Glonce

Essay: AI-generated pull requests are closing open source to outsiders

miscThe Glonce editorsHacker News🔥56Glonce rating56Impact35Novelty45Relevance87Surprise40Players10Credibility70

A developer who made his GitHub account on June 17, 2011 has written a personal essay arguing that open source as he has known it is dying, and that AI is what is killing it. He admits the title is a bit hyperbolic. He is self-taught, says he would not have a career without open source, and uses AI every day to write and review code, so he frames himself as part of the problem rather than an outside critic.\n\nHis argument starts with what open source felt like. In June 2014 he sent his first real PRs to PointDNS's Node.js client: a fix for a crash on chunked responses, then, two hours later, a 'global tidy up' that touched almost every line. A maintainer merged both the next morning, with no back and forth and no bots. A stranger sent about 300 lines of unsolicited changes and was trusted with them. He sees a PR as someone saying 'I cared enough to make it better, and I'm trusting you with my work'. Today, he says, he would assume an agent wrote that second PR and would not blame anyone for closing it. He cites Miguel Grinberg, who maintains Flask-SocketIO: 'Today, an unsolicited PR is a red flag.' And Andreas Kling, on Ladybird's decision to stop accepting public PRs: 'A substantial patch used to imply substantial effort, and that effort was a reasonable proxy for good faith. That assumption no longer holds.' In the author's words, the effort was the signal, and that is what is gone.\n\nHe describes what a popular repo looks like now: within seconds a bot summarises your own change back to you, another posts a preview deployment, another posts a walkthrough with a sequence diagram, and sometimes a fourth replies to the third. The human conversation is buried. Worse are PRs that fix issues that do not exist, rewrites that are confident and wrong, and security reports about hallucinated vulnerabilities. He adds that there are 'apparently' accounts opening dozens of such PRs a day across hundreds of repos to farm green squares for a résumé. He has started muting notifications from repos he used to love following. Even his old PointDNS PR picked up junk comments last November from an account he did not know, and he cannot tell if it was a bot or a person.\n\nHe then lists the doors closing, as he describes them. curl ended its monetary bug bounty after the signal-to-noise ratio collapsed; Daniel Stenberg wrote that the share of real reports had fallen below 5% ('Not even one in twenty was real'). tldraw started automatically closing external PRs. Ghostty tightened its AI policy, with Mitchell Hashimoto writing that low-effort AI contributions had raised the 'bad' count 'by 10x if not more'. Jazzband, home to dozens of Python projects, shut down entirely, blaming a 'slopocalypse' of generated PRs and issues. OpenJDK banned LLM-generated contributions, naming reviewer burden as the first risk. Godot now requires human-authored code and bans autonomous agents. COSMIC requires contributors to confirm their PRs contain no LLM-generated code, comments or descriptions. Codeberg members voted to ban mostly AI-generated projects. Then, on October 1, Sindre Sorhus disabled external PRs across all his repos: 'Due to AI, I have disabled external pull requests on all my repos. Open source, as we have known it, was fun while it lasted.' He added that it has been 15 years for him.\n\nThe latest case, the week the essay was written, was Hono. Yusuke Wada announced that external PRs were disabled on honojs/hono, recalling the PR from @usualoma for RegExpRouter that gave the project a very fast HTTP router, and ending with 'PRs don't work in this era. Contribute in other ways.' The author notes that outsider is still contributing four years later, and reads the move as grief, not hypocrisy.\n\nPlatforms are saying it too. In February GitHub published 'Welcome to the Eternal September of open source', including the line 'The cost to create has dropped but the cost to review has not.' The next day it shipped a setting to turn pull requests off entirely. Since then it has added caps on open PRs per user (AI agents count toward the cap), a way to restrict who can open issues, and a way to archive spammy PRs. Some projects are leaving: Zig moved to Codeberg last year, and more people are running their own Forgejo or Gitea instances. The author says that fractures things further, since each move means another account and another place to look.\n\nHis core point is that the cost of AI did not vanish, it moved. When generating a PR takes ten seconds and reviewing it properly takes thirty minutes (his illustration, not measured data), the work shifts from the person who wants something onto the person who has to say no, usually a stretched volunteer. AI made contributing cheap but did not make maintaining cheaper.\n\nHe does not offer a fix. Banning AI PRs feels right to him for many projects, but it is a blunt tool: it catches someone who used AI for one good test along with someone who pointed an agent at a thousand repos, it relies on honesty or on detection that does not really work, and it nudges toward repos closed by default, where you need to be vouched for. Perhaps, he says, that is where things are heading: smaller trusted circles, source available, contributions by invitation. Maybe that is even fine and he is being nostalgic. But his younger self, nervously sending a stranger 300 lines, would not get through that door.

