Open source AI-generated code policy: r/opensource bans AI-made and solo projects, and where Debian, Linux, curl, Gentoo and QEMU draw their lines

Open source AI-generated code policy used to be something each project wrote for its own repository. On October 24, 2026, the moderators of Reddit's r/opensource applied a rule to a whole community instead: "if your project uses AI, is made by AI, or is intended for AI, it's not welcome on r/opensource," plus new requirements that effectively shut out solo and young projects. The move landed in a year of fights over AI coding agents and the maintainers who review their output, from QGIS's vote to ban AI-assisted code on October 7 to the flood of AI-found vulnerabilities that maintainers have to patch. This analysis sets the subreddit's rules beside the documented policies of the major projects, in their own words and with their dates.

This analysis is based on the r/opensource moderators' October 24 announcement, each project's own policy pages (Gentoo, NetBSD, QEMU, Debian, the Linux kernel, curl and Mozilla's Firefox docs), QEMU's patch archive, Debian's vote results, GitHub's changelog and blog, Tom's Hardware's October 26 report, and the Hacker News discussion of the Reddit announcement, checked October 27, 2026.

The short version

• r/opensource: bans AI-made, AI-using and AI-focused projects, and requires promoted projects to have a year of active maintenance, multiple contributors and an OSI-approved license. It's a forum rule about what can be posted, not a rule about code.
• Ban or presumption against AI: Gentoo (since April 14, 2024), NetBSD (2024) and QEMU (since June 2025) still say so in their published rules.
• Allowed, with a human responsible: Debian (vote ended August 28, 2026), the Linux kernel (an Assisted-by: tag, documented since Linux 7.0), curl and Firefox.
• Bug reports are a separate fight: curl requires reporters to disclose AI use and says, "We ban users immediately who submit made up fake reports."
• GitHub's answer is switches, not rules: since February 2026, maintainers can restrict pull requests to collaborators or turn them off, and since June they can cap open PRs from outsiders.

What did r/opensource ban?

The announcement, a pinned moderator post by Wolvereness titled "Your tokens aren't valuable: No more AI," went up on October 24. It opens: "The long story short, if your project uses AI, is made by AI, or is intended for AI, it's not welcome on r/opensource. AI, as it exists today, is incongruent to this Open Source community." It adds: "If it's obvious you're using AI in your project, we don't want it. Tokens are cheap, and we don't care how many you spent to make your amazing project."

The other rules in the post go beyond AI:

• projects advertised in the subreddit must be at least a year old and actively maintained, have multiple contributors ("subjectively 3+"), have an existing community and carry an OSI license, and can't be "intended for AI (such as MCPs)";
• common capstone and school projects, "such as note-taking, PDF viewers, cli music players," are excluded;
• "we can no longer field requests asking for maintainers or people to contribute";
• accounts must be at least a year old "with significant Reddit contributions," a rule the post says isn't new, and users who message the moderators about it after trying to post "will be permanently banned and muted";
• "If you don't speak English, you need to find a different community," because "We cannot distinguish between AI-written and AI-translated."

Officially incorporated nonprofits can be exempted from the project and account minimums if they get approval before their first post.

The backlash centered on the solo-project and language rules. Tom's Hardware, in an October 26 report by Newton Gitonga, quoted a developer whose nine-year-old project, with more than 300 GitHub stars and one contributor, risked exclusion "despite having no AI involvement." When users asked whether even the Linux kernel would pass, Wolvereness said it would meet the minimums and suggested that judging whether a project is obviously AI-generated would be subjective, Tom's Hardware reported. The moderators later edited the announcement to point affected users to a new subreddit, r/TrueOpenSource, according to the same report. On Hacker News, where a link to the announcement was posted on October 25 and had drawn more than 120 comments by October 27, commenters split between calling it "a typical Reddit moderation power trip" and agreeing that LLMs "caused an explosion" of low-effort project posts in software subreddits.

Tom's Hardware also reported that r/programming restricted most AI and LLM content in May 2026. Neither forum rule changes what any open-source project accepts as code.

What do major open-source projects' AI policies say?

Most large projects don't ban AI. They require a human to take responsibility for what's submitted, and some ask for disclosure. A minority still reject AI-generated code outright, mainly over copyright.

Last verified: October 27, 2026

Why did Debian decide not to ban AI?

Debian's developers had the full range of options in front of them. The ballot for the 2026 general resolution, "LLM usage in Debian," had nine choices, from "Ban LLM contributions from Debian via Social Contract" and "Debian is created by humans" to "Accept AI contributions for Debian specific work." Voting ran from August 15 to August 28, 2026.

The winner was Option 5, "Responsible Use of Generative AI," proposed by Marc Haber. It beat every other option head to head, including "None of the above" by 281 votes to 126. The ban options failed: Option 1, which needed a 3:1 supermajority to change the Social Contract, got a ratio of 0.560. The adopted text says the use of an AI tool "does not diminish the contributor's responsibility for the work they submit," and that "blindly accepting or uploading AI-generated material without appropriate human review is inconsistent" with that responsibility. It encourages, but doesn't require, disclosure.

