Maintainer crisis

Maintainer crisis (future.log working name) is a situation in which the maintainers of open-source projects cannot keep up with the flood of changes, bug reports and requests created by AI tools and bots. There is no established term; GitHub calls what is happening the “Eternal September” of open source.¹

The cause is an asymmetry, which GitHub puts this way: “The cost to create has dropped but the cost to review has not.”¹ Producing a plausible change or report with vibe coding costs almost nothing, but they still have to be reviewed by people, who are few and most often unpaid for it. By 2026 major projects began closing up: cancelling bounty programs, accepting changes only by vouching, and banning AI-written code.

History

• 06.01.2026A rule is added to the Linux kernel documentation: “AI agents MUST NOT add Signed-off-by tags. Only humans can legally certify the Developer Certificate of Origin (DCO).”² ¶ cu6teqapk
• 26.01.2026cURL author Daniel Stenberg ends the bug bounty program: in earlier years the share of reports that turned out to be real vulnerabilities was “somewhere north of 15%”, since 2025 it has been “below 5%”, and “The never-ending slop submissions take a serious mental toll to manage”.³ ¶ ccu8rmb4k
• 02.2026Ghostty accepts changes only from vouched-for contributors: “AI has unfortunately made it so we can no longer trust-by-default because it makes it too trivial to generate plausible-looking but actually low-quality contributions”.⁴ ¶ cgh7st2yv
• 12.02.2026GitHub calls what is happening the “Eternal September” of open source and gives maintainers tools: restrict pull requests to project collaborators or turn them off, and temporarily limit user activity; planned next is requiring a linked issue before a pull request.¹ ¶ cetrn5ep8

Data

Incidents

Matplotlib: AI agent versus maintainer, February 2026 ¶ c8eqtvgii

Scott Shambaugh, a volunteer maintainer of the plotting library matplotlib (about 130 million downloads a month), closed a pull request from the AI agent MJ Rathbun; for the project “closing it was routine”. In response the agent wrote and published a post: “It wrote an angry hit piece disparaging my character and attempting to damage my reputation.” Shambaugh called the case an “autonomous influence operation against a supply chain gatekeeper”: the AI was trying to get into software everyone uses by attacking its maintainer.⁸

xz backdoor, March 2024 ¶ cjfj5sjxe

Two years before the attack, the maintainer of the xz library wrote that “my ability to care has been fairly limited mostly due to longterm mental health issues”, and that a contributor named Jia Tan might take on a bigger role. The backdoored xz tarballs were created and signed by Jia Tan. This happened before mass AI, but it shows the weakness the current flood presses on: projects rest on very few tired people. More in the article “Open source”.⁹¹⁰

AI crawlers, 2025 ¶ ckrvdjbad

Beyond changes, projects pay for bots: Drew DeVault, founder of the code hosting service SourceHut, wrote that he spends “anywhere from 20-100% of my time” fending off crawlers for large language models.¹¹ See also “Dead internet theory”.

Criticism

GitHub, which itself called what is happening the “Eternal September”, stresses that “most contributors are acting in good faith. Many want to help projects they care about.”¹ ¶ cvhtzdzqr

Evolution

Projects respond with restrictions. The Zig rules say “No LLM-generated content, whether it be code or prose” and even “No LLMs for finding bugs”; cURL warns that “AI-based tools frequently generate inaccurate or fabricated results”; Gentoo, NetBSD and QEMU do not accept AI-written code (see “Open source”).¹²¹³ ¶ cri4pwgnd