Key facts

  • The author, a self-taught developer on GitHub since June 17, 2011, argues that open source as he has known it is dying because AI-generated PRs, issues and reports are overwhelming maintainers.
  • He lists projects that have closed or restricted outside contributions: curl (bug bounty ended), tldraw, Ghostty, Jazzband, OpenJDK, Ladybird, Godot, COSMIC, Codeberg, Sindre Sorhus's repos from October 1, and Hono this week.
  • Daniel Stenberg wrote that real reports to curl's bug bounty had fallen below 5%, and Mitchell Hashimoto said low-effort AI contributions raised Ghostty's 'bad' count 'by 10x if not more'.
  • GitHub added a setting to turn PRs off, caps on open PRs per user (AI agents count), issue restrictions and archiving of spammy PRs.
  • The author says AI made contributing cheap but not maintaining, calls bans a blunt tool, and says he does not know the fix.

Why it matters

This is a first-person account of a shift many maintainers describe: the effort behind a pull request used to be a signal of good faith, and AI has removed it. The author's list of closures is broad, from a bug bounty (curl) to a whole collective (Jazzband) to widely used projects (Hono, Sorhus's repos). The thread running through it is that the cost of creating a contribution has collapsed while the cost of reviewing it has not, a point he backs with GitHub's own wording. The essay is opinion and a lament, not a study, but it collects the named decisions in one place.

Who it affects

Maintainers come first: they absorb the review burden and are the ones saying no, often as unpaid volunteers. Newcomers and first-time contributors are next; the author argues someone like his 2014 self would no longer get through the door. Users of the affected projects may see fewer outside fixes. Platforms such as GitHub and Codeberg are affected too, as are projects weighing a move to self-hosted Forgejo or Gitea.

How to use it

The essay is not a how-to, and the author says he is not telling anyone to stop using AI. His practical takeaway is to stop treating the cost of AI as zero: if you generate a PR in ten seconds, someone else pays to review it. Maintainers can look at the GitHub options he lists: turning pull requests off, caps on open PRs per user, restricting who can open issues, and archiving spammy PRs. Hono's maintainer ends his announcement with 'Contribute in other ways.'

How solid is it

It is a personal blog essay, and nearly every claim about the projects is the author's own account of what they did. Named people are quoted directly: Grinberg, Kling, Sorhus and Wada. The under-5% figure and the 10x figure are Stenberg's and Hashimoto's, as reported by the author. The ten seconds versus thirty minutes comparison is explicitly illustrative. The claim about accounts farming green squares is hedged with 'apparently'. No wider data is cited, and the author does not say how many repos in total have closed to outside PRs.

Risks and caveats

The author himself calls the title a bit hyperbolic and says he may be nostalgic for an Internet that was never going to last. He does not blame maintainers, but notes that blanket bans are blunt: they catch careful AI-assisted contributors along with spam, and rely on honesty or on detection that does not really work. Closing doors may push toward repos closed by default, with contributions by invitation, and migration to new hosts fragments projects further. The Sorhus and Wada quotes cite AI and 'this era', so not every closure should be read as a single-cause story.

“Due to AI, I have disabled external pull requests on all my repos. Open source, as we have known it, was fun while it lasted.”

— Sindre Sorhus, as quoted in the essay