CoChat
Sign Up
PreprintCited by 3Open Source Software InnovationsSoftware Engineering ResearchSoftware Engineering Techniques and Practices

"AI Slop is DDoSing Open Source": Understanding the Impact of AI-Generated Contributions on Open Source Sustainability

Open access
Afroz, Sadia, Miller, Courtney, Menezes, Tyler, Gilmour, Edward, Sarma, Anita, Feng, Zixuan·2026·arXiv
DOI 10.48550/arxiv.2607.04003arXiv 2607.04003
Open this paper in CoChat — free accountOpen PDF

Abstract

Open source software (OSS) communities are facing increasing pressure from Generative AI (GenAI) tools. We call it AI-DDoS: a denial-of-service effect in which plausible but low-quality AI-generated contributions overwhelm OSS community capacity. Using a phenomenon-based mixed-methods approach, we first analyze practitioner accounts from Reddit, OSS mentor mailing lists, and blogs to identify six recurring themes and derive hypotheses. We then evaluate these hypotheses using Bayesian Structural Time Series analysis across 294 repositories with over 2 million pull requests and issues. Our results show that while PR volume increased in 2025, merge rates declined, with one-time contributors experiencing an 18.18% drop in PR merge rates relative to the counterfactual. Finally, we identify 11 remediation strategies through practitioners' interviews and validate them with a survey of 229 OSS practitioners, grouping them into preservative, adaptive, and transformative orientations. Our findings show that AI-DDoS is not only a contribution-volume problem but a sustainability trap: communities often default to low-effort defensive strategies that protect short-term review capacity while making openness difficult to sustain.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper characterizes “AI-DDoS,” a denial-of-service effect in which plausible but low-quality GenAI contributions overwhelm open source review capacity. Using practitioner accounts and Bayesian structural time series across 294 repositories, it finds post-2025 PR volume rose while merge and issue-completion rates fell, especially for one-time contributors, and identifies 11 remediation strategies validated by 229 practitioners.

Key findings

  • Triangulated gray literature produced six recurring themes: volume/submission flood, quality collapse, transient contributors, incentive/platform structure, maintainer/mentor wellbeing, and defensive contraction; theme segment counts ranged from 19 to 77 across sources.
  • Across 294 repositories with 1,224,374 PRs and 822,133 issues from 356,972 contributors, weekly PR volume ran 6.80% above the counterfactual (about 520 excess PRs/week, roughly 27,000/year), PR merge ratio fell 1.06%, issue volume fell 8.12% (opposite to the hypothesis), and issue completion ratio fell 3.40%.
  • One-time contributors showed the sharpest merge decline: PR volume rose 5.84% but PR merge ratio fell 18.18% (|d| = 2.84), and issue completion ratio fell 10.30%; non-one-time contributors had PR volume +6.91%, PR merge ratio −3.45%, and issue completion ratio −8.09%.
  • The survey of 229 OSS practitioners endorsed preservative strategies most: tighten CI-based quality gates (73%) and enforce no-review cutoffs for red-flagged submissions (71%); the least endorsed were grounding trust in verified identity/endorsement (39%) and expanding triage through rotation/community review (34%).

Methods

  • Phenomenon-based mixed-methods design: Stage 1 reflexive thematic analysis of gray literature—12 blog posts, 24 Reddit threads (334 comments), and 13 mentors mailing-list threads (119 emails)—to derive hypotheses.
  • Stage 2 used Bayesian Structural Time Series causal impact analysis on 294 GitHub repositories, weekly volume-weighted, from January 2023 to December 2025, treating 2025 as the intervention period.
  • RQ2 used semi-structured interviews with 11 OSS maintainers guided by Organizational Resilience Theory, member checking with 7 respondents, then a validation survey of 229 valid practitioners (from 336 responses) rating 11 strategies on a 5-point Likert scale, plus 83 open-ended responses.

Limitations

  • Stated: Stage 1 qualitative analysis may overrepresent visible, vocal, or highly affected practitioners and is treated as phenomenon identification rather than prevalence estimation; RQ2 may have self-selection bias, mitigated with neutral questions and concrete examples.
  • Stated: BSTS deviations are consistent with AI-DDoS but do not rule out other 2025 ecosystem changes, individual AI use was not observed, and significant placebo effects for issue metrics mean issue-side findings are interpreted cautiously; external validity is limited to popular, active repositories and survey respondents.
  • Evident: the intervention is a calendar-year boundary rather than a specific date, no natural comparison group exists, and the survey sample was mostly men (197/229, 86.03%) and experienced practitioners, which may limit generalizability.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2607.04003

Cites

0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 62 cited sources checked · 0 supported · 0 flagged

  • Findingown data

    Non-one-time contributors' weekly issue completion ratio decreased by 8.09% (d = 1.60).

