Why this page exists
I wrote this because I made this mistake myself.
I'd been learning to use Claude Code and was feeling productive — maybe a little too productive. I found an open source journalism project I genuinely admire, saw some open issues, and thought I could help. I did test the code and verify the changes were relevant and accurate. But I opened several pull requests — multiple PRs, across multiple repos, in the span of about an hour. All AI-assisted. And that was the problem.
It doesn't matter that my code was good. The maintainers had no way to know that. To a small team receiving multiple AI-authored PRs from a stranger in rapid succession, the pattern looked like the start of a flood — the kind of flood they'd been reading about other projects drowning in. They had no reason to assume good faith from someone they'd never seen before. They had every reason to be concerned.
A maintainer from the project emailed me. They were gracious and patient about it — far more than they needed to be. They explained that as a small team, they couldn't review back-to-back AI-authored pull requests, especially several in one hour. They asked me to pick a single issue, make sure it followed best practices and passed tests in my local dev environment, and then let them know when it was ready for review. No anger. No public shaming. Just a clear, professional request to slow down and do it right.
In my case, the code itself was fine (I think). This was a false positive on quality. But it was a true positive on the pattern — and if they hadn't said something, I probably would have kept going, submitting PRs on every open issue I felt comfortable tackling. That's the thing about enthusiasm combined with powerful tools: it doesn't feel like a flood when you're the one sending it.
On top of that, even though I did my best to verify what I was submitting, I'm a beginner. There's an old distinction between "known unknowns" and "unknown unknowns" — the things you know you don't know versus the things you don't even know to look for. As an early-stage contributor, I had plenty of both. There are edge cases, architectural decisions, project-specific conventions, and backward compatibility concerns that an experienced contributor would catch but that I'd walk right past. I didn't even know what questions to ask, let alone the answers. Following what you think is proper procedure isn't the same as actually knowing what proper procedure is for a given project. Every codebase has its own norms, and you can't learn them from the outside.
That's why, especially as a beginner, it's worth going the extra mile before you even think about contributing: actually use the app or project you want to help with. Read through the codebase. Explore the existing issues and past pull requests to understand how the community works. And reach out to the maintainers first — ask if they're open to AI-assisted contributions, ask if there are norms or practices you should know about, and ask which issues would be most helpful to tackle. A five-minute conversation can save everyone hours of wasted work.
And here's the uncomfortable truth that goes beyond etiquette: even if you follow every best practice on this page, the maintainer may still not want your code. When AI makes writing code trivial, the code itself stops being the valuable part of a contribution. Nikita Roy, a data scientist, Knight Fellow at ICFJ, and founder of Newsroom Robots, put it bluntly when I told her about my experience: "AI-generated PRs are putting real strain on maintainers right now, even well-intentioned ones, and it's a big issue in tech circles. So even with following best practices, I don't believe that's necessarily the solution." She pointed me to Steve Ruiz's blog post about shutting down external PRs on tldraw, where he asked: "If writing the code is the easy part, why would I want someone else to write it?" The answer might be that the most valuable thing you can contribute isn't code — it's bug reports, documentation, testing, design feedback, or a well-written issue that helps the maintainer understand a problem they haven't seen yet.
And my situation is still the mild version. I at least took the time to verify what I was submitting. The problem is made far worse by people who don't — who point an AI at a repo, generate a patch, and submit it without reading, testing, or understanding any of it. Maintainers can't tell the difference at a glance between a well-tested AI-assisted PR and a completely untested one. The volume and the pattern look the same from their side.
I got lucky. I got a kind email from a patient person. Many open source maintainers aren't in a position to be that generous. They're unpaid volunteers maintaining projects that millions of people depend on, and they're being hit with a flood of AI-generated contributions from strangers who never bothered to check their work. Some maintainers have shut down their bug bounty programs. Others have closed their projects to outside contributions entirely. A few have started keeping public lists of repeat offenders. My experience was mild compared to what many of them deal with every day.
This course teaches you to use AI coding agents. That means you'll be able to generate code faster than you ever could before. That power comes with a responsibility: as Simon Willison put it, your job is to deliver code you have proven to work. Just because you can generate a pull request in five minutes doesn't mean you should.
The core problem: effort asymmetry
AI coding agents have eliminated the natural friction that used to limit low-quality contributions. Writing code used to be hard enough that only people who cared would bother submitting a pull request. Now anyone can generate a plausible-looking PR in minutes. But reviewing that PR still takes just as long as it always did — often longer, because AI-generated code can look structurally fine while being logically wrong.
