# OSS Is Going Just Great ...and Generative AI is definitely not burying maintainers under mass-generated slop. ## 2024 ### January - Daniel Stenberg (curl) publishes ["The I in LLM stands for intelligence"](https://daniel.haxx.se/blog/2024/01/02/the-i-in-llm-stands-for-intelligence/) ### March - [**Claude 3 family (Opus, Sonnet, Haiku) released**](https://www.anthropic.com/news/claude-3-family) ### April - [Gentoo bans AI-generated code contributions](https://wiki.gentoo.org/wiki/Project:Council/AI_policy) ### May - [**GPT-4o released**](https://openai.com/index/hello-gpt-4o/) - [NetBSD bans AI-generated code as "tainted"](https://www.netbsd.org/developers/commit-guidelines.html) ### June - [**Claude 3.5 Sonnet released**](https://www.anthropic.com/news/claude-3-5-sonnet) ### July - [**GPT-4o mini released**](https://openai.com/index/gpt-4o-mini-advancing-cost-efficient-intelligence/) - ["We Have a Package for You!"](https://arxiv.org/abs/2406.10279) posted to arXiv (later published at USENIX Security 2025) ### September - [**o1-preview and o1-mini released**](https://openai.com/index/introducing-openai-o1-preview/) ### October - [**Claude 3.5 Haiku released**](https://www.anthropic.com/news/3-5-models-and-computer-use) - [Sonatype 2024 report](https://www.sonatype.com/state-of-the-software-supply-chain/2024/scale): 704,102 malicious packages logged (156% YoY increase) ### December - [**o1 released**](https://openai.com/index/o1-and-new-tools-for-developers/) - [**GitHub Copilot free tier**](https://github.blog/news-insights/product-news/github-copilot-in-vscode-free/) - Seth Larson (Python PSF) publishes ["New era of slop security reports"](https://sethmlarson.dev/slop-security-reports) ## 2025 ### January - [**o3-mini released**](https://openai.com/index/openai-o3-mini/) - [**DeepSeek R1 released**](https://api-docs.deepseek.com/news/news250120) ### February - Andrej Karpathy [coins "vibe coding"](https://x.com/karpathy/status/1886192184808149383) - [**Claude 3.7 Sonnet released**](https://www.anthropic.com/news/claude-3-7-sonnet) - [**Claude Code preview**](https://www.anthropic.com/news/claude-3-7-sonnet) ### April - [**o3 and o4-mini released**](https://openai.com/index/introducing-o3-and-o4-mini/) - [**GPT-4.1 series released**](https://openai.com/index/gpt-4-1/) - [Slopsquatting](https://mastodon.social/@andrewnez/114302875075999244) term coined (by Seth Larson, amplified by Andrew Nesbitt) - [Sonatype Q1 2025 report](https://www.sonatype.com/blog/open-source-malware-index-q1-2025): 17,954 malicious OSS packages identified; 56% related to data exfiltration (up from 26% in Q4 2024) ### May - [**Claude Sonnet 4 and Opus 4 released**](https://www.anthropic.com/news/claude-4) - [**Claude Code GA**](https://www.anthropic.com/news/claude-4) - [**OpenAI Codex released**](https://openai.com/index/introducing-codex/) - Stenberg posts ["We are effectively being DDoSed"](https://simonwillison.net/2025/May/6/daniel-stenberg/); introduces instant-ban policy for AI slop on curl's HackerOne - Open Collective reports being ["flooded with AI garbage"](https://techcrunch.com/2025/07/24/ai-slop-and-fake-reports-are-exhausting-some-security-bug-bounties/) bug reports ### June - Trend Micro publishes [slopsquatting research](https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/slopsquatting-when-ai-agents-hallucinate-malicious-packages) - [Malicious PyPI packages targeting Solana developers](https://www.reversinglabs.com/blog/same-name-different-hack-pypi-package-targets-solana-developers) discovered ### July - curl bug report volume [spikes to 8x normal rate](https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/) in one week - Stenberg publicly [mulls killing the bug bounty program](https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/) - [HackerOne launches Hai Triage](https://www.hackerone.com/press-release/hackerone-unveils-hai-triage-upgraded-ai-powered-vulnerability-response) - PyPI publishes [incident report on phishing attack](https://blog.pypi.org/posts/2025-07-31-incident-report-phishing-attack/) - [IndonesianFoods campaign](https://www.bleepingcomputer.com/news/security/new-indonesianfoods-spammer-floods-npm-with-150-000-packages/) reaches 150,000+ npm packages - METR study: [experienced open-source developers