    “H2c is not supported, as issue volume decreased by 12.40% weekly on average under counterfactual(d = 0.97) , while H2d is supported, with the weekly issue completion ratio decreasing by 8.09% (d = 1.60).”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The pre-intervention trends in the metrics would have continued unchanged into 2025 absent the AI-assisted contribution surge.
    • Rests on an assumption: The observed deviations from the counterfactual in 2025 are attributable to the surge in AI-assisted contributions rather than other concurrent ecosystem-level changes.
  • Findingown data

    Survey participants widely endorsed preservative strategies.

    “participants widely endorsed preservative strategies because they are cheap, requiring little new infrastructure and little added coordination.”
    Quote in the paperSubstantial claim
  • Findingcitation

    Preservative strategies can kill most spray-and-pray submissions.

    “Such strategies can”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites R3

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Findingown data

    Non-one-time contributors' PR merge ratio fell 3.45% below the counterfactual (d = 2.14).

    “H2b is also supported, with their PR merge ratio falling 3.45% below the counterfactual (d = 2.14).”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The pre-intervention trends in the metrics would have continued unchanged into 2025 absent the AI-assisted contribution surge.
    • Rests on an assumption: The observed deviations from the counterfactual in 2025 are attributable to the surge in AI-assisted contributions rather than other concurrent ecosystem-level changes.
  • Findingown data

    Issue volume ran 8.12% below the counterfactual, corresponding to an average of about 431 fewer issues per week (roughly 22,000 fewer over the postintervention year).

    “H1c. Issue Volume is not supported but is significant in the opposite direction: issue volume ran 8.12% below the counterfactual, corresponding to an average of about 431 fewer issues per week (roughly 22,000 fewer over the postintervention year).”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: The pre-intervention trends in the metrics would have continued unchanged into 2025 absent the AI-assisted contribution surge.
    • Rests on an assumption: The observed deviations from the counterfactual in 2025 are attributable to the surge in AI-assisted contributions rather than other concurrent ecosystem-level changes.
  • May combine two claims. 41
  • Classified as probably not a substantial claim. 35
  • The quote only partly states this claim. 1

  • May combine two claims.

    Findingown data

    Across 294 widely-used projects, PR volume rose while merge rates and issue completion fell after 2025, with the sharpest effect among one-time contributors.

    “Causal impact evidence that AI-DDoS is a structural, ecosystem-wide problem: across 294 widely-used projects, PR volume rose while merge rates and issue completion fell after 2025, with the sharpest effect among one-time contributors.”
    • Also stated in: § Abstract · plain
      “Our results show that while PR volume increased in 2025, merge rates declined, with one-time contributors experiencing an 18.18% drop in PR merge rates relative to the counterfactual.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The BSTS counterfactual accurately represents what would have happened without AI adoption, with no other major ecosystem-wide changes in 2025 confounding the analysis.

  • Classified as probably not a substantial claim. May combine two claims.

    Findingown data

    We identified 11 remediation strategies and assessed their implementation effort as low, medium, or high.

    “In total, we identified 11 remediation strategies and assessed their implementation effort as low, medium, or high based on participants' descriptions of required labor, tooling, workflow changes, and coordination.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Practitioners across all three sources reported that AI-assisted contributions increase contribution volume while reducing contribution quality.

    “As shown in Table I (T1, T2, T4, and T5), practitioners across all three sources reported that AI-assisted contributions increase contribution volume while reducing contribution quality.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The three gray literature sources (Reddit, practitioner blogs, and the OSS mentors' mailing list) are independent.
    • Rests on an assumption: The practitioner accounts from the three gray literature sources are representative of OSS community experiences.

  • May combine two claims.

    Findingown data

    The study identified 11 remediation strategies through practitioner interviews and validated them with a survey of 229 OSS practitioners, grouping them into preservative, adaptive, and transformative orientations.

    “Finally, we identify 11 remediation strategies through practitioners' interviews and validate them with a survey of 229 OSS practitioners, grouping them into preservative, adaptive, and transformative orientations.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The survey of 229 OSS practitioners is representative of the broader OSS community.

