CoChat
Sign Up
PreprintCited by 2Software Engineering ResearchOpen Source Software InnovationsSoftware Engineering Techniques and Practices

"We Permit the Use of AI, but [...]": The Landscape of AI Policies in Popular Open Source Projects

Open access
Hora, Andre, Robbes, Romain, Zacchiroli, Stefano·2026·arXiv
DOI 10.48550/arxiv.2609.07542arXiv 2609.07542
Open this paper in CoChat — free accountOpen PDF

Abstract

Open source communities are converging on a new governance artifact: the AI contribution policy. These policies barely existed a few months ago and are now being written and adopted. We analyzed 281 AI contribution policies, and manually classified them along the six dimensions; to study how policies change, we also tracked 92 dedicated AI policy files over time. We answer four research questions on (1) AI usage allowance, (2) AI disclosure practices, (3) AI slop countermeasures, and (4) AI policy evolution. We find that, first, permission is the norm rather than the exception: 83.3% of policies permit or encourage AI in code contributions. But permission comes with conditions, as 67.3% require a high level of human involvement and 43.4% assign accountability. Second, AI disclosure is required by 48.8% of policies, most often in pull request descriptions and commit messages, but what must be disclosed varies widely. Third, we identify ten countermeasures against AI slop, targeting pull requests, users, and autonomous agents. Finally, policies are not static: half of the dedicated AI policy files have already been revised since creation. Our results give maintainers and researchers a baseline and a labeled corpus for studying the impact of AI policies.

AI snapshot

Written from the paper’s full text.

TL;DR

Analyzing 281 AI contribution policies from popular GitHub repositories, this paper finds that permission is the norm: 83.3% permit or encourage AI in code contributions, but usually with conditions such as human involvement and disclosure. Policies are new and evolving, with no cross-project standard for AI disclosure and ten countermeasures emerging against AI slop.

Key findings

  • AI use in code contributions is permitted or encouraged by 83.3% of policies and forbidden by 14.9%; 67.3% require high human involvement and 43.4% assign accountability to the human contributor. Guidance is concentrated on code contributions (98.2%), with much less on communication (42.3%) and issues/bugs/security (31.3%).
  • AI disclosure is required by 48.8% of policies, explicitly not required by 4.6%, and unaddressed by 46.6%. Where locations are named, PR descriptions (64.7%) and commit messages (26.7%) dominate; required content includes a description of AI usage (46%), AI agent name (32.8%), extent of AI usage (13%), and model version (7.4%).
  • The paper identifies ten AI slop countermeasures; among 188 observed, the most common are aggressively closing PRs (48.4%), banning/blocking users (20.8%), and disallowing fully autonomous agents (13.8%).
  • Policies are not static: among 92 dedicated AI policy files, 51% were revised at least once; 8 were created in 2025 versus 84 in 2026, and 196 commits were analyzed. Revision rationales include improving AI quality controls, disclosure rules, human accountability, policy visibility, restricting AI usage, and expanding scope.

Methods

  • The authors analyzed the top 2,000 GitHub repositories by stars meeting activity criteria (at least 100 commits, not forks, at least one commit in 2026), complemented by 36 well-known projects/organizations, and identified 281 AI contribution policies from dedicated AI policy files, contribution guidelines, and agent configuration files.
  • Three authors manually classified every policy along six dimensions (code contributions, communication, issues/bugs/security, AI disclosure obligations, accountability, human involvement); inter-rater agreement was 90% on 180 labels from 30 randomly selected policies.
  • For policy evolution, they tracked 92 dedicated AI policy files across the top 10,000 repositories and analyzed 196 commits and their messages.

Limitations

  • The paper states that detection may miss AI policies, though using dedicated files, contribution guidelines, and agent configuration files reduces false negatives; manual classification risk was mitigated by 90% agreement and consensus discussion.
  • The paper states that results cannot be directly generalized to repositories in other programming languages or to closed-source projects, since the sample is popular, active GitHub repositories (median 27.2K stars, 7.2K commits, 328 contributors; 23 languages).
  • The text makes evident that the study characterizes written policies, not whether they are followed in practice; the authors note future work to explore whether AI policies are actually followed and how countermeasures affect legitimate contributors.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2609.07542

Cites

0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 37 cited sources checked · 0 supported · 0 flagged

  • Findingown data

    14.9% of the AI policies analyzed forbid the use of AI in code contributions.