THE EFFORT ASYMMETRY
"Before AI, I might get one bad PR every six months. Now it feels like every other week."
— Mitchell Hashimoto, creator of Ghostty (SpecStory interview)
The journalism analogy
If you've ever worked at a publication, you know what it's like to receive unsolicited pitches from people who clearly haven't read your outlet. They don't know your beat, they haven't looked at what you've published, and the pitch doesn't match your audience. Reading and responding to each one takes time, even if the answer is no.
Now imagine those pitches arrive ten times faster because the sender used AI to generate them. The sender spent two minutes. You spent twenty. That's what's happening to open source maintainers right now.
What's happening right now
The problem has a name: AI slop. It refers to plausible-looking but broken contributions — pull requests, issues, bug reports, even security disclosures — that are generated by AI tools and submitted without meaningful human review. The term is spreading because the problem is spreading.
Here's what it looks like in practice:
curl shuts down its bug bounty program
curl is one of the most widely used open source tools in the world — it's the command-line utility for transferring data via URLs. It runs on virtually every computer, phone, and server.
In July 2025, curl's creator Daniel Stenberg published "Death by a thousand slops" describing how roughly 20% of the project's bug bounty submissions were AI-generated garbage. The valid rate dropped to just 5%. One submission described an "HTTP/3 Stream Dependency Cycle Exploit" complete with fake debugging sessions referencing a function that doesn't exist in curl's codebase.
By January 2026, Stenberg shut down curl's six-year bug bounty program entirely — over $86,000 in historical payouts ended because AI-generated submissions made triage unsustainable.
"Not to mention the emotional toll it takes to deal with these mind-numbing stupidities."
— Daniel Stenberg, curl creator ("Death by a thousand slops")
Ghostty implements zero-tolerance policy
Ghostty is a popular terminal emulator created by Mitchell Hashimoto (who also created Vagrant, Terraform, and co-founded HashiCorp). In January 2026, after months of escalating problems, Hashimoto adopted a zero-tolerance AI policy:
- — AI-assisted PRs are only allowed for issues that have already been accepted by maintainers
- — Drive-by AI PRs are closed immediately
- — Repeat offenders go on a public list blocking all future contributions
The policy requires that contributors fully understand every line of code they submit. Hashimoto was explicit that this isn't anti-AI — the Ghostty codebase itself is written with AI assistance, and maintainers use AI daily.
"This is not an anti-AI stance. This is an anti-idiot stance."
— Mitchell Hashimoto (Ghostty AI policy)
tldraw closes all external pull requests
tldraw is a popular open source drawing tool. In January 2026, creator Steve Ruiz began auto-closing all external pull requests due to AI slop.
Ruiz described a pattern: he'd write casual issue descriptions from personal notes, and external contributors would feed those descriptions to AI tools, generating "nonsense solutions based on nonsense issues" — AI on both sides of the contribution, with no human understanding in between.
His central question cut to the heart of it: "If writing the code is the easy part, why would I want someone else to write it?" The valuable part of a contribution isn't the code — it's the research, design thinking, and contextual understanding that justify the code review effort.
OCaml rejects a 13,000-line AI-generated PR
In November 2025, the OCaml programming language received a massive pull request — over 13,000 lines — adding DWARF debugging support. The contributor described his role as "directing, shaping, cajoling, and reviewing" Claude Code rather than writing the code himself.
Maintainer Gabriel Scherer rejected it, explaining that reviewing AI-generated code is more taxing than reviewing human-written code, and the project already had more contributors than reviewers. Copyright questions also arose when files credited a specific developer despite claims the code was AI-generated.
The lesson: a 13,000-line PR with no prior design discussion creates work for maintainers, regardless of whether a human or an AI wrote it.
AI-generated security reports
Seth Larson, the Python Software Foundation's Security Developer-in-Residence, documented a rise in AI-generated security reports that "appear at first glance to be potentially legitimate and thus require time to refute." One report flagged urllib3's deliberate disabling of SSLv2 as a security vulnerability — the scanning tool couldn't understand that the code was intentionally secure.
"Security reports that waste maintainers' time result in confusion, stress, frustration, and isolation — which can add to burnout of highly-trusted contributors."
— Seth Larson, Python Software Foundation ("The new era of slop security reports")
What it looks like done right
Joshua Rogers finds 50 real bugs in curl
In September 2025 — while curl was drowning in AI-generated garbage reports — security researcher Joshua Rogers used AI tools to identify 50 real bugs in curl's source code. Daniel Stenberg called the findings "actually truly awesome."
