Open source maintainers across multiple major repositories have issued public warnings about a. Surge in low-quality, AI-generated pull requests, code patches. And documentation contributions they say are flooding their issue trackers and wasting thousands. Of hours of volunteer time. According to posts on GitHub, the Linux kernel mailing list. And several popular npm and PyPI projects, contributors are increasingly using large language. Models to mass-generate submissions. That look plausible on the surface but contain fabricated fixes, hallucinated APIs, and plagiarized code snippets. This guide covers Please stop flooding our projects with AI slop to furnish. Your CV in detail. This guide covers Please stop flooding our projects with AI slop to furnish. Your CV in detail.
The frustration boiled over in a widely shared blog post titled "Please stop. Flooding our projects with AI slop to. Furnish your CV," published by veteran open source maintainers earlier this month. The post, which circulated through Hacker News and developer communities, argued that contributors are using generative AI tools to mass-produce patches, typo fixes, and minor dependency bumps, then listing these contributions on résumés and LinkedIn profiles as evidence of "open source experience." The maintainers wrote that such submissions consume disproportionate review time and erode. Trust in good-faith contributors.
Please stop flooding our projects with AI slop to furnish your CV: How. Bad Is the AI Slop Problem in Open Source?
Quantitative data on the trend remains limited, but maintainers report measurable increases. According to the Node.js project triage logs reviewed by multiple outlets, roughly 20% of new pull. Requests in late 2025 were flagged as low-quality or AI-assisted spam. The Python Package Index (PyPI) announced in October 2025. That it had removed thousands of auto-generated packages. That uploaded empty or hallucinated code, a process it now automates through the. New malware-detection tool acquired from the package security firm Snyk.
Senior maintainers describe identical patterns. Linux kernel contributor Greg Kroah-Hartman, who maintains the stable branch and the USB. Subsystem, posted on the Linux Kernel Mailing List (LKML) in November 2025. That he had personally rejected hundreds of patches generated by automated tools. That did not compile or referenced non-existent kernel functions. "I don't have time to babysit your chatbot," he wrote in a message archived at lkml.org. "If a patch is obviously machine-generated, it goes in the bin."
Why Maintainers Say This Matters Beyond Their Repositories
Open source software underpins an estimated 70% to 90% of modern applications, according. To repeated analyses by Synopsys in its. Annual Open Source Security and Risk Analysis report. When maintainer burnout accelerates, downstream companies face real security and stability risks. Because critical projects receive fewer updates, slower vulnerability patches, and less attentive code review. The XZ Utils backdoor attempt of 2024, traced to a single maintainer working. Under social engineering pressure, demonstrated how thin. Staffing in foundational libraries can become an attack surface.
--trust-me--
The volunteer nature of most open source work makes it especially vulnerable. Projects like curl, maintained primarily by Daniel Stenberg. And ImageMagick rely on a handful of dedicated contributors reviewing thousands of submissions. Adding AI-generated noise to that queue effectively reduces the signal-to-noise ratio for everyone. Including legitimate newcomers trying to make their first contribution. Stenberg has publicly asked contributors to "thin Whether you are new to Please stop flooding our projects with AI slop to furnish your CV or already experienced, the sections below have you covered.k before you submit" and warned that automated tools cannot replace understanding the codebase.
What This Means for Companies and Developers
For engineering managers, the practical takeaway is clear: counting GitHub contributions as a. Hiring signal without verifying their substance is now demonstrably unreliable. Résumé screening processes that treat raw contribution counts or green-square density as evidence. Of skill will increasingly filter in candidates. Who have outsourced their thinking to a chatbot. Hiring teams should instead review specific pull requests, ask candidates to walk through their reasoning. And weight depth over volume.
For contributors, the advice from seasoned maintainers is consistent: read the project's contribution. Guidelines, understand the existing code, run the test suite yourself. And submit changes you can defend in a code review. AI assistants can be useful for understanding unfamiliar APIs or drafting boilerplate. But the human contributor must own the correctness of the result. According to a November 2025 statement from the Open Source Initiative, "AI tools are acceptable aids, not acceptable authors."
What's Next for Open Source Triage Tools
Expect repository platforms to add more automated defenses. GitHub has already experimented with AI-based duplicate detection, and several community projects have released bots. That flag suspicious commits by measuring textual similarity to known LLM outputs. SPDX-style metadata proposals are also circulating in the TODO Group, a consortium of. Open source program offices, to label commits. As AI-assisted or human-authored, though no standard has shipped. Whatever the tooling, the underlying message from maintainers is unchanged: respect the work, understand the code. And stop treating open source as a free résumé-padding service.
Key Points
Maintainers report a sharp rise in low-quality, AI-generated pull requests and dependency updates. Across major open source projects.
Greg Kroah-Hartman publicly rejected hundreds of machine-generated kernel patches on the LKML in November 2025.
PyPI removed thousands of auto-generated packages using new malware-detection tooling in late 2025.
Open source code underpins an estimated 70% to 90% of modern applications, per Synopsys analyses.
Hiring teams are being urged to verify the substance of candidate contributions rather than count them.
The Bottom Line
Open source runs on trust and attention, and AI slop is draining both. The projects that keep the internet running deserve contributions from people who actually. Understand what they are submitting.
Related Resources
For more context, check our related article on TikTok to Pay Record $400 Million in Landmark Child Privacy Settlement with DOJ, related article on Apple Calendar Gets an AI-Powered Overhaul in iOS 27 with. Smart Event Details and Enhanced Siri Integration, related article on OpenAI Unveils 'Private Safety Processing' to Bolster Enterprise AI Privacy. Amidst Rivalry with Anthropic.
