▶ YouTube Summaries

• YT :: https://www.youtube.com/watch?v=qazhWj8kYLo
• Original title :: AI Has Broken Open Source

A walk through 2026's open-source closures, contribution bans and bounty shutdowns. Forrest's core claim: the "slop era" is over - AI output quality is no longer the problem. The problem is volume. Review capacity, not code quality, is now the bottleneck, and maintainers are still writing anti-AI policies aimed at a problem that has already changed shape.

The asymmetry

Bug bounties used to have a favourable time ratio: days or longer to find a vulnerability and write a report, one or two hours for the maintainer to triage it. AI collapsed the submission side to a minute or two while leaving triage untouched.

Timeline

• January :: Daniel Stenberg shuts down curl's bug bounty after six years, 87 vulnerabilities patched and over $100k paid out. Report accuracy fell from ~15% to under 5% - roughly 19 junk reports per real one. He removed the money to remove the incentive to fabricate, but kept taking security reports by GitHub and email. curl's PR system was untouched because 200+ CI jobs already filter PRs before any human looks.
• Also January :: Mitchell Hashimoto allows AI-assisted contributions to Ghostty but permanently bans anyone submitting slop. tldraw auto-closes all outside contributions. NetBSD had already banned AI-generated commits back in 2024, on provenance and licensing grounds rather than quality.
• February :: Hashimoto ships vouch - an existing contributor must vouch for you before your PR is reviewed.
• March :: HackerOne pauses the Internet Bug Bounty entirely after submissions roughly doubled with almost all of them bad.
• April :: Cal.com closes its repo after five years open, arguing "code is no longer just read, it is scanned, mapped, and exploited at near zero cost - transparency becomes exposure". A direct inversion of Linus's law.
• May :: The Linux kernel's private security list goes from two or three reports a week to more than double that per day; Torvalds calls it unmanageable. Notable because 80-90% of kernel contributions come from salaried employees at Intel, Microsoft and the like.
• July :: Torvalds nonetheless states Linux "is not one of those anti-AI projects" and that objectors can fork or walk away. AI assisted code is accepted if human-reviewed with the submitter taking responsibility. The statement was prompted by pushback against Sashiko, an AI bot reviewing kernel patches since March.
• July :: Codeberg members vote 358-144 to ban mostly-AI-written projects.

Codeberg's real motive

Beyond license laundering - running existing code through an AI until it is changed enough to shed its license - Forrest thinks the driver is cost. Codeberg runs on donations, not Microsoft money, while AI demand has pushed a disk from €700 to €3,700, contributors can push tens of thousands of generated lines a day, and scrapers hammer the servers. For contrast, GitHub Actions was down for hours on August 6th despite its owner's resources.

Detection is impossible

Strip the co-authored-by trailer, the slop README and the giveaway comments and there is no reliable way to tell. Policies act as deterrent only. He is confident plenty of anti-AI repos contain AI code that simply passed - and notes he cannot prove it, which is the point.

On DHH's "democratize open source"

DHH attributes refusal of AI contributions to envy and status games. Forrest concedes software has a real gatekeeping history (Stack Overflow) but rejects the framing: open source is not a democracy but a dictatorship - you choose the license, the contributors and the PRs you read. Agents do lower the barrier to entry, which is genuine democratization of building software, though money and frontier-model access put levels on it.

What actually works

No single answer - budget, manpower and goals differ per project. Options in use:

• Vouching (Ghostty).
• Heavy CI before human review: curl, Ghostty and Bun run 200+ jobs on a PR first.
• Fighting fire with fire: AI review in the pipeline. Bun makes it a required check; the kernel has Sashiko.

The vindication of the "let the code stand on its own" position: after closing the bounty, Stenberg moved reports to GitHub, decided that was worse, and returned to HackerOne. With no money offered, volume came back higher than before - but real-report rate is back above 15%. The new predicament is having to turn away good help for lack of review capacity.