  • May combine two claims.

    Findingown data

    Phenomenon 3 (Denial-of-service effect): AI-DDoS first breaks the human layer of OSS; communities then protect themselves by narrowing the open channels that once sustained broad participation.

    “We therefore characterize Phenomenon 3: (Denial-ofservice effect): AI-DDoS first breaks the human layer of OSS; communities then protect themselves by narrowing the open channels that once sustained broad participation.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The practitioner accounts from the three gray literature sources are representative of OSS community experiences.

  • May combine two claims.

    Findingown data

    Endorsement is highest and most consistent for preservative strategies: tighten CI-based quality gates (SP1, 73%) and enforce no-review cutoffs for red-flagged submissions (SP2, 71%).

    “Across the three categories, endorsement is highest and most consistent for preservative strategies: tighten CI-based quality gates (SP1, 73%) and enforce no-review cutoffs for red-flagged submissions (SP2, 71%).”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    The six recurring themes show cross-source convergence among the three data sets analyzed, with a concentration in 2025.

    “These themes show cross-source convergence among the three data sets we analyzed, with a concentration in 2025.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The three gray literature sources (Reddit, practitioner blogs, and the OSS mentors' mailing list) are independent.
    • Rests on an assumption: The practitioner accounts from the three gray literature sources are representative of OSS community experiences.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Findingown data

    One-time issue volume increased by 4.00% relative to the counterfactual, but this effect was not supported (posterior probability 82.8%, d = 0.27).

    “H3.c Issue volume 58.20 +4.00% 82.8% 0.27”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: The pre-intervention trends in the metrics would have continued unchanged into 2025 absent the AI-assisted contribution surge.
    • Rests on an assumption: The observed deviations from the counterfactual in 2025 are attributable to the surge in AI-assisted contributions rather than other concurrent ecosystem-level changes.

  • May combine two claims.

    Findingreasoning

    Stage 1 characterizes practitioner-reported AI-DDoS, with evidence converging around 2025 across three independent sources.

    “Stage 1 characterizes practitioner-reported AI-DDoS, with evidence converging around 2025 across three independent sources.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The three gray literature sources (Reddit, practitioner blogs, and the OSS mentors' mailing list) are independent.
    • Rests on an assumption: The practitioner accounts from the three gray literature sources are representative of OSS community experiences.

  • May combine two claims.

    Premisecitation

    A project's health and survival depend on its maintainers, who provide the labor that keeps the project alive, and on its ability to recruit and retain new contributors who renew that labor over time.

    “Over a decade of OSS sustainability research establishes that a project's health and survival depend on its maintainers, who provide the labor that keeps the project alive, and on its ability to recruit and retain new contributors who renew that labor over time [6], [7].”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [6]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [7]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    In January 2026, the cURL project ended its six-year bug bounty program after AI-generated contributions reduced the proportion of valid submissions to about 5% by July 2025, making triage unsustainable.

    “In January 2026, the cURL project ended its six-year bug bounty program after AI-generated contributions reduced the proportion of valid submissions to about 5% by July 2025, making triage unsustainable [4], [5].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [4]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [5]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationreasoning

    Defensive responses help OSS projects survive the immediate flood of AI-generated contributions, but they narrow or completely block the pathways through which OSS sustains itself.

    “These responses help projects survive the immediate flood, but they narrow or completely block the pathways through which OSS sustains itself.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation

    Generative AI tools for software development have dramatically lowered the cost of producing code while raising the cost of evaluating it.

    “Generative Artificial Intelligence (GenAI) tools for software development have dramatically lowered the cost of producing code while raising the cost of evaluating it [1], [2].”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [1]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [2]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Other OSS projects have moved to invitation-only contribution workflows, adopted blanket policies rejecting unsolicited pull requests, and stopped accepting outside vulnerability reports.

    “Others have moved to invitation-only contribution workflows, adopted blanket policies rejecting unsolicited pull requests, and stopped accepting outside vulnerability reports [2], [3].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [2]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [3]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    The 2025 Stack Overflow Developer Survey reports that 84% of developers use or plan to use GenAI tools and 51% use them daily, while GitHub's Octoverse 2025 reports platform-scale growth in developers and merged pull requests.

    “The 2025 Stack Overflow Developer Survey reports that 84% of developers use or plan to use them and 51% use them daily, while GitHub's Octoverse 2025 reports platformscale growth in developers and merged pull requests [15], [16].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [15]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [16]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    AI can generate a plausible pull request.

