When the contributor is a model

Open source did not schedule a referendum on artificial intelligence. It got one anyway, in the form of patches, proofs, Internet-Drafts, and package proposals that force the same uncomfortable questions in different rooms: who is accountable when a machine drafts the work, what must be disclosed, and whether existing norms of review and responsibility still hold when the cheapest participant never sleeps.

The argument is not whether models can produce plausible text or code. That question is settled in practice. It is whether communities built on human judgment can absorb machine participation without new rules, or whether pretending nothing has changed is itself a policy choice with costs.

At the IETF, Stephen Farrell and Chong Feng circulated a rough individual draft aimed at progressing discussion of how the community might handle LLM-generated text in standards work. Farrell asked for broad comment rather than another round of process dispatch. The thread quickly became a fight over what “responsibility” means when the tool can author entire messages.

Brian E. Carpenter took the classic engineering stance: the person sending the message is fully responsible, and the preparation aids are beside the point. “Whether they used a slide rule, a pocket calculator, a dictionary, a spell checker, a search engine, or an AI tool, to prepare the message is irrelevant,” he wrote. Jay Daley, the IETF’s executive director, rejected the analogy. The key difference, he argued, is that older tools do not write the email “in their own words not yours.” Accepting responsibility, in Daley’s reading, risks becoming a ritual: “I commit to sending any replies to my AI so that it can write a response for me” rather than understanding the substance. Laurence Lundblade allowed that personal responsibility “may not be the full solution” given the many-readers-for-one-writer asymmetry Farrell had highlighted. Phillip Hallam-Baker saw little problem with AI-written drafts if interoperability could be shown; John Levine answered that some AI code is fine and some is “an unmaintainable tangle of garbage,” returning again to submitter responsibility “no matter how he, she, or it, wrote it.” Brian Campbell added the operational fear already visible on some lists: robotic floods of plausible mail will demand a technical response, not a philosophical one.

The standards debate is about discourse integrity. Elsewhere the same technology is arriving as auditor and author of artifacts that ships can depend on.

On the IRTF’s usable formal methods list, Nadim Kobeissi reported finding “many critical soundness bugs in Tamarin using an LLM,” with artifacts and a forthcoming paper, after related discussion of LLM-generated Collatz proofs that had exploited prover bugs in Lean-family systems. Felix Linker, for the Tamarin maintainers, thanked him and confirmed fixes for some of the theories, while disputing others and the severity framing. For cases involving an internal-only keyword that had not been blocked everywhere, Linker wrote it was “debatable whether this is a soundness bug as no proof rule was changed.” Kobeissi pushed back hard: changes had touched soundness-related checking, and “this is undeniably and objectively a soundness issue.” Linker later said the extra check was “just defensive programming,” adding, “You can call the bug a soundness issue, if you like. I haven't made up my mind and don't plan to.” Kobeissi’s closing point was practical rather than taxonomic: someone must decide, because release notes and user re-validation of models that used the affected construction depend on that label. Machine-assisted discovery here did not invent the maintenance dilemma; it compressed the time between claim, patch, and public argument over what the patch means.

Security projects are adjusting process under similar pressure. Announcing OpenSSH 10.5, Damien Miller wrote that the team had received “a large number of security bug reports, many of which are findings from AI models or made with AI assistance.” Many lack impact under a realistic threat model, yet the project “very much welcome[s] these reports,” especially with human triage, tests, and fixes. Critically, bugs first flagged with AI help have been independently rediscovered by other researchers, which Miller read as evidence that non-reporting adversaries can find them too. The operational response is not a ban and not a special AI queue: more frequent releases so fixes reach users faster instead of waiting for the next planned batch. CVEs in the release covered agent locking interactions with session binding, a client realloc use-after-free around multiplexed remote forwarding, and authorized_keys restrict handling for tunnel forwarding. The policy shift is the story. Disclosure volume and parallel discovery are changing release cadence.

In the kernel, machine authorship is no longer hypothetical cover letters. Jason Gunthorpe posted a fourth-round series adding mlx5 support to the VFIO selftest framework, describing it as largely a remix of existing mlx5 VFIO work with an RDMA loopback path for DMA-style copies and MSI delivery via completion events. “This entire series was coded by Claude Code in about 4 days,” he wrote, after heavy human cleanup of “slop,” versus the month or two prior VFIO drivers often took. Review did not waive standards because of the origin story. David Matlack reported clang builds failing on GNU flexible-member warnings once kernel interface headers were pulled in, IGB selftest failures when a new region_size field was not page-aligned for IOMMU map and unmap, and other integration mismatches. Gunthorpe fixed and explained build-flag expectations; some of the scaffolding, he noted, he had not used the model for. The series carries explicit assisted-by attribution. The debate on the list is less “may AI touch the tree” than whether human maintainers can still see every assumption a fast generator papered over.

Freedom-oriented packaging surfaces a different axis: defaults and dependency on services. Thanos Apollo proposed hermes for NonGNU ELPA, an Emacs frontend to a Hermes agent with dashboards, streamed diffs, approval prompts, and session tools for local or remote agents. Jean Louis framed objections in classic SaaSS terms, pointing at choice architecture and “Who does that server really serve?” Richard Stallman listed conditions rather than a blanket veto. Hermes needs an LLM at runtime; if free local models exist, the package might be recommendable only with them, and “should not have anything in it that leads people to” SaaSS or nonfree stacks. If none qualify, Hermes should not be recommended either. He also pressed for concrete description of actions, asking whether steps would usually be Emacs Lisp calls. Apollo answered that hermes.el neither recommends nor defaults to a provider, speaking only to a user-configured agent, and that the agent’s file and shell tools run independently of Emacs; the package is supervision UI. The unresolved GNU-shaped question is whether an agnostic client is neutral infrastructure or a on-ramp whose silence about backends still steers users.

Thread the cases together and a single conflict sharpens. One camp treats models as powerful assistants under unchanged human accountability: Carpenter’s full responsibility for the sent message, Levine’s submitter ownership of drafts, Miller’s welcome for triaged AI-assisted reports, Gunthorpe’s signed series after de-slopping, Linker’s willingness to fix inputs without litigating the word “soundness.” Another camp argues that scale and fluency break the old analogies: Daley on emails written in the tool’s words, Farrell’s push for explicit community handling, Kobeissi’s insistence that soundness labels drive user action, Stallman’s refusal to bless tooling that normalizes nonfree or service-side models, and the shared fear of plausible floods that outrun scarce reviewer attention.

What remains open is not whether machines will keep showing up as co-authors, bug finders, and agent frontends. They will. Unresolved is whether projects need shared disclosure norms for generated standards text and code, how to classify and communicate machine-found flaws in trust anchors like provers, how fast “welcome the signal, ship sooner” can scale before triage collapses, and whether free-software distribution can draw a stable line between user-configured agents and recommended intelligence services. For now each community is improvising in public, with the same tool playing different roles and no consensus rulebook in sight.