Flood of AI-generated slop security reports and PRs overwhelms open source maintainers

Reported 25 Sep 2026 · entered the ledger 28 Sep 2026 · last checked 28 Sep 2026 · Side effect

GitHub rolled out repository controls enabling maintainers to disable pull requests entirely, restrict PRs to collaborators, and cap open PRs per external user after generative AI triggered a surge in low-quality contributions, issues, and comments that overwhelmed volunteer maintainer triage capacity.

The institution Open-source maintainers group

The mechanism Friction removed externality scale 4 of 5, fast

Adaptation tie submissions are tied to a person

The case as the ledger holds it

The assumption that broke: Filing a security vulnerability report or pull request requires human effort to find, verify, and document an issue, serving as a natural filter that made review feasible for unpaid maintainers.
The first-order effect: Maintainers faced a sharp rise in low-quality PRs, issues, comments, and reports generated via AI, forcing repository hosts to introduce blunt controls to turn off public PRs or restrict open contributions to pre-approved collaborators.
Who pays: Open-source maintainers whose volunteer time is drained triaging synthetic submissions, and legitimate new contributors locked out as repositories restrict PRs to existing collaborators. · group: Volunteers and reviewers
Scale and speed: 4 of 5 · fast

Evidence 2 pages read

X (@izs) ↗ 25 Sep 2026 · social source, review
Like, idk what yall are seeing, but I’m getting 5-20 security reports and pull requests per day, roughly 100% of which are invalid, all of them accompanied by 10 paragraphs of hallucinated breathless exuberance about how important they are. Not reasonable to process.
GitHub ↗ 29 May 2026
It’s become drastically easier to generate pull requests, issues, comments, and reports, but the work required to review them still depends on limited maintainer time and attention. As contribution volume rises, the pressure on maintainers rises with it. Generative AI has accelerated this shift, but the underlying challenge is broader than AI alone.

The second reader every claim, checked against the page

Claim	Verdict	Note
[fact] Earlier this year, GitHub opened a discussion about 'AI Slop at Scale' and a flood of low-quality contributions that existing tools were not built to handle.	supported	Page 1: "### The Problem: AI Slop at Scale" and "Earlier this year, we opened a discussion about a trend that's been making maintainers' lives harder: a flood of low-quality contributions that existing tools and workflows weren't built to handle."
[quote] "It’s become drastically easier to generate pull requests, issues, comments, and reports, but the work required to review them still depends on limited maintainer time and attention."	supported	Page 1: "It’s become drastically easier to generate pull requests, issues, comments, and reports, but the work required to review them still depends on limited maintainer time and attention." — verbatim match.
[fact] GitHub shipped features allowing maintainers to disable pull requests entirely on a repository or restrict PRs to collaborators only.	supported	Page 1, "What We've Already Shipped": "Disable PRs entirely on a repo" and "Restrict PRs to collaborators only".
[fact] GitHub introduced options to disable commit comments at user, repository, and organization levels, and to flag comments as 'low quality'.	supported	Page 1: "Disable commit comments on 3 levels: the user level, the repo level, the org level" and "Hide comments as low quality".
[fact] GitHub developed per-repository caps on concurrent open PRs and issues for users without write access, alongside bypass lists for trusted contributors.	supported	Page 1 roadmap: "PR Limits + Bypass list (shipping soon)... a per-repository cap on the number of concurrent open PRs a user without write access can have... Maintainers can create a bypass list"; "Per-repository issue caps - Maintainers will be able to limit how many open issues a user without write access can have at a time. As with PR limits, trusted contributors can be added to a bypass list."
[date] 2026-05-29	supported	Page 1: discussion posted "on May 29May 29, 2026".
[quote] The flood of low value slop reports and PRs are causing open source maintainers to just shrug and give up. No matter how well intended, it’s a DDoS.	supported	Page 2 post: "The biggest computer security problem caused by AI is that the flood of low value slop reports and PRs are causing open source maintainers to just shrug and give up. No matter how well intended, it’s a DDoS." — quoted portion is verbatim.
[quote] I’m getting 5-20 security reports and pull requests per day, roughly 100% of which are invalid, all of them accompanied by 10 paragraphs of hallucinated breathless exuberance about how important they are.	supported	Page 2 thread post 1: "Like, idk what yall are seeing, but I’m getting 5-20 security reports and pull requests per day, roughly 100% of which are invalid, all of them accompanied by 10 paragraphs of hallucinated breathless exuberance about how important they are."
[quote] I’ve been closing without review and blocking the spammers, but I’m about to just start skipping the inbox and let GitHub stay a litter pile. Which also means: no more legitimate security fixes	supported	Page 2 thread post 2: "I’ve been closing without review and blocking the spammers, but I’m about to just start skipping the inbox and let GitHub stay a litter pile. Which also means: no more legitimate security fixes 🤷" — quoted text matches apart from the trailing emoji.
[date] 2026-09-25	supported	Page 2: "Posted: 2026-09-25T13:59:46.000Z".