The result puts Debian where the kernel, curl and Firefox already were.

How does the Linux kernel handle AI-assisted patches?

Through credit and accountability. The kernel's "AI Coding Assistants" guide says only humans can certify the Developer Certificate of Origin, so "AI agents MUST NOT add Signed-off-by tags." The human submitter reviews all AI-generated code, adds their own sign-off and takes "full responsibility for the contribution." Tools are credited in an Assisted-by: line; basic tools such as git, gcc and editors aren't listed. It's FOSS reported on April 13, 2026 that the guide arrived with Linux 7.0 and credited kernel developer Sasha Levin with writing it.

A companion page on tool-generated content starts from the same worry as projects that ban AI: "reviewer and maintainer bandwidth is a scarce resource." It asks contributors to "be transparent about the origin of content in cover letters and changelogs," and it leaves room for maintainers to say no: "maintainers are entitled to reject your series without detailed review." The kernel's security rules add that anyone who used AI to find a bug "must treat it as public," as our story on kernel bug reports posted to a public list explains.

What is curl's AI-slop bug-report policy?

curl's rules target reports more than code. Its contribution guide says anyone who asked an AI tool to find problems "must make sure to reveal this fact in your report," should verify findings before reporting, and shouldn't paste AI-generated reports. The sanction is blunt: "We ban users immediately who submit made up fake reports to the project." Its vulnerability disclosure policy adds: "Do not lazily paste massive, AI-generated explanations," and states that "There is no bug bounty." curl ended its HackerOne bounty on January 31, 2026, after a flood of AI-generated reports, BleepingComputer reported at the time.

For code, curl is permissive. AI-assisted pull requests are accepted if they meet the usual standards, with a rule of thumb: "if someone can spot that the contribution was made with the help of AI, you have more work to do." The same report-quality pressure now runs through security work generally, as our PHP2Shell coverage shows.

Which projects still ban AI-generated code, and why?

Gentoo, NetBSD and QEMU, and their stated reason is legal more than practical. QEMU's policy patches, written by Daniel P. Berrangé and revised by Markus Armbruster, argue that contributors can't truthfully certify the Developer Certificate of Origin for AI output whose copyright and license status is unclear; maintainer Stefan Hajnoczi applied them on June 24, 2025. The policy page says it "may evolve as AI tools mature and the legal situation is clarified," but as of October 27 it lists no approved exceptions. Gentoo's council rule cites copyright, ethics and quality, and NetBSD treats LLM output like code of unknown origin.

QGIS joined the list on October 7, 2026, when its developers merged QEP 428, as our QGIS analysis details. When checked on October 27, the policy file on the QGIS proposals repository's main branch carried the ban as version 2.0 of the policy: "No LLM, AI or agent assisted code contributions are allowed" in the main QGIS repository.

What has GitHub done about AI-generated pull requests?

GitHub hasn't set a content policy; it has given maintainers controls. In a February 12, 2026 post, GitHub's Ashley Wolf wrote that generative AI "makes it easy for people to produce code, issues, or security reports at scale" and that "The cost to create has dropped but the cost to review has not." The next day GitHub's changelog added repository settings to turn pull requests off entirely or restrict new ones to collaborators. On June 17, 2026, it added a cap on how many open pull requests users without write access can have in a repository. Neither changelog entry mentions AI, and neither tells a project what to accept.

What does this mean for contributors?

• Read the project's file, not the forum. A subreddit ban says nothing about whether a patch is welcome. The same AI-assisted fix could go in with an Assisted-by: tag in the kernel, be accepted at Debian or Firefox with full personal responsibility, and be declined at QEMU or Gentoo.
• Disclosure is the common denominator. Even the permissive policies expect you to say when AI was involved, and curl requires it for bug reports.
• Responsibility doesn't transfer. Every allowing policy says the human submitter owns the result. That puts the argument in the "is AI a tool?" debate into project rules: the tool doesn't sign off, you do.

What's confirmed, reported and uncertain

• Confirmed (primary documents): the r/opensource announcement's October 24 date and rules as first posted; the Gentoo, NetBSD, QEMU, QGIS, Linux kernel, curl and Firefox policy text as published on October 27, 2026; QEMU's June 24, 2025 application; Debian's ballot, dates, result and winning text; GitHub's February 13 and June 17, 2026 settings.
• Reported:
  • the developer complaints, Wolvereness's comments on the Linux kernel and the later edit pointing to r/TrueOpenSource (Tom's Hardware, October 26, 2026);
  • r/programming's May restriction (Tom's Hardware);
  • the kernel guide's arrival with Linux 7.0 (It's FOSS, April 13, 2026);
  • NetBSD's 2024 adoption and the end of curl's bounty (earlier 9to5AI reporting citing OSnews and BleepingComputer).
• Uncertain:
  • whether the moderators have changed the rules since the edit Tom's Hardware reported, and how strictly they'll be enforced;
  • when Mozilla's Firefox AI coding policy and curl's current AI section were first published.