What made Rogers different from the slop submitters:
- > He tested multiple AI tools and evaluated their output himself using his own security expertise
- > He filtered results before submitting — not raw AI output, but a curated list
- > He had the domain knowledge to distinguish real bugs from hallucinated ones
- > He submitted findings in a format that respected the maintainer's time
As Simon Willison noted: "This is yet another illustration of how much more interesting these tools are when experienced professionals use them to augment their existing skills."
Rogers used the same tools as the slop submitters. He just applied judgment, expertise, and care on top of them.
Your job is to deliver code you have proven to work
Simon Willison — co-creator of the Django web framework and one of the most respected voices on AI in software development — wrote a piece in December 2025 that frames it clearly:
"As software engineers we don't just crank out code — in fact these days you could argue that's what the LLMs are for. We need to deliver code that works — and we need to include proof that it works as well. Not doing that directly shifts the burden of the actual work to whoever is expected to review our code."
— Simon Willison, "Your job is to deliver code you have proven to work"
Willison's framework has two steps, neither optional:
1. MANUAL TESTING
If you haven't seen the code do the right thing yourself, that code doesn't work. Run it. Check the output. Try the edge cases. If you can, paste terminal output or a screen recording into the PR to show your reviewer what you saw.
2. AUTOMATED TESTING
Your contribution should include a test that proves the change works. That test should fail if you revert the change. AI coding agents are good at writing tests — there's no excuse for skipping this step.
The key insight for AI-assisted work: make your coding agent prove its changes work before you submit them. If Claude Code writes a fix, tell it to also write a test, run the test, and show you the results. Don't submit something you haven't seen succeed.
Before you contribute: the checklist
Before you open a pull request on someone else's project — especially if you used AI tools to write any of the code — go through this list. Every item matters.
Check for an AI contribution policy
Look for AI_POLICY.md, AGENTS.md, or references to AI in CONTRIBUTING.md. A growing list of projects have explicit policies. Some ban AI contributions entirely. Some require disclosure. Some allow AI with conditions. Respect whatever the project has decided.
Read the existing code first
Understand the project's patterns, conventions, and architecture before pointing an AI at it. AI tools generate code that looks right but often doesn't match how the project actually works. The maintainer will see this immediately.
Open an issue before opening a PR
Ask if the change is wanted. Describe the problem you're solving and your proposed approach. This takes five minutes and can save everyone hours. A 13,000-line surprise PR with no prior discussion is a burden, not a gift.
Understand every line you submit
If you can't explain what your code does and how it interacts with the rest of the project without asking the AI again, you're not ready to submit. Mitchell Hashimoto's rule: "Never commit code you cannot explain. AI should help you learn faster, not think less."
Test your changes yourself
Run the project's test suite. Run your changes manually. Add automated tests for new behavior. If your coding agent wrote the code, make it also prove the code works. Paste evidence into the PR: terminal output, screenshots, test results.
Keep it small and focused
Small PRs that do one thing well are easier to review than sprawling changes. A 50-line fix with tests is more likely to get merged than a 500-line refactor nobody asked for. Start small, build trust, then scale up.
Disclose AI usage
Note in the PR description that you used AI tools. It helps reviewers calibrate how much attention to give different parts of the code. More on the emerging standards for this below.
Follow through on feedback
If a maintainer takes the time to review your PR and leave comments, respond to them. The social contract of open source includes iteration. Don't submit and disappear — that wastes the reviewer's investment.
Follow the project's templates and guidelines
If there's a PR template, fill it out completely. If there's a CLA (Contributor License Agreement), sign it. If there's a code style guide, match it. These exist for a reason, and ignoring them signals that you didn't care enough to read them.
Don't spray PRs across dozens of repos
If you've opened similar AI-generated PRs to many repositories in a short period, maintainers will notice. It signals automated, indiscriminate submission rather than genuine engagement. Focus on one project at a time and contribute meaningfully.
Disclosing AI usage: the emerging standards
There's no single standard yet, but a consensus is forming. Several major projects now require or recommend commit trailers that indicate AI involvement:
| TAG | USED BY | MEANING |
|---|---|---|
| Assisted-by: | Fedora, Linux kernel, OpenInfra | AI helped, but a human authored the work |
| Generated-by: | Apache Software Foundation, OpenInfra | AI generated substantial portions of the content |
| Co-developed-by: | Linux kernel (proposed) | Joint human-AI development |
The emerging consensus:
- > Disclosure should be proportional. Autocomplete suggestions and grammar fixes don't need it. Substantial code generation does.