    “AI can generate a plausible pull request, but situated understanding is harder to fake across the discussion, revision, and review cycle.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationown data

    Across both research questions, the evidence converges that AI-DDoS is an emerging, ecosystem-wide structural crisis, not an isolated complaint.

    “Across both RQs, the evidence converges: AI-DDoS is an emerging, ecosystem-wide structural crisis, not an isolated complaint.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Prior work has examined how OSS projects can keep the contributor pathway open by lowering entry barriers through good first issues, mentoring programs, contribution guidelines, and structured onboarding practices.

    “Prior work has therefore examined how OSS projects can keep this pathway open by lowering entry barriers through”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [23]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [24]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given

    Adaptive and transformative remediation leads to organizational growth.

    “Adaptive & transformative remediation leads to organizational growth.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    AI-DDoS and the strategies used to remediate it reach well beyond their immediate toll on maintainers.

    “AI-DDoS and the strategies used to remediate it therefore reach well beyond their immediate toll on the maintainers (e.g., Linux [9] and Ghostty [10]).”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [9]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [10]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationreasoning

    AI-DDoS (AI-assisted contributions) is emerging as an ecosystem crisis and is placing OSS communities under structural pressure.

    “Our results converge on a concerning picture: AI-DDoS is emerging as an ecosystem crisis”
    • Also stated in: § Do Not Unplug the Server. · plain
      “In conclusion, AI-assisted contributions are placing OSS communities under structural pressure.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    The survey captures the views of OSS participants who chose to respond and may not represent all OSS communities equally.

    “Similarly, the survey captures the views of OSS participants who chose to respond, and while the sample spans diverse project sizes, roles, and experience levels, it may not represent all OSS communities equally.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Study design and conductown data

    Placebo tests strengthen confidence in PR findings, but significant placebo effects for issue metrics suggest that issue workflows were already changing before 2025, so issue-side findings are interpreted more cautiously.

    “As a model robustness check, placebo tests using January 2024 as a pseudo-intervention date strengthen confidence in PR findings, but significant placebo effects for issue metrics suggest that issue workflows were already changing before 2025, and we therefore interpret issue-side findings more cautiously [67].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [67]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationreasoning

    Portable trust signals across projects could reduce the need to evaluate every contributor from scratch.

    “Second, portable trust signals across projects could reduce the need to evaluate every contributor from scratch.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationreasoning

    Organizational growth depends on the OSS ecosystem to transform the AI-DDoS pressure into shared sustainability infrastructure.

    “Organizational growth ( 3 in Figure 2) depends on the OSS ecosystem to transform the AI-DDoS pressure into shared sustainability infrastructure.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    Controlled studies report productivity gains from AI-assisted tools, especially for less experienced developers, but emerging evidence shows quality tradeoffs, including increased churn, reduced reuse, more static-analysis warnings, and higher complexity.

    “Controlled studies report productivity gains [32], [33], especially for less experienced developers [34], but emerging evidence shows quality tradeoffs, including increased churn, reduced reuse, more static-analysis warnings, and higher complexity [35], [36].”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [32]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [33]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [34]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    Situated understanding is harder to fake across the discussion, revision, and review cycle.

    “AI can generate a plausible pull request, but situated understanding is harder to fake across the discussion, revision, and review cycle.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    Proof of engagement maps onto challenge-response.

    “For example, proof of engagement ( 2 in Figure 2) maps onto challenge-response: contributors are asked to explain why a change is needed, how the code works, what alternatives were considered or failed, and how they respond to review.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: OSS contributions are social interactions.

  • May combine two claims.

    Premisecitation

    The OSS sustainability model relies on trust: trust that outsiders arrive with good-faith intent, that maintainers can distinguish promising newcomers from low-quality noise, and that welcoming many outsiders will replenish the contributor base.

    “Yet this model of sustainability relies on trust: trust that outsiders arrive with good-faith intent, that maintainers can distinguish promising newcomers from low-quality noise, and that welcoming many outsiders will replenish the contributor base [25].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [25]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Premisecitation

    OSS sustainability is a project's ability to continuously generate the labor required to maintain it, through sustained maintainer engagement, the attraction and retention of contributors, and the conversion of newcomers into core developers.

