Established in 2021, LF Research regularly publishes studies exploring the dynamics of how open-source projects are built, maintained, and consumed, utilizing extensive surveys and project telemetry. This latest investigation, sponsored by Red Hat with additional contributions from OpenSSF, LF AI & Data, and Futurewei, captures a critical turning point for the developer community as automated tools make it easier than ever to generate and submit code.
However, this democratization of code creation has introduced a significant downside: a flood of low-quality submissions. According to the report’s findings, respondents estimate that roughly 25% of incoming pull requests across open-source repositories consist of low-quality AI-generated code, often referred to colloquially as "AI slop." For larger, high-visibility projects, that estimated figure climbs even higher, reaching 31%.
The findings indicate that large projects—defined in the study as those with more than 50 active contributors—are bearing the brunt of this shift. Among maintainers of these larger repositories, 69% report a noticeable increase in incoming contributions, compared to 59% across all surveyed maintainers. Furthermore, 64% of large-project maintainers note that code reviews now take significantly longer to complete. Perhaps most concerningly, burnout has emerged as the top concern for maintainers of large projects at 63%, narrowly edging out contribution quality, which was cited by 60% of respondents as a primary worry.
Compounding these operational pressures is a distinct lag in project governance and policy. Many open-source communities have yet to establish formal frameworks to handle AI-assisted coding and the associated security vulnerability reporting trends. Out of the 119 respondents who answered specific questions regarding project policies, only 35% stated that their project has a formal policy explicitly permitting the use of AI tools. Meanwhile, 32% reported having no policy and no plans to create one, 23% indicated that they plan to draft a policy in the future, and 10% have chosen to ban AI-generated contributions outright.
These mixed stances reflect a broader, fractured approach across the ecosystem. While some notable projects, such as LLVM, have implemented nuanced guidelines that allow AI-generated code under specific conditions, a staggering 26% of projects surveyed have no mechanism whatsoever to verify whether incoming contributions were assisted by artificial intelligence. In response to these vulnerabilities, the report calls on the broader contributor community to invest greater effort in establishing clear written policies, ensuring transparent disclosure of AI usage, and strengthening testing and documentation protocols.
Despite the administrative and review overhead, the report acknowledges that generative AI does offer genuine productivity benefits for individual developers. Survey respondents estimated that code authoring takes 52% less time on average when leveraging AI tools. At the same time, however, complex tasks present a different picture; 21% of respondents noted that more intricate programming challenges actually took longer to complete when AI was involved, pointing to the limitations of automated generation when dealing with sophisticated system architecture.
Views on community health and inclusivity are similarly mixed. A strong majority of maintainers—71%—agree that generative AI makes it easier for newcomers and less-experienced developers to take their first steps toward contributing to open-source projects. Yet, this influx of new participants has not translated into broader trust. Just over half of the respondents, 53%, stated that AI has not improved community trust, while a mere 13% believe it has enhanced trust within their projects.
The report also outlines important methodological caveats regarding its conclusions. Respondents were primarily recruited through Linux Foundation newsletters and social media channels, alongside partner channels including Red Hat. Furthermore, the widely cited figure that 25% of pull requests consist of AI slop represents an aggregate estimate provided by 111 respondents rather than a precise, measured count across the entire open-source ecosystem.
Because formal disclosure policies remain scarce and a quarter of projects lack verification tools, catching and filtering out low-quality AI output heavily relies on voluntary disclosure by contributors. As past incidents in the open-source community have demonstrated, the individuals submitting automated, unverified code are rarely the ones who bother to check its quality or origin, leaving maintainers to shoulder the burden of quality control in an increasingly automated world.
Leave a Reply