    “14.9% of the AI policies we analyze forbid the use of AI in code contributions”
    • Also stated in: § 2.4.4 AI Policy Evolution. · plain
      “We detected that 42 (14.9%)AI policies forbid the use of generative AI for code contribution.”
    • Also stated in: § 2.4.4 AI Policy Evolution. · plain
      “Finding 2: 83.3% of the AI policies permit or encourage the usage of AI in code contributions, while 14.9% explicitly forbid it.”
    Quote in the paperSubstantial claim
  • Findingown data

    48.8% of AI policies require disclosure of AI usage.

    “48.8% require disclosure of AI usage”
    • Also stated in: § Contributions. · plain
      “Nearly half of the policies (48.8%) require contributors to disclose AI usage”
    • Also stated in: § Yes · plain
      “We found AI disclosure obligation in 48.8% (137) of the AI policies.”
    • Also stated in: § 10 Conclusion · plain
      “48.8% require disclosure of AI usage”
    • Also stated in: § 10 Conclusion · plain
      “AI disclosure is required by 48.8% of policies”
    Quote in the paperSubstantial claim
  • Findingown data

    Disallowing fully autonomous agents is among the most frequent countermeasures observed.

    “disallowing fully autonomous agents is among the most frequent countermeasures we observe.”
    Quote in the paperSubstantial claim
  • Findingown data

    67.3% of AI policies require a high level of human involvement.

    “67.3% require a high level of human involvement”
    • Also stated in: § 3.3 Human Involvement and Accountability · plain
      “67.3% (189) of the AI policies mention that a high level of human involvement is required in the contribution process.”
    • Also stated in: § 3.3 Human Involvement and Accountability · plain
      “Finding 3: Most AI policies (67.3%) require a high level of human involvement in the contribution process, for example, by reviewing, testing, or answering questions.”
    • Also stated in: § 10 Conclusion · plain
      “67.3% require a high level of human involvement”
    Quote in the paperSubstantial claim
  • Findingown data

    A new kind of artifact has appeared in open source repositories over the past 18 months, the AI contribution policy.

    “A new kind of artifact has appeared in open source repositories over the past 18 months, the AI contribution policy, or AI policy for short.”
    Quote in the paperSubstantial claim
  • May combine two claims. 42
  • Classified as probably not a substantial claim. 24

  • May combine two claims.

    Findingown data

    We analyzed the 2,000 most popular GitHub repositories, complemented by 36 well-known projects and organizations, and identified 281 AI contribution policies.

    “we analyzed the 2,000 most popular GitHub repositories, complemented by 36 well-known projects and organizations such as the Apache Software Foundation, the Linux kernel, and LLVM, and identified 281 AI contribution policies”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The 2,000 most popular GitHub repositories plus 36 well-known projects/organizations are representative of open source projects generally.

  • May combine two claims.

    Findingown data

    We tracked 92 dedicated AI policy files across the top 10,000 repositories and analyzed the 196 commits that created and modified them.

    “we additionally tracked 92 dedicated AI policy files across the top 10,000 repositories and analyzed the 196 commits that created and modified them.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The 92 dedicated AI policy files from the top 10,000 repositories are representative of AI policy evolution.
    • Rests on an assumption: The 196 commits analyzed are representative of policy changes.

  • May combine two claims.

    Findingown data

    Of the 188 countermeasures observed, the three most common are aggressively closing pull requests (48.4%), banning or blocking users (20.8%), and disallowing fully autonomous agents (13.8%).

    “of the 188 countermeasures we observe, the three most common are aggressively closing pull requests (48.4%), banning or blocking users (20.8%), and disallowing fully autonomous agents (13.8%).”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    AI policies were updated to defend against AI slop, make contribution requirements stricter, and clarify the consequences of policy violations.

    “For example, we found cases in which AI policies were updated to defend against AI slop, make contribution requirements stricter, and clarify the consequences of policy violations.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    The analyzed repositories encompass 23 distinct programming languages, with a median of 27.2K stars, 7.2K commits, and 328 contributors.

    “Overall, the selected repositories encompass 23 distinct programming languages, with a median of 27.2K stars, 7.2K commits, and 328 contributors.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    The most common AI slop countermeasures are aggressively closing pull requests, banning users, and disallowing fully autonomous agents.

    “the most common being aggressively closing pull requests, banning users, and disallowing fully autonomous agents”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingcitation

    In some AI policies, AI disclosure is not explicitly required, so contributors are not necessarily obliged to disclose their use of AI.