    “OSS sustainability is a project's ability to continuously generate the labor required to maintain it, through sustained maintainer engagement, the attraction and retention of contributors, and the conversion of newcomers into core developers [6], [19].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [6]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [19]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S1 (asserted), S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Interpretationnone given

    AI-DDoS is produced by individual contributors misusing AI.

    “It is produced not only by individual contributors misusing AI, but also from platform incentives that reward visible activity [56]”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    AI-DDoS is not only a contribution-volume problem but a sustainability trap: communities often default to low-effort defensive strategies that protect short-term review capacity while making openness difficult to sustain.

    “Our findings show that AI-DDoS is not only a contributionvolume problem but a sustainability trap: communities often default to low-effort defensive strategies that protect short-term review capacity while making openness difficult to sustain.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The survey of 229 OSS practitioners is representative of the broader OSS community.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductcitation

    Data saturation was reached after eight interviews, when no new codes emerged, and three additional interviews confirmed saturation and balanced participant perspectives.

    “We reached saturation after eight interviews, when no new codes emerged [73], and conducted three additional interviews to confirm saturation and balance participant perspectives.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [73]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationown data

    One-time issue volume initially declined but rebounded sharply late in the observation window, aligning with the aggregate issue pattern and suggesting that issue-side impacts emerged later.

    “The temporal plot shows that one-time issue volume initially declined but rebounded sharply late in the observation window, aligning with the aggregate issue pattern and suggesting that issue-side impacts emerged later.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The observed deviations from the counterfactual in 2025 are attributable to the surge in AI-assisted contributions rather than other concurrent ecosystem-level changes.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationreasoning

    Preservative gates resemble origin-side filters: cheap, familiar, already deployed, but risky.

    “For example, preservative gates resemble origin-side filters: cheap, familiar, already deployed, but risky.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: OSS contributions are social interactions.

  • Classified as probably not a substantial claim.

    Premisecitation

    Reviewing a contribution requires maintainers to assess not only functional correctness, but also architectural fit, test coverage, and long-term maintainability.

    “For example, reviewing a contribution requires maintainers to assess not only functional correctness, but also architectural fit, test coverage, and long-term maintainability [26], [27].”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [26]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [27]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    Projects can design questions that are cheap for genuine newcomers who have engaged with the project but costly for volume contributors.

    “Projects can design questions that are cheap for genuine newcomers who have engaged with the project but costly for volume contributors.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given

    Lightweight proof-of-engagement gates will allow OSS communities to ask contributors for small signs of real engagement before maintainers invest review effort.

    “First, lightweight proof-of-engagement”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Study design and conductcitation

    The study uses a Bayesian Structural Time Series (BSTS) causal impact framework to test whether repository-level behaviors changed significantly after widespread AI-assisted contribution emerged.

    “We then use a Bayesian Structural Time Series (BSTS) causal impact framework [58] to test whether repository-level behaviors changed significantly after widespread AI-assisted contribution emerged.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [58]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationreasoning

    As communities close their doors to survive the flood of AI-generated contributions, they cut off the contributor pipeline that renews maintainer labor, turning open projects into closed systems that slowly atrophy through attrition.

    “The first impact is on the projects themselves: as communities close their doors to survive the flood, they cut off the contributor pipeline that renews maintainer labor, turning open projects into closed systems that slowly atrophy through attrition.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    CodeRabbit reports that AI-generated pull requests contain 1.7 times more issues than human-written ones.

    “CodeRabbit reports that AI-generated pull requests contain 1.7 times more issues than human-written ones [37].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [37]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductreasoning

    The three independent sources enable data triangulation, strengthening the credibility of the qualitative findings.

    “These three independent sources enable data triangulation, strengthening the credibility of our qualitative findings.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The three gray literature sources (Reddit, practitioner blogs, and the OSS mentors' mailing list) are independent.

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationreasoning

    Filtering AI-assisted work is the easy part.

    “Filtering AI-assisted work is the easy part.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    GitHub describes 2025 as an OSS 'Eternal September', where rising contribution volume overwhelms human attention and strains trust.

    “GitHub describes 2025 as an OSS”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [2]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationreasoning

    Tools that help maintainers gauge engagement could move automation beyond artifact checks such as whether tests pass or a pull request follows a template.

    “Third, tools that help maintainers gauge engagement could move automation beyond artifact checks such as whether tests pass or a pull request follows a template.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning

    When trust in OSS contributions fails, openness becomes a liability.

