Please stop flooding our projects with AI slop to furnish your CV

30 June 2026 by Neil

Successful contributions to unfastened root projects are a benignant of currency. GitHub successful peculiar encourages this successful a number of ways: by showing avatars of contributors connected repository pages, by showing your contributions to your followers via the activity provender and by signalling contributions per time connected the activity chart of your profile. Potential hiring managers often return statement of this. Recruiters often find and surface candidates this way. If you are a package developer (either existing aliases aspiring) looking for work, tuning these signals tin often activity to your advantage.

As an unfastened root maintainer, it’s rather noticeable really the shape of outer contributions has changed successful the past year. We’re acold much apt to person propulsion requests alternatively of issues. If we do person issues, they often travel pinch an AI-generated study attached. We’re receiving acold much information vulnerability reports than ever earlier and often they moreover travel pinch AI-generated hole proposals attached too.

I don’t uncertainty that immoderate of these contributions are from group who are genuinely willing successful what we do, but the cynical portion of maine believes that a important magnitude of this is that group are realising that AI tin beryllium utilized to crippled GitHub to their ain benefit. It’s now easy to inquire Claude to make a database of absorbing unfastened root projects, past inquire Claude to find immoderate problems successful them, and past inquire Claude to raise immoderate PRs to hole them. You don’t moreover person to usage the projects aliases attraction astir them, but you tin easy create the illusion to outsiders that you care, aliases that you recovered a problem, aliases that you put the clip into fixing it. On the internet, cipher knows you’re a dog, but pinch the thief of LLMs, you tin effortlessly overstate your quality abilities connected your GitHub profile.

Recently, a contributor pinch virtually nary GitHub-wide contributions from precocious 2018 up until a mates weeks ago, pinch nary anterior engagement pinch our task that we cognize of, raised 3 abstracted PRs to correct pronunciation and grammar mistakes successful comments. Claude made the fixes, presumably wrote the PR descriptions, moreover signed disconnected the commits connected behalf of the personification and past helpfully inserted its co-authorship into the perpetrate connection trailers. Maybe it moreover opened the PRs itself, who knows. I’d beryllium fascinated to cognize whether the punctual was to “go and find issues” aliases whether to attraction connected pronunciation and grammar issues successful peculiar for immoderate reason.

The changes were harmless and correct, but that did not make maine consciousness amended astir accepting aliases merging them. Instead I couldn’t thief but inquire myself: why this, why now? Why, retired of each of the issues and TODOs and FIXMEs successful our codebase are they submitting this? And past it dawned connected maine that these contributions weren’t astir our task astatine all.

I closed each 3 PRs without comment.

Maybe this was unreasonable, but truthfully, I’m conscionable not willing successful encouraging group to return up our clip pinch this benignant of busywork. I do not want to group a precedent of accepting PRs that materially amended nothing, nor do I want our contributor database to go a reward for asking a robot to hole typos.

The aforesaid shape has emerged pinch information vulnerability reports. CVEs traditionally are credited to their reporters, but each of the reports that we person received precocious person been evidently AI-generated. Security fixes are ever important of course, but again I find myself wondering if this is happening because group attraction astir the fixes aliases because they are looking for an easy credit. We person been acold much selective lately erstwhile evaluating the severity of specified reports and, successful immoderate cases, declining to rumor CVE notices for low-severity items. I person immoderate feelings astir the truth that backstage disclosure is dying anyway, which I whitethorn constitute astir different time, but the effort progressive successful coordinating backstage fixes and disclosure notices and releases is important capable to require america to beryllium selective.

Ultimately, unfastened root is built connected trust. The metric that matters is not really galore propulsion requests you tin seduce an LLM to produce, nor really galore CVEs you tin accumulate, but whether you tin make a task meaningfully better. If you want to lend to unfastened root projects, lend because you care. If each you want is different greenish quadrate aliases different contributor badge, please spell elsewhere.