    “In some cases, AI disclosure is not explicitly required, meaning that contributors are not necessarily obliged to disclose their use of AI.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    We identified 1,428 repositories with contribution guideline files, of which 317 included generative AI-related terms.

    “In total, we identified 1,428 repositories with contribution guideline files, of which 317 included generative AI-related terms.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Project maintainers may require AI disclosure in different artifacts, such as PR descriptions and commit messages, or leave it unclear where such disclosures should be provided.

    “Our RQ2 showed that project maintainers may require AI disclosure in different artifacts, such as PR descriptions and commit messages, or leave it unclear where such disclosures should be provided.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    We detected 775 repositories with agent configuration files, of which 118 included the policy term.

    “In total, we detected 775 repositories with agent configuration files, of which 118 included the policy term.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Only 8 AI policies were created in 2025, while 84 out of 92 were created in 2026.

    “Figure 5a shows that only 8 AI policies were created in 2025, while the majority were created in 2026 (84 out of 92).”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    AI contribution policies are not static but evolve over time for multiple reasons, including improving AI quality control, improving AI disclosure rules, enforcing human accountability, improving AI policy visibility, restricting AI usage, and expanding their scope.

    “Finding 7: AI contribution policies are not static but evolve over time for multiple reasons, including improving AI quality control, improving AI disclosure rules, enforcing human accountability, improving AI policy visibility, restricting AI usage, and expanding their scope.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    In RQ3, autonomous agents appeared in two countermeasures against AI slop: disallowing autonomous agents and adding agent instructions.

    “In RQ3, autonomous agents appeared in two countermeasures against AI slop: disallowing autonomous agents and adding agent instructions.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    RQ4 confirms that AI policies are improving over time, with contributors making guidance on disclosure, accountability, and policy scope clearer.

    “As a positive finding, RQ4 confirms that AI policies are improving over time, with contributors making guidance on disclosure, accountability, and policy scope clearer.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Findingown data

    AI policy revisions aim to enforce human accountability.

    “enforce human accountability”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    The Linux kernel AI policy has recently removed the requirement to disclose model names in commit messages to avoid free advertising to proprietary software companies.

    “The AI policy of the Linux kernel has recently removed the requirement to disclose model names in commit messages to”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data

    AI policy revisions aim to tighten quality controls.

    “to tighten quality controls”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    Projects also restrict new or external contributors, cap the number of pull requests, and publicly denounce offenders (name and shame).

    “Projects also restrict new or external contributors, cap the number of pull requests, and publicly denounce offenders (”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    Among the 281 AI policies, 214 (76.2%) permit AI for code contributions, 42 (14.9%) forbid it, 20 (7.1%) encourage it, and 5 (1.8%) provide no guidance.

    “214 (76.2%) 42 (14.9%)20 (7.1%) 5 (1.8%) Code Contributions None Forbidden Permitted Encouraged”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    The most common AI policy combines guidance on contributions, human involvement, AI disclosure, and accountability, while lacking information on communication and issues/bugs/security.

    “Indeed, our UpSet visualization (Figure 1) shows that the most common AI policy combines guidance on contributions, human involvement, AI disclosure, and accountability, while lacking information on communication and issues/bugs/security.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    In RQ4, autonomous agents emerged as a rationale for updating AI policies, with maintainers changing policies to restrict AI usage.

    “In RQ4, autonomous agents emerged as a rationale for updating AI policies, with maintainers changing policies to restrict AI usage.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    These systems are implemented in 23 distinct programming languages; the top-5 languages are Python (49), TypeScript (42), Rust (40), Go (28), and C++ (25).

    “These system are implemented in 23 distinct programming languages; the top-5 languages are Python (49), TypeScript (42), Rust (40), Go (28), and C++ (25).”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    The three most common countermeasures are closing pull requests, banning/blocking users, and disallowing autonomous agents.

    “The three most common countermeasures are closing pull requests, banning/blocking users, and disallowing autonomous agents.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Maintainers revise AI policies to tighten AI quality controls, clarify disclosure rules, enforce human accountability, make the policy more visible, restrict AI usage, and expand the policy's scope to new activities such as AI-generated reviews.

    “Maintainers revise them to tighten AI quality controls, clarify disclosure rules, enforce human accountability, make the policy more visible, restrict AI usage, and expand the policy's scope to new activities such as AIgenerated reviews.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Despite the generally positive stance toward AI usage in most AI policies, autonomous agents (e.g., OpenClaw) remain largely forbidden.