    “When that trust fails, openness becomes a liability.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

    Interpretationreasoning

    Crossing proof-of-engagement gates should be easy for genuine newcomers and harder for low-context, high-volume contributors.

    “Crossing these gates should be easy for genuine newcomers and harder for low-context, high-volume contributors.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    Ghostty requires disclosure of AI use, human understanding of submitted code, and sanctions for low-effort AI-generated work.

    “Other projects have responded by adding stronger gates around outside contributions: Ghostty requires disclosure of AI use, human understanding of submitted code, and sanctions for low-effort AI-generated work [3].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [3]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The well-researched onion model describes how contributors move from passive users to active users, patch contributors, and eventually core developers.

    “The well researched”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [20]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [21]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [22]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Today, AI-assisted tools weaken the constraint on producing plausible contributions by making them faster and cheaper to produce, while the labor needed to maintain them remains limited and exhaustible.

    “Today, AI-assisted tools weaken that constraint by making plausible-looking contributions faster and cheaper to produce [29], [30], while the labor needed to maintain them remains limited and exhaustible [25], [31].”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [29]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [30]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [25]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationcitation

    The pattern of support for transformation reflects ORT's organizational growth: communities support transformation when it improves contribution quality, but resist it when it needs high human effort.

    “The pattern reflects ORT's organizational growth, communities support transformation when it improves contribution quality, but resist it when it needs high human effort [74].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [74]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

    Interpretationcitation

    Cross-project reputation, contributor history, and personhood verification may help recognize trustworthy participants earlier.

    “Crossproject reputation, contributor history, and personhood verification may help recognize trustworthy participants earlier [23].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [23]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Despite a rapidly growing body of practitioner accounts describing lived experience with AI-DDoS, there is a lack of empirically grounded understanding of how prevalent AI-DDoS is and how it manifests across ecosystems.

    “However, despite a rapidly growing body of practitioner accounts describing their lived experience with AI-DDoS [9], [12], we lack an empirically grounded understanding of how prevalent it is and how it manifests across ecosystems.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [9]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [12]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning

    Under AI-DDoS, maintainers need support for engagement signals, like whether contributors explain their changes, respond to review, and understand project context.

    “Under AI-DDoS, maintainers also need support for engagement signals, like whether contributors explain their changes, respond to review, and understand project context.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationreasoning

    Triage rotation and community review distribute the review load across more reviewers.

    “Triage rotation and community review distribute the review load across more reviewers.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: OSS contributions are social interactions.

  • May combine two claims.

    Interpretationreasoning

    The impact of AI-assisted contribution pressure is already visible at the level of individual projects, and the responses it provokes reveal a deeper sustainability threat.

    “The impact of the AI-assisted contribution pressure is already visible at the level of individual projects, and the responses it provokes reveal the deeper sustainability threat.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    The findings may not fully generalize to lower-traffic, less active, privately managed, or less newcomer-oriented repositories.

    “However, the findings may not fully generalize to lower-traffic, less active, privately managed, or less newcomer-oriented repositories.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Study design and conductown data

    Placebo tests showed no significant placebo effects for PR-related metrics, but revealed significant placebo effects for issue-related metrics.

    “The tests showed no significant placebo effects for the PR-related metrics, but revealed significant placebo effects for issue-related metrics, which we discuss in Section V.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [67]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    Identity and endorsement provide reputation signals.

    “Identity and endorsement provide reputation signals.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: OSS contributions are social interactions.

  • May combine two claims.

    Premisecitation

    The Linux kernel redirects duplicate AI-generated vulnerability reports away from the private security list and requires AI-assisted contributions to remain transparent and legally accountable through human sign-off and the Assisted-by tag.

    “The Linux kernel has similarly responded to duplicate AI-generated vulnerability reports by redirecting them away from the private security list, while requiring AI-assisted contributions to remain transparent and legally accountable through human sign-off and the Assisted-by tag [9].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [9]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Interpretationreasoning

    Cross-project reputation and identity verification require action at the platform level, which are upstream of any single project.

    “Cross-project reputation and identity verification require action at the platform level, which are upstream of any single project.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: OSS contributions are social interactions.

  • May combine two claims.

    Interpretationcitation

    Coding-assistant tools matured earlier in 2025, likely shaping PR-side behavior first, while agentic tools that scan codebases and generate bug reports are emerging now.

