighting fire with fire — AI code review in the pipeline itself; Bun makes it a required check, the kernel has Sashiko.

Forrest declines to name one answer: every project has a different budget, headcount and goal, so the solution differs. The underlying principle he keeps returning to is to stop making humans do work a pipeline should do.