"We Permit the Use of AI, but [...]": The Landscape of AI Policies in Popular Open Source Projects

Study design

• The authors identified 281 AI contribution policies and manually classified them across six dimensions, with 90% agreement on a jointly classified sample; they tracked 92 dedicated policy files across the top 10,000 repositories and analyzed 196 commits.Source: §1 · p. 2

RQ1 (AI usage allowance)

• 83.3% of policies permit or encourage AI in code contributions, while 14.9% forbid it; 67.3% require high human involvement and 43.4% assign human accountability.Policies address code contributions far more often than communication or issues, bugs, and security; where guidance exists for those activities, it tends toward restriction.Source: §1 · p. 3

RQ2 (AI disclosure practices)

• 48.8% of policies require AI disclosure; named locations favor pull request descriptions (64.7%) over commit messages (26.7%), while required disclosure content has no shared convention.Among specified requirements, 46% ask for a description of AI usage, 32.8% the agent’s name, and 13% the extent of AI usage.Source: §1 · p. 3

RQ3 (AI slop countermeasures)

• The study identifies ten AI-slop countermeasures; among 188 observed measures, the most common are aggressively closing pull requests (48.4%), blocking users (20.8%), and disallowing fully autonomous agents (13.8%).Other measures include restricting new or external contributors, capping pull-request numbers, and publicly denouncing offenders.Source: §1 · p. 3

RQ4 (AI policy evolution)

• 51% of dedicated AI policies have been revised at least once, and revisions lengthen policies while tightening controls, clarifying disclosure, enforcing accountability, and expanding scope.Among 92 dedicated files tracked, 8 were created in 2025 and 84 in 2026.Source: §1 · pp. 2–3

Contributions

• The study provides a peer baseline for maintainers and a labeled corpus for researchers studying AI policies’ impact on open source projects.Its contributions include a six-dimension classification scheme and a taxonomy of ten anti-slop countermeasures.Source: §1 · p. 3

Extension over the conference version

• This paper expands the earlier study from 118 to 281 policies, adds agent-configuration files, extends the first two research questions, and introduces questions on AI slop and policy evolution.It also broadens the examined activities and disclosure dimensions, and adds discussion based on the extended analysis.Source: §1 · p. 4

• Section 2 presents the study design, Sections 3–6 report results, Sections 7–8 discuss findings and limitations, Section 9 reviews related work, and Section 10 concludes the paper.Source: §1 · p. 4
• The dataset is publicly available.Source: §1 · p. 4

2.1 Research Questions

• The four questions examine AI-use guidance, disclosure, AI-slop countermeasures, and whether policies change over time.The study considers guidance for code, communication, and issues, bugs, or security, as well as disclosure locations and content.Source: §2.1 · p. 4

2.2 Initial Set of Repositories

• Repositories were selected from GitHub’s most-starred projects meeting thresholds for commits, fork status, and recent activity.The selection required at least 100 commits, not being a fork, and at least one commit in 2026.Source: §2.2 · p. 4

2.3 Detecting AI Policies

• An AI policy is any set of rules governing contributor AI use; separate datasets address policy content and policy evolution.Dataset 1 supports RQ1–RQ3, while Dataset 2 supports RQ4.Source: §2.3 · p. 5

2.3.1 Dataset 1: AI policies collected from multiple sources.

• Dataset 1 combines policies from multiple sources, yielding 281 policies across 245 repositories after adding policies from 36 well-known projects and organizations.The repositories span 23 programming languages.Source: §2.3.1 · p. 5

2.3.2 Dataset 2: Dedicated AI policies.

• Dataset 2 contains 92 dedicated AI policy files, chosen because their changes directly reflect policy evolution rather than unrelated guideline edits.The study limits this dataset to dedicated policy files to avoid noise from other content in contribution guidelines.Source: §2.3.2 · p. 5

2.4 Protocol to Address the Research Questions

• The authors manually classified 281 policies across six dimensions, with two-author agreement of 90% on a random set of 30 policies.The dimensions cover contribution areas, disclosure, accountability, and human involvement.Source: §2.4.1 · p. 6

2.4.1 AI Usage Allowance.

• Usage guidance was categorized by whether AI use was forbidden, permitted, or encouraged, while human involvement ranged from low to high.High involvement meant required review, understanding, testing, or similar participation; full automation counted as low involvement.Source: §2.4.1 · p. 6

2.4.2 AI Disclosure Location and Content.

• For disclosure, the study recorded both where contributors must disclose AI use and what information policies require them to provide.Examples include disclosure in pull-request descriptions and naming the tool and extent of AI assistance.Source: §2.4.2 · p. 6

2.4.3 AI Slop Countermeasures.

• The authors collected explicit AI-slop rules, including measures such as closing low-quality pull requests and banning repeat submitters.These policy measures were used to identify countermeasures against AI slop.Source: §2.4.3 · p. 6

