When bans fail: AI contributions force open projects to rewrite the rules

Blanket bans on AI-assisted work no longer hold. Across standards bodies and code projects, maintainers are confronting the same failure mode: policies written when large language models were mostly noise are being ignored, sidestepped, or overwhelmed by volume, and the cost is landing on reviewers rather than generators.

The pressure is clearest at the IETF, where independent Internet-Draft traffic has spiked hard enough that veterans are talking about spam controls. Ross Finlayson opened a recent list thread with the blunt line: "Folks, this is getting out of hand." He floated a tongue-in-cheek bond for non-working-group drafts, then the real proposal: treat the surge like spam, at least by splitting announcement lists so people can drop the independent flood. Stephen Farrell, looking at a multi-decade heatmap of -00 submissions, called it a "pandemic of probable crap." Theodore Tso pointed at watermarking and detectors such as Google's SynthID, and at Claude's forthcoming public tools, as possible additions to the toolbox, while noting open-weight models will slip past them.

Lars Eggert argued the deeper point. "I believe the issue of fully or partially AI-generated IETF contributions is here to stay," he wrote, refusing the fantasy of putting the genie back. Tooling and -00 rate limits might blunt DDoS-like bursts, but they are stopgaps. The real shift matches open source: generating text is cheap; vetting it is not. Eggert expects to grow quicker at ignoring newcomers without a prior track record unless someone he trusts engages, or the topic sits in an area he cares about deeply. Carsten Bormann answered the predictable downside: if everyone does that, the IETF becomes less open, and genuine new voices drown in slop. His fix is attention infrastructure inside the Datatracker: commendations with graded interest, per-viewer weights based on authorship and leadership history, private subjective document scores rather than a public reputation system.

Andrew Yourtchenko offered a different filter, closer to a web of trust. Of drafts adopted in a recent window, only a handful had entire author lists with no prior RFC or working-group draft history. A rate limiter that grants one free hanging -00, then requires a shepherd from people already in the community, might slow pure cold-start spam without killing outsider brilliance that later clears via the Independent Stream Editor. S. Moonesamy added the working-group angle: some list traffic and drafts already show AI fingerprints; some are simply muddled because the barrier to filing fell.

QEMU is living the same tension from the other side of a hard ban. Paolo Bonzini posted an intentional full U-turn on AI-generated contributions, not because earlier copyright and DCO arguments vanished, but because the project hit a "unanimity trap." Small carve-outs for tests, comments, or bugfixes never stuck; disagreement always collapsed back to "no AI for code generation." Meanwhile the ban was already leaking. "Don't ask, don't tell" is a red flag, he wrote. The new hypothesis attacks maintainer burnout rather than provenance theater: keep humans in the design loop, document rules where agents will actually read them, and try cautious experimentation in the spirit of Rust and Software Freedom Conservancy guidance instead of a free-for-all or a pure prohibition.

That is what the proposed AGENTS.md (plus CLAUDE.md and GEMINI.md shims) is for. Daniel Berrangé framed the prior failure as partly documentation: a policy buried in developer docs never reached the tools people actually run. Concise, explicit agent instructions beat long prose; agents are "too eager to help you not be banned," Bonzini noted, so forbidding is easier than reshaping helpfulness. Skills with on-demand loading may keep context smaller than one giant instruction file. Alistair Francis put the enforcement problem plainly: "a blanket ban just leads people to ignore the ban and use AI anyway and lie about it." Limited, declared use with pre-arrangement for large series may produce more honesty than absolute rules people already violate in good faith.

Peter Maydell is not sold that more generation is the problem QEMU needs solved. The bottlenecks are review capacity, automated bug-finding against existing code, and unmaintained legacy, not a shortage of patches. An AI policy whose main move is allowing more generated code, he argued, will raise reviewer load. Bonzini and others counter that the load is arriving anyway; the choice is whether maintainers get disclosure, pre-review gates, and agent-visible norms, or silent LLM output mixed into ordinary series. Alex Bennée pressed for a minimal AGENTS.md that at least encodes the current rule so unaware users stop shipping policy-blind agent output tomorrow, while the larger rewrite is debated.

Emacs is having a smaller, sharper version of the same argument over an ELPA-bound Sapling client. Swithin Chan submitted sl.el, a Magit-inspired interface written with token burn on Windows where Git felt too slow, and later stripped headers after pushback. Richard Stallman drew a bright line that still leaves gray zone: maintainers do not object to bug information that came from someone running an LLM, provided humans verify the bug is real, because "LLMs and humans both make mistakes." That is tolerance for AI-assisted triage and reporting, not a blank check for LLM-authored packages. The submission thread still leaves unresolved how NonGNU or GNU ELPA should label, reject, or demand human accountability for code that was clearly agent-shaped.

Across all three venues the technical substance is less about model magic than about process controls that might scale. Detectors and watermarks are incomplete. Rate limits and shepherd requirements trade openness for signal. AGENTS.md and skills files try to put policy in the prompt path rather than a wiki page nobody's bot reads. Commendation graphs and private attention scores try to save reviewer time without a single global trust metric. Disclosure norms try to replace undetectable bans with social pressure and maintainer discretion.

Nothing is settled. IETF still has no consensus detector, bond, or Datatracker commendation design, only a shared sense that independent -00 volume is a spam-class problem and that ignoring strangers will quietly close the door. QEMU's U-turn is explicitly a request for comments, not landed policy; the split between burnout-driven experimentation and review-load skepticism remains live. Emacs will keep accepting verified bug leads while individual package reviews decide how much LLM provenance is disqualifying. The common unresolved stake is authority: who decides that a contribution is too tainted, too cheap, or too costly to review, when generation is abundant and attention is not.