    “Coding-assistant tools matured earlier in 2025, which likely shaped the PR-side behavior first, while agentic tools that scan codebases and generate bug reports are emerging now [70].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [70]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Because AI-DDoS is recent and still unfolding in OSS, gray literature provides timely evidence of early signals, community concerns, and practitioner responses, and has been widely used in empirical software engineering studies.

    “Because AI-DDoS is recent and still unfolding in OSS, gray literature provides timely evidence of early signals, community concerns, and practitioner responses, and has been widely used in empirical SE studies [39], [40].”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [39]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [40]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Rests on an assumption: AI-DDoS is recent and still unfolding in OSS.

  • May combine two claims.

    Study design and conductcitation

    Because individual AI use is not observed directly, 2025 is used as a prespecified detection window, supported by Stage 1 practitioner convergence, broader evidence that AI-assisted development became routine that year, and prior causal impact work.

    “Because we do not observe individual AI use directly, we use 2025 as a prespecified detection window, supported by Stage 1 practitioner convergence, broader evidence that AI-assisted development became routine that year [15], [16], and prior causal impact work [64].”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [15]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [16]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [64]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

    Interpretationreasoning

    The harder challenge is to identify hard-to-fake signals and rebuild the trust that openness depends on.

    “The harder challenge is to identify hard-tofake signals and rebuild the trust that openness depends on.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Premisecitation

    2025 is treated as the intervention boundary, the year in which practitioner reports converged and AI-assisted contribution became a routine part of OSS workflows.

    “We treat 2025 as the intervention boundary, the year in which practitioner reports converged and AI-assisted contribution became a routine part of OSS workflows [15], [16].”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [15]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [16]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

66 of 66

  • The paper relies on this without support.

    AI-DDoS is recent and still unfolding in OSS.

    “Because AI-DDoS is recent and still unfolding in OSS, gray literature provides timely evidence of early signals, community concerns, and practitioner responses, and has been widely used in empirical SE studies [39], [40].”

  • The paper relies on this without support.

    The three gray literature sources (Reddit, practitioner blogs, and the OSS mentors' mailing list) are independent.

    “These three independent sources enable data triangulation, strengthening the credibility of our qualitative findings.”

  • The paper relies on this without support.

    The practitioner accounts from the three gray literature sources are representative of OSS community experiences.

    “These themes show cross-source convergence among the three data sets we analyzed, with a concentration in 2025.”

  • The paper relies on this without support.

    The BSTS counterfactual accurately represents what would have happened without AI adoption, with no other major ecosystem-wide changes in 2025 confounding the analysis.

    “BSTS is well suited to our study because our objective is to estimate the counterfactual trajectory of repository activity following an ecosystem-wide intervention for which no natural comparison group exists.”

  • The paper relies on this without support.

    The survey of 229 OSS practitioners is representative of the broader OSS community.

    “Finally, we identify 11 remediation strategies through practitioners' interviews and validate them with a survey of 229 OSS practitioners, grouping them into preservative, adaptive, and transformative orientations.”

  • The authors state this as an assumption.

    The pre-intervention trends in the metrics would have continued unchanged into 2025 absent the AI-assisted contribution surge.

    “The model learns pre-intervention level without covariates and projects them into the post-intervention period to estimate the expected trajectory had pre-intervention trends continued, following prior studies [63], [64].”

  • The paper relies on this without support.

    The 294 sampled repositories are sufficiently representative of the broader OSS ecosystem to support ecosystem-level conclusions.

    “Therefore, we interpret results from 294 widely visible, active repositories as ecosystem-level evidence rather than direct measurements of individual AI use.”

  • The paper relies on this without support.

    The observed deviations from the counterfactual in 2025 are attributable to the surge in AI-assisted contributions rather than other concurrent ecosystem-level changes.

    “Deviations from this trajectory are consistent with AI-DDoS effects but do not rule out other 2025 ecosystem-level changes, such as platform growth or broader shifts in OSS participation.”

  • The paper relies on this without support.

    The broader software ecosystem depends on individual OSS communities.

    “it is a latent infrastructure risk for the broader software ecosystem that depends on them.”

  • The paper relies on this without support.

    OSS contributions are social interactions.

    “as OSS contributions are social interactions.”
10 of 10

Cites

The publisher hasn’t deposited this paper’s reference list.

