From blanket bans to AGENTS.md: open source tries to govern AI code

Blanket bans on AI-generated contributions are collapsing under their own weight. Maintainers who once treated large language models as out of bounds now confront usable multi-thousand-line series, agent configuration files that can instruct tools before a human reads the docs, and review automation that can be steered by untrusted input. The common thread is not enthusiasm for generative tooling. It is the discovery that "no AI" was stable mainly because it was simple, not because it matched how people already work.

That tension showed up sharply when Jason Gunthorpe posted a VFIO selftest driver series for mlx5 support. The work remixes the existing VFIO mlx5 path from rdma-core into the kernel selftest harness: an RDMA loopback queue pair issues RDMA WRITE operations that act as DMA memory copies, with send_msi wired through completion events. Device bring-up dominates the code; the data path is comparatively small. Gunthorpe was explicit about provenance. "This entire series was coded by Claude Code in about 4 days," he wrote, citing millions of output tokens, dozens of sessions, and thousands of lines of AI-generated notes. "I spent an annoying amount of time de-slopping and cleaning its work product to make it presentable." Prior VFIO drivers, he noted, had taken on the order of one to two months; a week to a presentable series was "pretty remarkable." Patches carried Assisted-by tags for the model and drew review attention on interface cleanup, macro extraction so selftests need not pull full RDMA headers, and DMA barrier helpers in tools headers. The technical bar remained ordinary kernel review. The social signal was not: a senior developer had treated an agent as a high-throughput junior and then owned the cleanup.

QEMU is trying to turn that kind of reality into policy. Paolo Bonzini floated an RFC that he labeled a deliberate reversal of the project's prior refusal of AI-generated content. Earlier attempts at narrow carve-outs for tests or comments had failed; each exception produced disagreement, and the only equilibrium left was a total ban. "Previous discussion have come to be a unanimity trap," he wrote. Contributors were already posting AI-assisted work, often in good faith, while "don't ask, don't tell" sat as a red flag. His proposed frame attacked maintainer burnout rather than copyright and DCO first principles: treat the no-AI rule as "an equilibrium only because it's stable, not because it's good," perturb it hard, and renegotiate. The series pairs human-facing documentation with AGENTS.md (and tool-specific stubs) so automated agents encounter participation rules, design expectations, and pre-arrangement norms instead of a buried wiki page.

The pushback is specific and not anti-tool in the abstract. Peter Maydell asked for a minimal AGENTS.md that encodes the current ban so agents stop generating upstream-bound code in ignorance, and he questioned the workload math. QEMU's bottlenecks, in his view, are review capacity, automated bug-finding against existing code, and unmaintained surface area, not a shortage of patches. A policy whose main move is to allow more generated code "feels bad," he argued, because it will increase reviewer load. Daniel P. Berrangé cast doubt on branding, calling "cautious experimentation" effectively "marketing words for a policy that is 'AI for anything.'" Alistair Francis took the enforcement angle from the other side: a blanket ban "just leads people to ignore the ban and use AI anyway and lie about it," whereas limited, declared use may produce honest pre-arrangement. Bonzini's reply stressed that AGENTS.md is meant to nag agents about process continuously, and that trust in maintainers still bounds what lands. The unresolved split is whether process theater plus disclosure reduces harm or merely legitimizes a flood.

Security stakes are no longer theoretical. A PyTorch pull-request review hook report describes prompt-injection risk when attacker-authored filenames from a PR diff are echoed into a model-facing additionalContext path treated as a system message. Paths flow from the diff into touched-file tracking, into stderr reporting of changed files, and into hook output without the neutralization applied elsewhere. Printable ASCII filenames can carry spaces, quotes, and full sentences at nontrivial length and file counts, giving a fork contributor a channel to dress untrusted prose as trusted hook context. Projects building AI review bots inherit a classic confused-deputy problem: every convenience field that re-enters the prompt as authority becomes part of the attack surface.

Licensing and Free Software ethics supply a fourth collision. On emacs-devel, Thanos Apollo proposed hermes, an Emacs front end for a Hermes agent, with local and remote instance support, streamed diffs, and approval flows. Jean Louis and others objected that a free client does not settle the matter if the natural path steers users toward non-free network services. Richard Stallman sharpened the criterion: if a non-mistreating path exists but "is not the most natural way to use it (the path of least resistance after starting Hermes), then it has a moral flaw." Parallel threads stressed that model weights under permissive terms still sit on datasets without clear provenance, so outputs can reproduce copyrighted material and leave GPL-quality provenance unsolved. Eli Zaretskii's maintainer posture stayed procedural amid the heat: packaging decisions and list norms are separate from whether society has a truly free model stack. The hermes debate is less about one ELPA entry than about whether "works with a local model" is an adequate answer when SaaSS remains the default funnel.

Across these venues the old binary is failing in the same way. Absolute prohibition does not stop capable contributors from shipping agent-written drivers or series; it only removes disclosure and shared review norms. Full permissiveness collides with reviewer bandwidth, DCO and copyright uncertainty, prompt-injection hazards in bot pipelines, and Free Software objections to packages that normalize dependent services. What is emerging instead is paperwork and architecture for governed acceptance: Assisted-by lines and human de-slopping in the kernel, AGENTS.md and pre-arranged large generations in QEMU, hardened context boundaries for review models, and moral tests for whether local, free paths are real defaults or fig leaves.

Nothing in that shift is settled. QEMU's RFC is explicitly not ready to merge; kernel culture is absorbing AI-assisted work through ordinary technical review without a project-wide constitution; PyTorch-style hooks show acceptance machinery can become an exploit path; Emacs and NonGNU still lack a clean line on LLM-shaped packages when datasets and services fail GNU criteria. The industry-wide move is from bans that could not be policed to rules that might be. Whether those rules protect maintainers and users, or merely formalize a new source of unreviewed bulk and ethical compromise, is the argument still in flight.