Posted 2026-01-18 • 5 min read
I have started several open source projects in my life. One was a messenger called Actor in ~2015, another is Happy (an encrypted mobile and web Claude Code client) in ~2025. Both are cross-platform messengers. The old project didn’t see many contributions. The new one receives plenty — but something has changed. Most of them are now vibecoded. I wouldn’t call them low effort exactly, but the quality is much lower than I’d expect. And we are clearly not unique. Recently, curl introduced mandatory AI disclosure after being flooded with fabricated security reports. QEMU formally banned AI-generated code over licensing concerns. The Zig project left GitHub entirely, citing their strict no-LLM policy. Just this wee…
Posted 2026-01-18 • 5 min read
I have started several open source projects in my life. One was a messenger called Actor in ~2015, another is Happy (an encrypted mobile and web Claude Code client) in ~2025. Both are cross-platform messengers. The old project didn’t see many contributions. The new one receives plenty — but something has changed. Most of them are now vibecoded. I wouldn’t call them low effort exactly, but the quality is much lower than I’d expect. And we are clearly not unique. Recently, curl introduced mandatory AI disclosure after being flooded with fabricated security reports. QEMU formally banned AI-generated code over licensing concerns. The Zig project left GitHub entirely, citing their strict no-LLM policy. Just this week, tldraw announced they would begin automatically closing all external pull requests.
Fatal contributions
Trash contributions existed before AI. Someone would wander into your repo, fix a typo, submit something half-baked. You could tell at a glance.
Now you can’t. Sometimes the PR looks fine, appears to understand the issue. Sometimes it’s the opposite: walls of emojis, a thousand lines to fix a ten-line problem. Projects started receiving security reports with detailed stack traces, register states, function names — all hallucinated. A contribution to the Linux kernel was bot-generated but undisclosed. A kernel developer and maintainer both reviewed it, both missed the bug. It was only caught later when someone actually read the code.
Every merge is a leap of faith.
Slop all the way down
Happy is coded in bursts — a few intense days, then weeks away. Context evaporates. Contributors are tired, juggling other work. You come back and half the codebase feels unfamiliar. This is exactly when vibecoding is most tempting: just describe what you want, let the agent figure out the details you’ve forgotten. But we won the competition by polishing details, by caring about things agents don’t notice — the small UX decisions, the edge cases, the fit and finish. Not by generating more code faster.
Open source lives on personal projects and startups. Personal projects are almost entirely vibecoded now — why wouldn’t they be? Startups are somewhere in between, racing to ship, using whatever gets them there faster. This is the code that ends up on GitHub. This is what we are building on.
How much of the ecosystem is already slop?
Trust erasure
It’s not just strangers. Your coworkers use AI. Your friends use AI. You use AI. Everyone is forwarding slop to each other now.
Before, a contribution meant something. Someone understood the code well enough to change it. They owned that decision. If it broke, they knew why. Now a PR arrives and even the author can’t explain it fully. They described what they wanted. The agent produced something. It seemed to work.
It’s like driving with Tesla Autopilot. Eight hours in an old Porsche and you’re fine — you were engaged. Eight hours supervising Autopilot and you’re destroyed. Attention half-engaged, never fully off, never fully in control. You can’t relax and you can’t focus. That’s what code review feels like now. That’s what writing code feels like now.
Ownership used to be distributed across contributors. Now it’s distributed across no one. The code exists, but nobody fully understands it. The agent made choices for reasons it can’t articulate, approved by a human who didn’t quite follow them.
You own nothing and ship anyway.
Future
The game theory is brutal. If you slow down to understand and others don’t, you lose. Ship fast or get filtered out. From the outside, nobody can tell vibecoded from crafted — the market only sees speed and the appearance of function. So everyone optimizes for that.
Each vibecoded contribution erodes the ecosystem a little. But the contributor doesn’t pay that cost. They ship and move on. The cost gets distributed across everyone who depends on the code later. Tragedy of the commons, one PR at a time.
The careful people either adapt or leave. The culture shifts — not because anyone chose it, but because everyone who chose differently got filtered out. Once speed becomes the norm, you can’t unilaterally slow down. What was "fast" is now "normal." The baseline moved.
And the more slop in the ecosystem, the more you’re building on slop anyway. Why craft your layer if it sits on generated garbage? The incentive to care doesn’t propagate. If the foundation is slop, the ceiling is slop.
You could still understand. You could read every line. The capability is there. Human context is still deeper than any model. But you won’t — because you can’t afford to.
Some code will stay careful. Aviation. Medical devices. Infrastructure where failure kills. The cost of mistakes is high enough that craft still pays. But most software isn’t that. Most software is everything else — the endless layer of apps and tools and services where "works" is good enough.
Two worlds. One where understanding still matters. One where it’s a luxury no one can afford.