Open source maintainers are fighting back against AI slop, one bounty program at a time
In 2026, "AI slop" became Macquarie Dictionary's word of the year — low-quality generative AI content, "often containing errors, and not requested by the user." Open source maintainers didn't need a dictionary to tell them what it meant. They'd been triaging it by the thousand for a year, and the Jazzband collective, a well-known hub of Python packaging projects, shut down entirely in 2026, with its lead maintainer citing the unsustainable volume of AI-generated spam PRs and issues as the deciding factor.
The thesis here isn't that AI tools are bad for code — plenty of legitimate contributions now start with an AI assist. It's that the review economics of open source were built on a specific assumption: that a submitted pull request represents real human time and judgment, which justifies a maintainer spending real time evaluating it. Generative AI broke that assumption at the exact chokepoint — human review capacity — that open source was never able to scale.
What AI slop actually looks like in a PR queue
It's not obviously malicious. Jeffrey Paul, VP of open-source solutions at Fueled, describes it as submissions from people who don't fully understand the problem, the proposed solution, or both — a contributor ran an AI tool, got something that looked plausible, and submitted it without verifying it actually worked. The code often compiles. It sometimes passes tests. It frequently doesn't do what it claims, and figuring that out requires the same depth of review as evaluating a legitimate contribution — the effort isn't reduced, only the submission cost is.
That asymmetry is the entire crisis in one sentence: generating a plausible-looking PR now costs a contributor almost nothing, while verifying it still costs a maintainer the same as it always did.
curl's bounty program: a case study in the numbers
No project has been more publicly transparent about the damage than curl. Founder Daniel Stenberg tracked submission quality through 2025 as AI-generated security reports flooded the project's bug bounty program. By mid-2025, only about 5% of submissions were genuine vulnerabilities — the rest were AI-generated reports that looked structurally correct but described flaws that didn't exist. Stenberg closed the bounty program entirely at the start of 2026. It didn't fully solve the problem — slop submissions still arrive by email and GitHub — but it removed the direct financial incentive that made curl a specific target. Only seven maintainers review curl's security reports, a number that hasn't scaled even as submission volume exploded.
RubyGems is reportedly considering the same move, according to director of open source Marty Haught, after going months without a single valid vulnerability report amid continued submission volume.
The human cost, not just the process cost
Godot game engine maintainer Rémi Verschelde has described triaging AI slop as draining and demoralizing — a distinction worth sitting with. Reviewing a bad-faith or low-effort human contribution is frustrating but legible; you can reason about the contributor's intent. Reviewing AI slop means repeatedly investing real cognitive effort into evaluating something with no intent behind it at all, then discarding it. That's a specific, compounding kind of burnout distinct from ordinary maintainer overload, and it's a documented factor in Jazzband's decision to shut down rather than continue.
What the response actually looks like
WordPress rolled out formal AI contribution guidelines requiring disclosure of AI tool use and defining unacceptable patterns, like large unreviewed code dumps, explicitly to reduce the burden on maintainers evaluating submissions blind. GitHub, facing pressure as the platform hosting most of this traffic, announced a set of maintainer-facing features aimed at giving project owners more control over submission volume and quality gating — the company's own framing called it addressing "the eternal September of open source," a reference to the moment a community's growth outpaces its capacity to acculturate new arrivals.
The pattern across every response — WordPress's disclosure rules, curl's bounty closure, GitHub's tooling — is the same: shift the cost of low-effort submission back onto the person submitting it, because for three years that cost had fallen entirely on the maintainer.
What to actually do about it
If you maintain a project, the curl and WordPress playbooks are copyable now: require AI-use disclosure in your contribution template, and treat a first slop submission as an education opportunity but a second as grounds for a warning or block — most legitimate contributors adjust once told, and the ones who don't were never going to be sustainable contributors anyway. If you're a contributor using AI tools, the discipline that keeps you off a maintainer's slop list is simple and unglamorous: run and verify the code yourself before submitting, and be able to explain in your own words why the fix is correct. That's the exact test AI slop fails, and it's the one thing generative tools still can't do for you.