Open-source maintainers have spent the past year drowning in AI-generated pull requests, and a growing number of projects have responded by writing a rule about it. Researchers went looking for those rules across every substantial, active GitHub project they could find, and found that barely one project in eighty has written anything down at all. Such policies were rare through 2025 and have been appearing much faster this year.
Where a rule did exist, the researchers compared each project against similar projects that never adopted one, tracking what changed in the weeks after. Writing a rule about AI contributions roughly doubled the share of pull requests visibly using AI. Maintainers replied to more of them, reviewers each handled less code, and pull requests got smaller. Even projects that banned AI-generated code outright still saw AI-assisted work arriving; what changed was that more of it came labelled.
"Bans raise the entry bar for contributions rather than eliminate AI."
One group did suppress it, and it's the group most companies default to. Projects that restricted how AI could be used but never asked contributors to declare it were the only ones where both AI activity and disclosure fell together. A rule people can't see doesn't stop the behaviour; it stops the reporting.
"Stating nothing is worse than an explicit stance statement."
Asking for disclosure alone wasn't enough either. Projects that required a declaration but attached no consequence attracted the most new contributors and also ended up with more security issues flagged in their code, roughly a fifth more. The projects that paired disclosure with a review requirement and a stated consequence had about a quarter fewer.
A contribution policy works better as a measurement instrument than as a compliance document. What a disclosure requirement buys is a field a team can sort its review queue by, which is worth more than the prohibition most leaders reach for first, because a ban removes the signal without removing the code. Any internal AI policy that specifies what engineers may not do, but never says what they must declare, has bought the enforcement cost and none of the visibility.
Two things temper this. The study watches only the first couple of months after a policy lands, and projects that bother to write one were probably already paying closer attention than their peers. And "safer" here means an automated scanner flagged fewer problems, which is a reasonable proxy for care rather than evidence that anything was prevented.
Sources
- Chen, Y., Zimmermann, T., Trinkenreich, B., "Making AI Visible, Not Vanished: How AI Policies Reshape Developer Experience on GitHub" — https://arxiv.org/abs/2608.03329