Is AI-assisted development allowed?

[mcollina]

This commit from the qemu project was brought to my attention: qemu/qemu@3d40db0.

What's our position on this topic?

Is this something we should gather the Board's guidance on? I guess there should be some LF-wide policy on this.

[ljharb]

LLM output indeed has unclear legal provenance and thus no project should accept it. I'd be pleased if we had an LF-wide policy stating as much.

[mcollina]

@ljharb I have a feeling that this would massively drop the contribution rate. Most people are now using GitHub Copilot or Cursor. Essentially dropping them would be crippling our project in this era.

[ljharb]

The linked commit message says

use of AI code generators is either known, or suspected.

In other words, if they're using these tools responsibly, then nobody including a court will know, and it'll be fine. If they're not, their contributions aren't valuable anyways.

In other words, it may indeed be that this LLM-powered era means most contributions aren't valuable anymore, but that's something we all have to grapple with, and is more important a question than the number of contributions.

[mcollina]

In other words, if they're using these tools responsibly, then nobody including a court will know, and it'll be fine. If they're not, their contributions aren't valuable anyways.

Do you say we should ban AI-assisted development and encourage people to lie about their usage?

[ljharb]

I think we should do what qemu did, which is ban any contributions that appear to be from an LLM. Nobody needs to lie because we wouldn't ask them to.

[jsumners]

I'm not so naïve as to think we can detect such submissions with 100% certainty 100% of the time (I've already got it wrong at least once). But we can require as much honesty as we do for other contributions.

In my view, until copyright law is updated to account for this world we find ourselves in today, it is not possible to reassign copyright (see 1 & 2) of the output from these tools to anyone; not the person who used the tool to generate the output, nor to the project/organization they are attempting to give it to. Which is what we ask people to do when they make a contribution, sign over their rights of the work to the project. So, if the theory holds true, that the "author" doesn't own the rights, then they have no rights to give to the project.

[ovflowd]

I think we should do what qemu did, which is ban any contributions that appear to be from an LLM. Nobody needs to lie because we wouldn't ask them to.

To me, this sounds more like a stance driven by legal interpretations — mainly concerns around licensing and the risk of proprietary code being introduced via AI-generated contributions. That said, realistically, this isn't something we can fully enforce unless collaborators specifically flag code that seems AI-generated.

When contributors sign off commits, they're effectively stating — to the best of their knowledge — that they're complying with the DCO. Of course, many drive-by contributors might not even know the DCO exists or that they’re expected to follow it.

One possible solution here is using something like LFX’s EasyCLA. It makes contributors explicitly agree to the CLA, DCO, and Code of Conduct before contributing, which could reduce ambiguity.

Alternatively (or additionally), we could include a clear and visible statement on relevant repos saying that AI-generated content isn’t allowed. Otherwise, I think we’ll keep seeing people — even well-meaning ones — submitting AI-generated code without realizing the implications.

[tobie]

The LF has a policy on Gen AI. It essentially states the following:

1. The tools you use should not place licensing requirements on their output which aren't compatible with the license of the project you're contributing to.
2. If there's copyrighted material in your output, you need to check with the copyright owner as you would in any other case.

The US Copyright Office has a report on the copyrightability of Gen AI. It is fairly straightforward:

• if you use AI tools to assist with creation rather than stand in for it, there's no impact on your ability to copyright your work.
• Purely generated work can't be copyrighted [ed: so it's not an issue to include it in open source].

So taking the two things together:

1. check your tools don't place requirements on their output that aren't compatible with open source (that's generally not the case).
2. check that your code doesn't infringe on someone else's copyright (shouldn't be the case unless you're doing things you shouldn't like asking an LLM to reproduce existing algorithms or modifying closed code).
3. If you follow (1) and (2): your code remains yours (or your employer's) if you're using AI as an assistive tool. If it's purely generated by AI, then it's not copyrightable. In both cases, you can contribute it to an open source code-base (provided your employer allows you to if they own the copyright).

From a project's perspective, there isn't really more you need to do here then you would have before gen AI.

[ljharb]

We can enforce anything we want to - it's open source, maintainers aren't required to justify to anyone why they don't want to accept a contribution.

Personally, I'm not sure the US Copyright Office's stance is sufficient, nor the DCO.

[mcollina]

Thanks @tobie!

[tobie]

@ljharb absolutely! If a contribution is junk, it's junk. That said, that's true regardless of what was used to create it.

The problem with generated code is that it has an easier time masquerading as passable code even when it's junk, essentially wasting reviewer time (same issue as with AI-generated CVEs).

So this is really is more of a maintenance issue than a legal one.

The tension here is that that we want to bring new contributors to open source while not increasing maintainer burden. Usage of gen AI makes this more challenging: while it makes it easier for new contributors to muster the courage to contribute, it makes it way harder for maintainers to assess code quality at face value. I think that's the underlying issue that needs to be addressed.