Research works printed but not linked: 17

  1. Y. Ye and K. Kishida, "Toward an understanding of the motivation of open source software developers," in ICSE. IEEE, 2003, pp. 419-429.
  2. A. K. Wagner, S. B. Soumerai, F. Zhang, and D. Ross-Degnan, "Segmented regression analysis of interrupted time series studies in medication use research," Journal of clinical pharmacy and therapeutics, vol. 27, no. 4, pp. 299-309, 2002.
  3. J. L. Bernal, S. Cummins, and A. Gasparrini, "Interrupted time series regression for the evaluation of public health interventions: a tutorial," International journal of epidemiology, vol. 46, no. 1, pp. 348-355, 2017.
  4. O. Lenhart, "The effects of paid family leave on food insecu- rity-evidence from california," Review of Economics of the Household, vol. 19, no. 3, pp. 615-639, 2021.
  5. J. Cohen, Statistical Power Analysis for the Behavioral Sciences. New York, NY, USA: Routledge, 2013.
  6. S. K. Basak, L. Neil, B. Reaves, and L. Williams, "What challenges do developers face about checked-in secrets in software artifacts?" in 2023 IEEE/ACM 45th ICSE. IEEE, 2023, pp. 1635-1647.
  7. S. Musa and D. T. Enggarsyah, "Absorptive capacity, organizational creativity, organizational agility, organizational resilience and compet- itive advantage in disruptive environments," Journal of Strategy and Management, vol. 18, no. 2, pp. 303-325, 2025.
  8. C. A. Lengnick-Hall, T. E. Beck, and M. L. Lengnick-Hall, "Developing a capacity for organizational resilience through strategic human resource management," Human resource management review, vol. 21, no. 3, pp. 243-255, 2011.
  9. Z. Feng, T. Zimmermann, L. Pisani, C. Gooley, J. Wander, and A. Sarma, "When domains collide: An activity theory exploration of cross-disciplinary collaboration," in ESEM. IEEE, 2025, pp. 301-312.
  10. B. Marcus and A. Schütz, "Who are the people reluctant to participate in research? personality correlates of four different types of nonresponse as inferred from self-and observer ratings," Journal of personality, vol. 73, no. 4, pp. 959-984, 2005.
  11. S. G. Rogelberg, J. M. Conway, M. E. Sederburg, C. Spitzmüller, S. Aziz, and W. E. Knight, "Profiling active and passive nonrespondents to an organizational survey." Journal of Applied Psychology, vol. 88, no. 6, p. 1104, 2003.
  12. A. J. Onwuegbuzie and N. L. Leech, "Validity and qualitative research: An oxymoron?" Quality & quantity, vol. 41, no. 2, pp. 233-249, 2007.
  13. T. Mahjabin, Y. Xiao, G. Sun, and W. Jiang, "A survey of distributed denial-of-service attack, prevention, and mitigation techniques," IJDSN, vol. 13, no. 12, p. 1550147717741463, 2017.
  14. S. T. Zargar, J. Joshi, and D. Tipper, "A survey of defense mechanisms against distributed denial of service (ddos) flooding attacks," IEEE communications surveys & tutorials, vol. 15, no. 4, pp. 2046-2069, 2013.
  15. M. Yoon, "Using whitelisting to mitigate ddos attacks on critical internet sites," IEEE Communications Magazine, vol. 48, no. 7, pp. 110-115, 2010.
  16. M. Belyaev and S. Gaivoronski, "Towards load balancing in sdn- networks during ddos-attacks," in MoNeTeC. IEEE, 2014, pp. 1-6.
  17. G. Somani, M. S. Gaur, D. Sanghi, M. Conti, and M. Rajarajan, "Scale inside-out: Rapid mitigation of cloud ddos attacks," TDSC, vol. 15, no. 6, pp. 959-973, 2017.

Cited by

Sorted by citations

Related

Authors
Afroz, S., Miller, C., Menezes, T., Gilmour, E., Sarma, A., & Feng, Z.
Affiliations
  • Oregon State University (US)
  • George Washington University (US)
  • CodeDay (US)
  • Virginia Commonwealth University (US)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2026
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2607.04003
arXiv
2607.04003
OpenAlex
W7167601810
Semantic Scholar
56b633fcfd63e41482f51ba2a35d056b62480e64
Cited by
1
References
0
Citations by year
2026: 1
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Topics
  • Physical Sciences › Computer Science › Computer Science Applications › Open Source Software Innovations
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Research
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
Keywords
open source software, open source sustainability, generative AI, community capacity, remediation strategies, contribution quality, open source communities

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-11-02.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-11-02.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review