2.4.4 AI Policy Evolution.

• To study policy evolution, the authors examined 92 dedicated policy files and analyzed commit messages explaining changes.The dataset contained 196 commits; the messages were used to identify reasons for policy changes.Source: §2.4.4 · p. 6

3.1 Overview

• 98.2% address code contributions, compared with 42.3% for communication and 31.3% for issues, bugs, and security.Source: §3.1 · p. 7

3.2 Code Contributions, Communication, and Issues/Bugs/Security

• 83.3% of AI policies permit or encourage AI use in code contributions, while 14.9% explicitly forbid it.Source: §3.2 · p. 9
• When guidance addresses communication, restrictions are more common than permission (27.8% vs. 13.9%); for issues, permission and prohibition are similar (15.7% vs. 14.6%).Source: §3.2 · p. 9

3.3 Human Involvement and Accountability

• 67.3% require high human involvement, such as understanding, reviewing, testing, explaining, or ensuring the quality of AI-assisted contributions.Source: §3.3 · pp. 9–10
• 43.4% state that contributors are responsible for submissions, while 56.6% provide no explicit accountability guidance.Source: §3.3 · p. 10

4.1 AI Disclosure Obligation (whether)

• 48.8% of policies require AI disclosure, 46.6% provide no guidance, and 4.6% explicitly say disclosure is not required.Source: §4.1 · p. 11

4.3 Content of AI Disclosure (what)

• Some policies require multiple disclosure details, such as both the agent name and the extent of AI usage.Source: §4.3 · p. 12

4.2 Location of AI Disclosure (where)

• Among locations named by policies, pull request descriptions (64.7%) and commit messages (26.7%) are the most common.Source: §4.3 · p. 12, §4.2 · p. 12

4.3 Content of AI Disclosure (what)

• The most common disclosure content is a description of AI usage (46%), the AI agent name (32.8%), and the extent of AI usage (13%).Source: §4.3 · p. 12

5 RQ3: AI Slop Countermeasures

• The authors identify ten countermeasures targeting pull requests, users, and autonomous agents.Source: §5 · p. 13

5.1 Pull Requests: close PR, require prior PR approval, label the PR, limit PRs, and stop accepting PRs

• Pull-request measures include closing low-quality submissions, requiring prior approval, labeling suspected automated submissions, and limiting or pausing PRs.Source: §5.1 · pp. 13–14

5.2 Users: ban/block user, restrict new/external users, and denounce users

• User-focused measures include bans or blocks, restrictions on new or external contributors, and public denouncements.Source: §5.2 · p. 14

5.3 Autonomous agents: disallow autonomous agents and add agent instructions

• Some policies prohibit autonomous agents from opening or driving contributions, while others give agents explicit instructions not to submit them.Source: §5.3 · p. 14

5 RQ3: AI Slop Countermeasures

• Of 188 observed countermeasures, the most common are closing pull requests (48.4%), banning or blocking users (20.8%), and disallowing autonomous agents (13.8%).Source: §5.3 · p. 14

6 RQ4: AI Policy Evolution

• 49% of the 92 policies remained unchanged, while 51% underwent two or more commits.Source: §6 · p. 15
• Among policies with two or more changes, median length rose from 45 lines in the first version to 50 in the latest, and average length from 59 to 71 lines.Source: §6 · p. 15
• The 92 policies account for 196 commits, but only 31 commit messages clearly explained the changes.Source: §6 · p. 15
• The six reported rationale categories include improving quality controls (8 commits), improving disclosure rules (7), enforcing accountability (5), and improving visibility (5).Source: §6 · p. 15
• Policy updates also address AI slop, clarify consequences, restrict usage, and expand policy scope to additional contribution types.Source: §6 · p. 15

7.1 AI is Permitted but...

• 83.3% of AI policies permit or encourage AI in code contributions, but welcoming projects also emphasize transparency, accountability, human involvement, and multiple recommendations.Permission does not imply indiscriminate use.Source: §7.1 · p. 16

7.2 Clear Guidance on Code Contributions, but Limited Guidance on Communication and Issues/Bugs/Security

• 98.2% of policies clearly state whether AI is accepted in code contributions, and 70.5% provide guidance on human involvement.Guidance is more limited on accountability (43.4%), communication (42.3%), and issues/bugs/security (31.3%); 27.8% prohibit AI communication, while 13.9% explicitly permit it.Source: §7.2 · p. 17

7.3 Lack of Standards on AI Disclosure

• 48.8% of policies require AI disclosure, while 46.6% provide no explicit guidance, and requirements vary in where and what contributors disclose.Disclosure may be required in pull-request descriptions or commit messages and may cover AI use, agent name, extent of use, or model version.Source: §7.3 · p. 17

7.4 Level of AI Assistance: Human-written, AI-assisted, and AI-generated

• Some projects classify contributions as human-written, AI-assisted, or AI-generated; SHAP tracks autonomous, assisted, and advised agent contributions.Kornia acknowledges that the boundary between AI-assisted and AI-generated work can be fuzzy and says contributors will not be sanctioned based on that distinction.Source: §7.4 · p. 18