    “These finding reinforces that, despite the generally positive case toward AI usage in most AI policies, autonomous agents (e.g., OpenClaw) remain largely forbidden.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    The 31 commit messages explaining AI policy changes fall into six categories: Improving AI Quality Controls (8), Improving AI Disclosure Rules (7), Enforcing Human Accountability (5), Improving AI Policy Visibility (5), Restricting AI Usage (3), and Expanding AI Policy Scope (3).

    “Table 5 presents these rationales, divided into six categories: Improving AI Quality Controls (8 commits), Improving AI Disclosure Rules (7 commits), Enforcing Human Accountability (5 commits), Improving AI Policy Visibility (5 commits), Restricting AI Usage (3 commits), and Expanding AI Policy Scope (3 commits).”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data

    AI policy revisions aim to clarify disclosure rules.

    “clarify disclosure rules”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    The median repository with an AI policy has 27.2K stars, 7.2K commits, and 328 contributors.

    “On the median, these repositories have 27.2K stars (first quartile: 19.3K; third quartile: 44.3k), 7.2K commits (first quartile: 2.6K; third quartile: 15.8K), and 328 contributors (first quartile: 182.5; third quartile: 407).”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    Other AI slop countermeasures include restricting new/external users, requiring prior PR approval, adding agent instructions, limiting the number of PRs, and denouncing users.

    “Other cases include restricting new/external users, requiring prior PR approval, adding agent instructions, limiting the number of PRs, and denouncing users.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    When present, communication is more often restricted than permitted: 27.8% of AI policies prohibit communication with AI, whereas only 13.9% explicitly permit it.

    “Another interesting finding is that, when present, communication is more often restricted than permitted: 27.8% of AI policies prohibit communication with AI, whereas only 13.9% explicitly permit it.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    Of the disclosure content requirements, a description of AI usage accounts for 46%, the name of the AI agent for 32.8%, and the extent of AI usage for 13%.

    “of the requirements they state, a description of AI usage accounts for 46%, the name of the AI agent for 32.8%, and the extent of AI usage for 13%”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given

    For maintainers, writing a policy currently means guessing: there is no peer baseline describing what comparable projects require, nor evidence about which requirements are common enough that contributors will recognize them.

    “For maintainers, writing a policy currently means guessing: there is no peer baseline describing what comparable projects require, nor evidence about which requirements are common enough that contributors will recognize them.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Study design and conductown data

    The three authors manually classified every policy along the six dimensions of a classification scheme, with an overall agreement of 90% on a jointly classified sample.

    “The three authors manually classified every policy along the six dimensions of a classification scheme we built for this purpose, with an overall agreement of 90% on a jointly classified sample.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given

    For contributors, the expectations attached to AI-assisted work are largely unwritten and vary from project to project, so that following one project's rules may mean violating another's inadvertently.

    “For contributors, the expectations attached to AI-assisted work are largely unwritten and vary from project to project, so that following one project's rules may mean violating another's inadvertently.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Premisecitation

    Generative AI is transforming how software is designed, developed, and engineered.

    “Generative AI (GenAI) is transforming how software is designed, developed, and engineered [12,17].”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [12]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [17]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Classified as probably not a substantial claim.

    Premisereasoning

    Traditional open source development assumes authorship can be attributed and vouched for.

    “that authorship can be attributed and vouched for-as artifacts like the Developer Certificate of Origin (DCO)foot_0 make explicit”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data

    Less visible, but far more common, is a quieter response: projects are writing their rules down.

    “Less visible, but far more common, is a quieter response: projects are writing their rules down.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Premisecitation

    Maintainers report an endless stream of AI-generated pull requests and bug reports that are plausible on the surface but worthless on inspection, known as AI slop: low-quality content produced at scale using AI.

    “Maintainers report an endless stream of AI-generated pull requests and bug reports that are plausible on the surface but worthless on inspection, a phenomenon that has come to be known as”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [31]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [4]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [5]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    Traditional open source development assumes a patch has a human author who understands it.

    “Traditional open source development rests on assumptions about who contributes and how: that a patch has a human author who understands it”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    Coding agents such as Claude Code and Codex operate with a high degree of autonomy, can invoke external tools, execute code, and complete development tasks end-to-end.

    “Coding agents such as Claude Code and Codex operate with a high degree of autonomy: they can invoke external tools, execute code, and complete development tasks end-to-end [28].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [28]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationreasoning

    The AI contribution policy convention is being formed right now, in public, and can be observed while it forms rather than reconstructed afterward.

