"AI Slop is DDoSing Open Source": Understanding the Impact of AI-Generated Contributions on Open Source Sustainability

Abstract: Open source software (OSS) communities are facing increasing pressure from Generative AI (GenAI) tools. We call it AI-DDoS: a denial-of-service effect in which plausible but low-quality AI-generated contributions overwhelm OSS community capacity. Using a phenomenon-based mixed-methods approach, we first analyze practitioner accounts from Reddit, OSS mentor mailing lists, and blogs to identify six recurring themes and derive hypotheses. We then evaluate these hypotheses using Bayesian Structural Time Series analysis across 294 repositories with over 2 million pull requests and issues. Our results show that while PR volume increased in 2025, merge rates declined, with one-time contributors experiencing an 18.18% drop in PR merge rates relative to the counterfactual. Finally, we identify 11 remediation strategies through practitioners' interviews and validate them with a survey of 229 OSS practitioners, grouping them into preservative, adaptive, and transformative orientations. Our findings show that AI-DDoS is not only a contribution-volume problem but a sustainability trap: communities often default to low-effort defensive strategies that protect short-term review capacity while making openness difficult to sustain.

• The paper shows that AI-generated contributions create a flood that overwhelms maintainers, significantly reducing one-time contributor merge rates.
• It employs a mixed-methods approach combining Bayesian causal inference on 2 million submissions with qualitative interviews from 294 repositories.
• The study outlines remediation strategies ranging from low-effort automated gating to transformative engagement measures, balancing short-term defenses with long-term sustainability.

The Impact of AI-Generated Contributions on Open Source Sustainability: An Expert Analysis

Introduction: Framing AI-DDoS as a Structural Threat

The proliferation of generative AI (GenAI) tools has initiated a structural transformation in open source software (OSS) ecosystems, notably altering the economics of contribution and review. The study "AI Slop is DDoSing Open Source": Understanding the Impact of AI-Generated Contributions on Open Source Sustainability (2607.04003) advances the term "AI-DDoS" to underscore a denial-of-service analogy: OSS maintainers are overwhelmed by a surge of plausible but low-quality AI-generated contributions, leading to review gridlock and threatening the sustainability of open collaboration itself.

The authors pursue a phenomenon-based, mixed-methods approach, triangulating practitioner accounts from gray literature and systematic interviews, and combining this with Bayesian causal inference on contribution data at scale. This dual perspective positions the work as both a conceptual and empirical advance in understanding and responding to AI-borne pressure in OSS.

Figure 1: Overview of contribution flow, illustrating the dramatic post-2025 increase in AI-generated contributions and a corresponding decline in accepted submissions.

Qualitative and Quantitative Manifestations of AI-DDoS

Thematic Synthesis:

Practitioner narratives spanning Reddit, curated blogs, and major OSS mentors' mailing lists coalesce around six recurrent themes: submission volume overload, collapse in submission quality, transient "drive-by" contributors, incentive misalignments, maintainer burnout, and defensive (often exclusionary) responses. The longitudinal analysis reveals that projects experience a temporal sequence: initial submission flood, quality degradation, maintainer strain, and, ultimately, a contraction of openness through workflow hardening or outright closure to external contributors.

Bayesian Causal Impact:

Large-scale data analysis of 294 major OSS repositories encompassing over 2 million PRs and issues between 2023–2025 empirically substantiates these practitioner reports. The 2025 inflection is pinpointed as the intervention year, marking widespread GenAI adoption. Bayesian Structural Time Series (BSTS) modeling robustly identifies several significant, ecosystem-scale effects:

• PR volume increased by 6.8% ($p>0.999$), equating to ~27,000 excess PRs over one year.
• PR merge rates declined by 1.06% overall, with a pronounced 18.18% drop in merge rates for one-time contributors.
• Issue completion rates similarly fell (3.4% overall; 10.3% for one-time contributors).
• The burden is not limited to low-participation contributors: recurring contributors exhibited increased submission rates but also declining acceptance, indicating systemic pressure.

Notably, the one-time contributor merge rate reduction (Cohen's $d=2.84$) presents as the strongest effect, characterizing AI-DDoS as both a quantitative volume problem and a quality signal problem within existing trust and gatekeeping mechanisms.

Patterns of Remediation: Preservation, Adaptation, Transformation

Through theory-driven practitioner interviews and a survey of 229 OSS participants, the authors distill 11 remediation strategies and categorize them according to Organizational Resilience Theory (ORT):

• Preservative: Automated CI/test gating and no-review cutoffs for red-flagged submissions, widely adopted due to minimal infrastructure demands.
• Adaptive: AI-use disclosure, intent clarification, heuristic risk flagging, and selective AI-assisted review. Support here is divided; efforts are contingent on project and maintainer resources.
• Transformative: Mandating contributor understanding, project-mission-aligned AI policies, intent-centric review, and identity/endorsement requirements. These high-effort strategies are less universally endorsed, reflecting the inherent tension between openness and security.

Figure 2: AI-DDoS disruption and remediation framed through Organizational Resilience Theory: defensive strategies risk rigidity traps, while adaptive and transformative measures open paths for organizational growth.

Endorsement and Effort Dynamics

Low-effort preservation is preferred, with >70% endorsement for basic gating and early rejections. More invasive, coordination-heavy approaches (e.g., requiring identity verification or shifting to intent-based review) are least favored. Adaptive strategies such as lightweight AI-use disclosure split the difference, being both practical and context-sensitive. The polarization away from high-effort, high-restriction governance highlights a tradeoff: short-term survivability versus long-term erosion of contributor pathways and systemic openness.

Implications and Future Directions

Practical Implications

The empirical evidence that maintainers respond with defensive closure highlights a classic rigidity trap: minimizing short-term review effort by constricting participation, with long-term consequences for OSS health and contributor renewal. The sustainability of OSS, contingent on the perpetual onboarding and retention of new contributors, is jeopardized by strategies that inadvertently atrophy its labor pipeline.

Theoretical Implications

This work contributes a conceptual bridge between DDoS mitigation in technical systems and trust/reputation management in distributed socio-technical ecosystems. The application of ORT and explicit analogy to layered DDoS remedies (verification, engagement gating, reputational endorsements) provide a theoretical substrate for cross-pollination between cyber-defense and OSS governance.

Future Research Trajectories

• Development of engagement gates: Systems that require cost-signaling or demonstration of project-specific understanding, cheap for genuine humans but costly for high-volume AI-driven contributors.
• Portable cross-project trust signals: Reputation or endorsement mechanisms that avoid the need for per-project cold starts, but do not fully close the ecosystem.
• Instrumentation of engagement quality: Tooling that moves beyond artifact checks, potentially leveraging interaction/response metrics as hard-to-fake engagement proxies, while remaining robust to adversarial adaptation by LLMs and agents.

Conclusion

This study establishes that AI-generated "slop" constitutes not just an operational nuisance but an ecosystem-level sustainability risk for OSS. Defensive, low-effort strategies dominate for now, but threaten the foundational openness and renewal mechanisms of open source. Steering the OSS community away from the rigidity trap of defensive closure, and towards multifaceted, socio-technical resilience, will require upstream platform adjustments and new engagement infrastructures. The challenge for researchers and practitioners alike is to design mitigation mechanisms that preserve the core values of OSS while maintaining its viability in the AI-augmented era.