7.5 Concerns Regarding AI Slop

• RQ3 identified ten AI-slop countermeasures targeting pull requests, users, and autonomous agents; the most common are closing pull requests, banning or blocking users, and disallowing autonomous agents.Improving quality controls motivates policy changes, but restrictions may create friction for legitimate contributors, and their long-term effects remain unclear.Source: §7.5 · p. 19

7.6 Concerns Regarding Autonomous Agents

• Autonomous agents appear both in countermeasures against AI slop and as a reason for policy updates restricting AI use, even when AI contributions are otherwise permitted.For example, python-attrs prohibits unsupervised agentic tools like OpenClaw.Source: §7.6 · p. 19
• Several policies bar unsupervised or fully autonomous agent contributions, with some threatening bans or closing bot-generated submissions without review.The examples include permanent bans for bot-like behavior, possible account bans for bot-generated contributions, and a prohibition on contributions from agents operating without human oversight.Source: §7.6 · p. 20
• At least one policy removed a prohibition on AI-generated contributions while adding guidelines for coding agents.Source: §7.6 · p. 20

AI-generated PRs and add guidance to AGENTS.md”.7

• Autonomous agents remain largely forbidden despite the generally positive stance toward AI usage in policies.Some policies specifically instruct autonomous agents not to contribute.Source: AI-generated PRs and add guidance to… · p. 20
• Some policies give autonomous agents specific instructions not to contribute to the project.Source: AI-generated PRs and add guidance to… · p. 20
• As AI tools evolve, policies may shift from prohibitions toward coding-agent guidelines.Source: AI-generated PRs and add guidance to… · p. 20

8 Limitations

• Policy detection covered dedicated policy files, contribution guidelines, and agent configuration files, with most policies found in CONTRIBUTING.md.Using all three source types reduces the risk of failing to identify AI contribution policies.Source: §8 · p. 20
• Manual classification achieved 90% overall agreement across 180 labels, with remaining cases discussed until consensus.The authors state that this agreement reduces misclassification risk.Source: §8 · p. 20
• The 281 policies came from the top 2,000 repositories and 36 well-known projects and organizations, limiting direct generalization to other languages or closed-source projects.Repositories were selected for popularity and recent activity, including at least 100 commits and one commit in 2026.Source: §8 · p. 20

Coding Agent Guidance

• Coding-agent adoption was reported as close to 30% overall on GitHub and 76% in new projects.Research on agent guidance has examined diverse content, including conventions, project structure, build instructions, and testing.Source: §9 · pp. 20–21

Contribution Guidelines

• Studies of contribution guidelines examined README structure, prescribed versus actual practices, and contributor testing documentation.The cited work found guideline alignment associated with greater repository popularity, deviations from prescribed processes, and varying prevalence of test documentation.Source: §9 · p. 21

Coding Agent Guidance

• Research has examined coding-agent guidance files such as AGENTS.md and CLAUDE.md, finding diverse content; common categories include conventions and best practices, contribution guidelines, project structure, and build and testing instructions [22].Source: §9 · p. 21

AI Policies and AI Governance

• This study extends the authors’ earlier analysis of 118 policies to 281 policies, broadens usage dimensions, and adds research questions on AI slop and policy evolution.It also expands the repository sample and includes policies from 36 well-known projects and organizations.Source: §9 · p. 21
• Prior AI-governance research characterized seven concerns and three orientations across projects [37], and proposed five governance dimensions for analyzing AI policies [8].The cited study of policy effects also reported benefits including maintainer engagement, increased disclosure, and richer review interactions.Source: §9 · pp. 21–22
• Rather than building a governance framework, the study quantifies multiple dimensions across 281 policies and examines disclosure, slop countermeasures, and policy change.The authors describe these as the first explorations of those three topics in this context.Source: §9 · p. 22

10 Conclusion

• The study analyzed 281 policies and tracked 92 dedicated files across 196 commits, contributing a labeled corpus for researchers studying policy impact.Source: §10 · p. 22
• 83.3% of policies permit or encourage AI use in code contributions, while 67.3% require high human involvement, 43.4% assign contributor accountability, and 14.9% forbid AI.Source: §10 · p. 22
• 48.8% of policies require AI disclosure, most often in pull request descriptions and commit messages, though required disclosure varies widely.Source: §10 · p. 22
• Ten countermeasures target pull requests, users, and autonomous agents; the most common include closing pull requests, banning users, and disallowing fully autonomous agents.Source: §10 · p. 22
• Half of dedicated AI policy files have been revised since creation, with revisions addressing quality controls, disclosure, accountability, and policy scope.Source: §10 · p. 22
• Future work includes studying additional policy dimensions, whether policies are followed, and whether anti-slop measures affect legitimate contributors or reduce low-quality contributions.Source: §10 · p. 22