    “The timing here is singular: this convention is being formed right now, in public; we can observe it while it forms rather than reconstructing it after the fact.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    Traditional open source development assumes reviewer attention is a scarce, often volunteer-funded resource that a contributor's own effort is expected to repay.

    “that reviewer attention is a scarce, often volunteer-funded resource that a contributor's own effort is expected to repay.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationnone given

    For tool and platform builders, there is no disclosure convention to target; projects disagree even on the mechanics, some requiring a Git commit message trailer such as Assisted-by while others explicitly forbid the Co-authored-by trailer.

    “For tool and platform builders, there is no disclosure convention to target; projects disagree even on the mechanics, some requiring a Git commit message trailer such as Assisted-by while others explicitly forbid the Co-authored-by trailer that some coding agents emit by default.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    For researchers, mining contributions supported by AI at scale depends on the traces that disclosure rules produce, thus those rules dictate what can be measured.

    “For researchers, the impact is methodological: mining contributions supported by AI at scale depends on the traces that disclosure rules produce, thus, those rules dictate what can be measured in the first place [28].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [28]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Contribution guidelines and codes of conduct also began as ad hoc documents in individual projects before consolidating into conventions with recognizable names, locations, and structures.

    “Contribution guidelines and codes of conduct also began as ad hoc documents in individual projects before consolidating into conventions with recognizable names, locations, and structures [34,10,11].”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [34]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [10]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [11]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning

    These cases have shaped a widely held impression that open source is turning against AI.

    “These are the cases that reach a wide audience, and they have shaped a widely held impression that open source is turning against AI.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Due to the ease of generating code, open source projects are experiencing growth in contributions.

    “Due to the ease of generating code, open source projects are experiencing growth in contributions [32,23,37,4].”
    Quote in the paperNot a substantial claim0 of 4 sources checked
    • cites [32]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [23]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [37]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [4]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    An UpSet visualization is similar to a Venn diagram, but scales better as the number of categories increases.

    “An UpSet visualization is similar to a Venn diagram, but scales better as the number of categories increases[19].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [19]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning

    Permission to use AI does not imply that AI should be used indiscriminately.

    “However, it is important to emphasize that permission does not imply that AI should be used indiscriminately.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationown data

    Contributors should be able to perform multiple tasks related to their AI-assisted contribution, including understanding, reviewing, explaining, testing, answering questions, and ensuring quality.

    “contributors should be able to perform multiple tasks related to their AI-assisted contribution, including understanding, reviewing, explaining, testing, answering questions, and ensuring quality.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Study design and conductnone given

    The findings cannot be directly generalized to repositories written in other programming languages or to closed-source projects.

    “Despite these observations, our findings, as is common in empirical software engineering, cannot be directly generalized to repositories written in other programming languages or to closed-source projects.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Study design and conductown data

    To evaluate agreement, we randomly selected 30 AI policies, and two authors independently classified the six dimensions, resulting in 180 classifications and an overall agreement of 90% (162 out of 180).

    “This resulted in 180 classifications (30 AI policies × 6 dimensions) and an overall agreement of 90% (162 out of 180).”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationreasoning

    While such AI policies can reduce AI slop, they may also increase friction for legitimate contributors.

    “While such AI policies can reduce AI slop, they may also increase friction for legitimate contributors.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing). May combine two claims.

    Interpretationcitation

    As AI is increasingly contributing to code generation, three-level approaches may become more prevalent across open source projects, providing maintainers with a clearer understanding of the extent of AI involvement and making it harder to omit AI use.

    “As AI is increasingly contributing to code generation [26,27], we foresee that such three-level approaches may become more prevalent across open source projects, providing maintainers with a clearer understanding of the extent of AI involvement in contributions, making it harder to omit AI use.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [26]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [27]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationnone given

    The term 'AI slop' applies equally to software contributions and is perceived as a risk by developers who deploy countermeasures against it.

    “While the term originates from non-software contributions, it applies equally to software, and is perceived as a risk by developers who, consequently, deploy countermeasures against it.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Study design and conductown data

    The authors assessed inter-rater agreement on 180 labels, achieving an overall agreement of 90%, and the remaining cases were discussed until consensus was reached.

    “To mitigate the risk of misclassification, we assessed inter-rater agreement on 180 labels, achieving a overall agreement of 90%; the remaining cases were discussed until consensus was reached.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationown data

    The most characteristic sentence from the corpus is a qualification: we permit the use of AI, but [...].