- > The contributor remains accountable regardless of what tools they used. AI can't sign a CLA or a Developer Certificate of Origin.
- > Disclosure helps reviewers allocate attention. Knowing which parts of a PR were AI-generated tells a reviewer where to look more carefully.
EXAMPLE COMMIT MESSAGE
Fix date parsing for non-US locale formats
The existing regex assumed MM/DD/YYYY order. This patch adds
locale-aware parsing using dateutil, with tests for ISO 8601,
European (DD/MM/YYYY), and US formats.
Assisted-by: Claude Code (anthropic.com)
Where projects stand
As of early 2026, projects fall into three broad categories. Always check the specific project's policy before contributing.
AI CONTRIBUTIONS BANNED
No AI-generated code accepted, full stop. Usually driven by copyright uncertainty and quality concerns.
Examples: Gentoo Linux, QEMU, Zig, GIMP, Forgejo, Asahi Linux, Apache CouchDB
ALLOWED WITH DISCLOSURE
AI tools are fine as long as you disclose usage and take full responsibility. This is the most common stance.
Examples: Fedora, Linux kernel, Apache SF, CPython, Django, Rust, NumPy
PROJECT-SPECIFIC RULES
Custom policies ranging from "strongly discouraged" to "allowed only for accepted issues." Read the docs.
Examples: Ghostty (accepted issues only), tldraw (closed to external PRs), nvim-tree (discouraged)
The repository melissawm/open-source-ai-contribution-policies tracks these policies across open source projects.
The 3 Cs: how maintainers evaluate contributors
The GitHub Blog published "Rethinking open source mentorship in the AI era" proposing a useful framework for evaluating contributions. Before you submit a PR, ask yourself these three questions:
COMPREHENSION
Do I understand the problem?
Can you explain, in your own words, what's broken and why your change fixes it? If you'd need to ask the AI to answer questions about your own PR, you don't have comprehension yet.
CONTEXT
Am I providing the right information?
Does your PR description explain the what and why? Did you disclose AI usage? Did you follow the project's PR template? Context reduces the reviewer's burden.
CONTINUITY
Will I be here for the follow-up?
Will you respond to review comments? Will you fix issues that come up? Will you maintain what you built? Drive-by PRs signal that you don't care about the project — just about the contribution.
Things you should never do
- X Submit AI output you haven't reviewed or tested
- X Mass-file AI-generated issues or bug reports across many projects
- X Submit PRs for issues you don't understand just because the AI made it easy
- X Hide or deny AI usage when asked
- X Submit a massive PR with no prior discussion or issue
- X Use AI to hunt for bug bounties in projects you've never used
- X Ignore PR templates, contribution guidelines, or CLAs
- X Submit and disappear when someone leaves review feedback
- X Open similar AI-generated PRs across dozens of repositories
The bottom line
AI coding agents are powerful tools. This course teaches you to use them. But the moment you point those tools at someone else's project, you take on a responsibility to that project's maintainers — people who are often unpaid volunteers building software the whole world depends on.
The question isn't whether you can generate a pull request in five minutes. The question is whether the pull request is worth someone else's hour to review.
Be the Joshua Rogers, not the slop submitter. Use AI to augment your understanding, not to bypass it. Prove your code works before asking someone else to look at it. And when in doubt, open an issue first.
Open source runs on trust, and trust is built by showing up with care.
Sources and further reading
- Simon Willison, "Your job is to deliver code you have proven to work" (Dec 2025) — the core framework for responsible contribution
- Daniel Stenberg, "Death by a thousand slops" (Jul 2025) — the curl maintainer on AI-generated bug reports
- Seth Larson, "The new era of slop security reports" — Python Software Foundation on AI security report spam
- Ghostty AI policy — Mitchell Hashimoto's zero-tolerance approach with rationale
- Steve Ruiz, "Stay away from my trash" (Jan 2026) — why tldraw closed external PRs
- Simon Willison on Joshua Rogers' curl bug discoveries (Oct 2025) — the positive example of AI-assisted research
- GitHub Blog, "Rethinking open source mentorship in the AI era" — the 3 Cs framework
- Open source AI contribution policies tracker — which projects have explicit AI policies
- DevClass, "OCaml maintainers reject massive AI-generated pull request" (Nov 2025) — the 13,000-line PR case study
- The Register, "GitHub ponders kill switch for pull requests" (Feb 2026) — GitHub's response to the problem
- Apache Software Foundation generative tooling guidance — disclosure standards for ASF projects
- Continue Blog, "We're losing open contribution" — the broader impact on open source culture