are 19% slower with AI tools](https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/) — despite believing they were 20% faster ### August - [**GPT-5 released**](https://openai.com/index/introducing-gpt-5/) - [**Claude Opus 4.1 released**](https://www.anthropic.com/news/claude-opus-4-1) - Ghostty (Mitchell Hashimoto) introduces [mandatory AI disclosure policy](https://github.com/ghostty-org/ghostty/pull/8289) for PRs ### September - [**Claude Sonnet 4.5 released**](https://www.anthropic.com/news/claude-sonnet-4-5) - [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem) self-replicating npm malware discovered - PyPI publishes [incident report on token exfiltration via GitHub Actions](https://blog.pypi.org/posts/2025-09-16-github-actions-token-exfiltration/) - Cybersecurity Dive: ["Tech giants pledged millions to secure open-source code. Then AI came along."](https://www.cybersecuritydive.com/news/open-source-software-security-progress-roadblocks/758506/) ### October - [**Claude Haiku 4.5 released**](https://www.anthropic.com/news/claude-haiku-4-5) - Stenberg: ["A new breed of analyzers"](https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/) — praises AI-assisted bug finding by Joshua Rogers - [PyPI adds typosquatting detection](https://blog.pypi.org/posts/2025-12-31-pypi-2025-in-review/) for project creation ### November - [**Clawdbot launched**](https://github.com/clawdbot) - [**Claude Opus 4.5 released**](https://www.anthropic.com/news/claude-opus-4-5) - Nolan Lawson: ["The Fate of Small Open Source"](https://nolanlawson.com/2025/11/16/the-fate-of-small-open-source/) - [Linux kernel AI contribution guidelines proposed](https://www.phoronix.com/news/Linux-Kernel-AI-Guidelines-v3) (Dave Hansen/Intel, v3) - [OCaml maintainers reject 13,000-line AI-generated pull request](https://devclass.com/2025/11/27/ocaml-maintainers-reject-massive-ai-generated-pull-request/) - PyPI publishes [incident report on Shai-Hulud implications](https://blog.pypi.org/posts/2025-11-26-pypi-and-shai-hulud/) ### December - [**GPT-5.2 released**](https://openai.com/index/introducing-gpt-5-2/) - [**Claude Code background agents released**](https://www.anthropic.com/news/enabling-claude-code-to-work-more-autonomously) - [PyPI year in review](https://blog.pypi.org/posts/2025-12-31-pypi-2025-in-review/): hardened ZIP upload pipeline, typosquatting detection, domain resurrection prevention, spam prevention - [Excalidraw receives 2x PRs in Q4 vs Q3](https://tldraw.dev/blog/stay-away-from-my-trash) - Rob Pike, Guido van Rossum, and Anders Hejlsberg [spammed by autonomous AI agents](https://simonwillison.net/2025/Dec/26/slop-acts-of-kindness/) performing "random acts of kindness" on Christmas Day ## 2026 ### January - [Clawdbot renamed to Moltbot](https://news.ycombinator.com/item?id=46783863) after Anthropic trademark complaint; then renamed to [OpenClaw](https://docs.openclaw.ai/) three days later. The abandoned "Moltbot" name was [immediately impersonated](https://www.malwarebytes.com/blog/threat-intel/2026/01/clawdbots-rename-to-moltbot-sparks-impersonation-campaign) by attackers who grabbed old handles and pushed [400+ malicious agent skills](https://www.bleepingcomputer.com/news/security/malicious-moltbot-skills-used-to-push-password-stealing-malware/) through ClawHub - [Sonatype 2026 State of the Software Supply Chain report](https://www.sonatype.com/state-of-the-software-supply-chain/introduction) published - Cloudflare publishes ["Building a serverless, post-quantum Matrix homeserver"](https://blog.cloudflare.com/serverless-matrix-homeserver-workers/); [Matrix Foundation responds](https://matrix.org/blog/2026/01/28/matrix-on-cloudflare-workers/) - Armin Ronacher (Flask creator) publishes ["Agent Psychosis"](https://lucumr.pocoo.org/2026/1/18/agent-psychosis/) - [Linus Torvalds tells kernel devs to stop making an issue of AI slop in docs](https://www.phoronix.com/news/Torvalds-Linux-Kernel-AI-Slop) - curl [shuts down bug bounty program](https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/) (effective Jan 31) - [LLVM institutes "human-in-the-loop" policy](https://github.com/llvm/llvm-project/commit/18695b27d565) for AI-generated contributions - Ghostty (Hashimoto) [escalates to zero-tolerance AI policy](https://github.com/ghostty-org/ghostty/pull/10412) - tldraw (Steve Ruiz) [auto-closes ALL external pull requests](https://tldraw.dev/blog/stay-away-from-my-trash) — "Stay away from my trash" - [128 phantom npm packages](https://www.aikido.dev/blog/agent-skills-spreading-hallucinated-npx-commands) (slopsquatting) racked up 121,539 downloads Jul 2025–Jan 2026 - ["How AI Impacts Skill Formation"](https://arxiv.org/abs/2601.20245) (Shen & Tamkin) — developers using AI learned less and debugged worse, without significant efficiency gains ### February - Daniel Stenberg delivers FOSDEM 2026 closing keynote: ["Open Source Security in spite of AI"](https://daniel.haxx.se/blog/2026/02/03/open-source-security-in-spite-of-ai/) - [International AI Safety Report 2026](https://internationalaisafetyreport.org/publication/international-ai-safety-report-2026) published (Yoshua Bengio et al.) — documents AI agents completing multi-hour software engineering tasks autonomously - [**Claude Opus 4.6 released**](https://www.anthropic.com/news/claude-opus-4-6) — Anthropic reports it [found 500+ high-severity zero-day vulnerabilities](https://www.axios.com/2026/02/05/anthropic-claude-opus-46-software-hunting) in OSS libraries (Ghostscript, OpenSC, CGIF) during [internal red-team testing](https://red.anthropic.com/2026/zero-days/) - [GitHub weighs PR "kill switch"](https://www.theregister.com/2026/02/03/github_kill_switch_pull_requests_ai/) - RedMonk publishes ["AI Slopageddon and the OSS Maintainers"](https://redmonk.com/kholterhoff/2026/02/03/ai-slopageddon-and-the-oss-maintainers/) - InfoWorld: ["Is AI killing open source?"](https://www.infoworld.com/article/4129056/is-ai-killing-open-source.html) - continue.dev: ["We're Losing Open Contribution"](https://blog.continue.dev/were-losing-open-contribution/) - Mitchell Hashimoto releases [Vouch](https://github.com/mitchellh/vouch), a community trust management system based on explicit vouches to participate - [1Password launches SCAM benchmark](https://1password.com/blog/ai-agent-security-benchmark) — tests whether AI agents fall for phishing and social engineering during realistic workflows; every model tested committed critical failures - [An AI Agent Published a Hit Piece on Me](https://theshamblog.com/an-ai-agent-published-a-hit-piece-on-me/) - [Godot maintainers struggle with "draining and demoralizing" AI slop PRs](https://www.theregister.com/2026/02/18/godot_maintainers_struggle_with_draining/) - [Blender proposes AI contributions policy](https://devtalk.blender.org/t/ai-contributions-policy/44202) - [Black Duck 2026 OSSRA report](https://www.blackduck.com/blog/open-source-trends-ossra-report.html): open source vulnerabilities doubled to 581 per codebase as AI accelerates code creation - [Gentoo launches official Codeberg mirror](https://www.gentoo.org/news/2026/02/16/codeberg.html) as an alternative to GitHub for contributions - [**Anthropic launches Claude for Open Source**](https://claude.com/contact-sales/claude-for-oss) — 6 months of free Claude Max 20x for open source maintainers and core contributors ### March - Tuan Anh Tran: ["Relicensing with AI-Assisted Rewrite"](https://tuananh.net/2026/03/05/relicensing-with-ai-assisted-rewrite/) — using AI to rewrite a LGPL-licensed library as a way to circumvent copyleft ## Resources - [CHAOSS AI Alignment WG](https://github.com/chaoss/wg-ai-alignment/blob/main/moderation/README.md) — project AI policies, spam examples, blog posts - [Sonatype SSC Attack Timeline](https://www.sonatype.com/resources/vulnerability-timeline) — curated timeline of supply chain attacks - [daniel.haxx.se AI tag](https://daniel.haxx.se/blog/tag/ai/) — Stenberg's full archive of AI-related curl posts - [Pivot to AI](https://pivot-to-ai.com/) — David Gerard's AI hype and harm tracker - [Simon Willison's blog](https://simonwillison.net/) — prolific coverage of AI tools and their real-world impact - [Seth Larson's blog](https://sethmlarson.dev/) — Python PSF security developer-in-residence Missing something? [Contributions welcome](https://github.com/andrew/nesbitt.io/blob/master/oss-is-going-just-great.md). Hat tip to [Web3 Is Going Just Great](https://web3isgoinggreat.com/) for the format inspiration. --- By Andrew Nesbitt (https://nesbitt.io). Markdown version of https://nesbitt.io/oss-is-going-just-great/