    “The most characteristic sentence from our corpus is such a qualification:”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Interpretationcitation

    This gap creates research opportunities for developing tools and techniques to identify whether a given artifact was generated/assisted by coding agents or produced by humans.

    “On the other hand, this gap creates research opportunities for developing tools and techniques to identify whether a given artifact was generated/assisted by coding agents or produced by humans [18,24,36,30,3].”
    Quote in the paperNot a substantial claim0 of 5 sources checked
    • cites [18]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [24]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [36]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [30]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [3]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The star metric is primarily adopted in the software mining literature as a proxy of popularity.

    “The star metric is primarily adopted in the software mining literature as a proxy of popularity [6,7].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [6]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [7]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationnone given

    As AI tools evolve, AI policies may become less restrictive in the future, shifting from prohibitions toward guidelines to coding agents.

    “However, as AI tools evolve, AI policies may become less restrictive in the future, shifting from prohibitions toward guidelines to coding agents.”
    Quote in the paperNot a substantial claim
60 of 60

  • The paper relies on this without support.

    The 2,000 most popular GitHub repositories plus 36 well-known projects/organizations are representative of open source projects generally.

    “we selected the top 2,000 repositories from the initial set of repositories.”
    “we added the AI policies of 36 well-known open-projects and organizations”

  • The paper relies on this without support.

    The 92 dedicated AI policy files from the top 10,000 repositories are representative of AI policy evolution.

    “we constructed a second dataset from the top 10,000 repositories in the initial set of repositories.”
    “The final dataset comprises 92 dedicated AI policies for contributors [16].”

  • The paper relies on this without support.

    The six dimensions of the classification scheme capture the relevant aspects of AI contribution policies.

    “We manually classified the 281 AI policies from Dataset 1 with respect to six dimensions: code contributions, communication, issues/bugs/security, AI disclosure obligations, accountability, and level of human involvement.”

  • The paper relies on this without support.

    The commit messages analyzed clearly explain the rationale for changes to AI policies.

    “We then analyzed the commit messages that clearly explained the rationale for the changes.”

  • The paper relies on this without support.

    The 196 commits analyzed are representative of policy changes.

    “we mined the commit history of these files and extracted 196 commit messages.”

  • The paper relies on this without support.

    Commit messages that appear to explain AI policy changes accurately reflect the reasons for those changes.

    “We manually inspected the commit messages to better understand the reasons behind these changes and found 31 messages that clearly explained the changes.”
6 of 6

Cites

The publisher hasn’t deposited this paper’s reference list.

Research works printed but not linked: 2

  1. Baris Ardic, Mitchell Olsthoorn, and Andy Zaidman. 2026. Uncovering AGENTS.md: what testing guidance open source projects provide to coding agents. In International Working Conference on Source Code Analysis and Manipulation (SCAM). IEEE, Benevento, Italy.
  2. Jason Tsay, Laura Dabbish, and James D. Herbsleb. 2014. Influence of social and technical factors for evaluating contribution in GitHub. In International Conference on Software Engineering, ICSE 2014, Hyderabad, India -May 31 -June 07, 2014.

Cited by

Sorted by citations

Related

Authors
Hora, A., Robbes, R., & Zacchiroli, S.
ORCID
Venue
arXiv
Publisher
arXiv
Published
2026
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2609.07542
arXiv
2609.07542
OpenAlex
W7212006957
Semantic Scholar
b97104908c72c0168bfcc0959ac2322956d1e44c
Cited by
0
References
0
Type
posted content
Language
en
Open access
Licence
creativecommons.org/licenses/by/4.0/legalcode
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University) (cc-by)
Funders
  • Coordenação de Aperfeiçoamento de Pessoal de Nível Superior
  • Conselho Nacional de Desenvolvimento Científico e Tecnológico (408817/2024-0)
  • Fundação de Amparo à Pesquisa do Estado de Minas Gerais
  • Université de Bordeaux
  • Instituto Nacional de Ciência e Tecnologia para Engenharia de Software (408817/20240)
Topics
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Research
  • Physical Sciences › Computer Science › Computer Science Applications › Open Source Software Innovations
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
Keywords
open source software, AI governance, AI disclosure, AI slop, human-in-the-loop, accountability, policy evolution, autonomous agents, pull requests, commit messages, open source communities

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-11-02.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-11-02.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review