When machines join the queue: IETF, QEMU, and Emacs argue over AI participation

The flood is no longer theoretical. Standards authors, hypervisor maintainers, and free-software package curators are facing the same practical question at once: how much machine participation a volunteer community can absorb before review, trust, and openness break. The answers differ in form (detectors and bonds at the IETF, AGENTS.md rules at QEMU, packaging philosophy at Emacs) but the through-line is identical. Cheap generation has shifted cost onto human attention, and projects are discovering that neither a pure ban nor a pure free-for-all holds.

At the IETF, independent Internet-Draft submissions have spiked in a way that looks, to long-time participants, less like community growth and more like inbox DDoS. Ross Finlayson put the mood bluntly: "Folks, this is getting out of hand." His half-serious bond proposal (a refundable fee for independent drafts, returned only if a working group adopts them) was framed as contrary to IETF ethos, yet the spam analogy stuck. "We need to start thinking of this as a problem akin to spam, and start treating it accordingly," he wrote, also floating split announce lists so people could unsubscribe from independent noise.

Lars Eggert refused the fantasy of putting the genie back. "I believe the issue of fully or partially AI-generated IETF contributions is here to stay," he argued, adding that tooling and submission restrictions are stopgaps. AI can accelerate standards work "if used responsibly and correctly," but the real problem is quality and review load: "This is pretty much the exact problem we have in open source, where PRs are now cheap to generate and the cost is shifting to core review, which is not (yet?) similarly cheaply done." His personal adaptation is revealing of the social risk. He expects to "be quicker to ignore or disregard new contributions from folks I have not had a history with" unless a known participant engages. Carsten Bormann answered the downside of that reflex: genuine newcomers get lost in "AI slop," and the IETF becomes less open, not more. His proposed fix is automated attention management: documents receiving multi-level commendations, viewer-private weight scores for "commenders" based on past authorship and leadership, and searchable document weights that stay subjective rather than turning into a public reputation system.

Others reach for technical filters and social gates. Theodore Tso pointed at watermarking already shipping in major models (Google SynthID, forthcoming Claude tooling) as something the IETF could add to its toolbox, while noting open-weight models remain a gap. Andrew Yourtchenko, after scripting author histories with "my friend Claude," observed that almost all adopted drafts already come from people previously on RFCs or WG drafts. That led him toward a web-of-trust shape for -00 rate limits: one free hanging draft per account, then a shepherd from the existing community. S. Moonesamy separately noted AI-generated traffic even inside working-group lists, and drafts that exist mainly because the barrier to writing fell. Carlos Martinez-Cagnazzo closed a loop many open-source projects are circling: fight slop with better-tuned AI scoring of submissions, and let humans decide.

QEMU hit the same wall from the opposite direction. For a time the project held a blanket ban on AI-generated contributions. Paolo Bonzini has now proposed what he calls, without euphemism, "a full U-turn," not because prior arguments were wrong but because the ban became a "unanimity trap." Small carve-outs died under individual objections; the only stable equilibrium was absolute prohibition. Yet the policy was not actually stopping AI patches. "Don't ask, don't tell" approaches, he warned, are a red flag. His reframing attacks maintainer burnout rather than copyright or DCO theology: treat the no-AI rule as stable but not good, perturb it hard, and see what discussion follows. The concrete vehicle is an AGENTS.md (plus tool-specific stubs) that tells coding agents the participation rules, insists the human remain part of the design process, and steers large generated work toward pre-arrangement with maintainers.

Pushback inside QEMU is not about nostalgia for the ban so much as about where the scarce resource sits. Peter Maydell argued the project is not short of code-writing speed; it is short of review, and already drowning in automated bug finding and unmaintained old code. Allowing more generated code "feels bad" because it increases reviewer load. He asked at least for a minimal AGENTS.md that encodes the current policy so unaware agents stop proposing non-compliant patches. Alistair Francis and others countered that absolute bans train people to hide use: "a blanket ban just leads people to ignore the ban and use AI anyway and lie about it." Declared, limited use with pre-arrangement for large series may produce more honest disclosure. Daniel P. Berrangé framed missing agent documentation itself as the failure mode: a policy buried in human-facing docs never reached the tools people actually run. Across the thread, Conservancy-style advice not to shun either camp, and Rust-like cautious experimentation, sit uneasily beside the recognition that enforcement of any middle path is still soft and trust-based.

Emacs is fighting a third face of the same conflict: not draft spam or patch provenance, but whether packaging an LLM agent front end belongs in NonGNU ELPA at all. Thanos Apollo offered hermes, an Emacs interface to Hermes Agent with dashboards, streamed chat, approval prompts, session control, and support for local and remote agent instances. The philosophical collision was immediate. Richard Stallman insisted that recommendations steer: anything that suggests a site or program "might influence users to use it" and therefore engages GNU responsibility around nonfree software and SaaSS. "Our actions must be coherent with our philosophy." Eli Zaretskii drew a sharper operational line. Hermes, in his reading, allows user-configured connections the way EWW allows visiting non-free sites; that is not the same as steering or recommending them. "We don't suggest any non-free site or program, not in this case anyway." The packaging fight thus becomes a fight over free-software norms under LLM-shaped architecture: is an agent client a neutral tool, or a vector that normalizes remote, opaque model services?

Taken together, the three threads are one argument with local dialects. Detection (watermarks, AI scores), rate limits and webs of trust, documentation aimed at agents themselves, and outright refusal all appear as partial answers to the same scarcity: human review time and the credibility of open processes. Eggert’s parallel to open-source pull requests, Bonzini’s burnout-first U-turn, and Stallman’s coherence demand all assume that machine text will keep arriving. What remains unresolved is who bears the new cost, how newcomers prove they are not noise, and whether free-software distribution channels can host LLM clients without laundering SaaSS. No community has a settled equilibrium yet; each is still choosing which failure mode it fears more: capture by slop, or a closed circle that only trusts people it already knows.