# Major open-source projects adopt divergent policies on AI-generated code contributions

> **Key takeaway:** Rust, cURL, GCC, Debian, the Linux kernel, and Asahi Linux have each established distinct policies governing LLM-assisted contributions, reflecting unresolved tension between review burden, legal risk, and practical utility.

**Published:** 2026-11-14T11:52:00+00:00 
**Source:** It's FOSS Community News 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/major-open-source-projects-adopt-divergent-policies-on-ai-ge.html 

## Summary
The debate over AI-generated code in open source has shifted from informal complaints to concrete policy decisions across multiple high-profile projects. ImageMagick closed an eight-month request to ban AI-written code after it devolved into ideological conflict, while Asahi Linux began relicensing from MIT to GPLv2 to combat unauthorized use of its unreleased work, including cases where LLMs were used to obscure code provenance. On the policy front, Rust now permits LLMs for questions and code review but bans undisclosed LLM-generated comments, documentation, and diagnostics. GCC rejects legally significant contributions containing LLM output but allows marked, insignificant ones. Debian and the Linux kernel both require human accountability without banning the tools outright. cURL ended its bug bounty program in January after AI-generated vulnerability reports overwhelmed maintainers, though project lead Daniel Stenberg reports quality has improved since spring.

The divergence extends to hosting platforms: Codeberg members voted 358-144 in July to stop hosting predominantly AI-written projects, citing crawler load and storage costs. Linus Torvalds acknowledged that AI-found bugs and patches from unqualified contributors create real maintainer burden, while arguing the problem lies in misuse rather than the technology itself. No consensus has emerged, with GCC planning a 2027 policy review and Rust expecting ongoing revisions.

## Project policies and their technical distinctions
- **Rust:** Accepts LLMs for answering questions and reviewing work; explicitly bans LLM-generated comments, documentation, and diagnostics; permits LLM-written code only under disclosed experiment conditions; prohibits harassment of LLM users.
- **GCC:** Rejects legally significant contributions involving LLM output entirely; allows legally insignificant contributions if clearly marked as LLM-generated; plans formal policy review by start of 2027.
- **Debian and Linux kernel:** Both maintain tool-neutral positions requiring the named human submitter to read, test, understand, and take accountability for all submitted code, addressing review burden through attribution rather than prohibition.
- **cURL:** Terminated bug bounty program at end of January due to majority of reports becoming AI-generated non-vulnerabilities; reports recent AI-assisted submissions have improved in quality though remain verbose.
- **Asahi Linux:** Relicensing from MIT to GPLv2 specifically to address unauthorized lifting of unreleased work, including LLM rewriting to hide provenance; policy warns that LLM agents may compromise clean-room reverse engineering compliance by obscuring knowledge acquisition methods.

## Why it matters
The patchwork of incompatible policies creates growing friction for cross-project contributors who must navigate distinct rulebooks for each submission, increasing compliance overhead in already strained maintainer communities. For Linux distributions and downstream packagers, the divergence matters because kernel, GCC, and Rust toolchain contributions flow through these projects, and licensing or provenance disputes in Asahi Linux's Apple Silicon reverse engineering work could affect hardware enablement timelines for ARM64 laptops.