RFC: Create AI policy

Context

AI is all around us and not always for the better, far from it.
We see a deluge of new contributions enabled by AI that have lowered the barrier to contribute dramatically.

Problem

AboutCode repos have roughly between 100 and 150 PR and issues contributed in the last 2 months that feel like entirely vibe coded or mostly AI-generated.

There are several issues we must consider:

• AI-generated code and content may not be copyrightable or may commonly be borrowed from open source code used in LLMs training, without any attribution, credits or license
• AI-generated content is mostly bland, conventional, flat and lacks substance
• The human time it may take to review a machine-generated contribution is not worth the efforts of the maintainers, as it may require asymmetrically more efforts on our side to sort out human from machine-generated contributions. Machine-generated contributions can be seen are a sort of Distributed Denial of Maintainer Services on our projects. They are subtly and superficially acceptable, and may even pass some tests, but are in many cases not understood by their contributors and will result in serious tech debt if merged.
• We are a community of people. We did not join this community to work with or for AI agents. Eventually I am warming up to the ASF moto of community over code.
• We receive support from orgs like NLnet and they have an AI policy for the projects they support that we must take into consideration.
• We cannot grow a community of contributors if our merge queues are flooded with machine-generated contributions.

Our current development environment where issues and pull requests are our primary community communication and exchange media is at risk of collapsing if AI "slop" is left unchecked.

Solution

We must put in place a proper AI policy to avoid the degradation of our community and projects, one that privileges contributions from real persons over most machine-contributions.

We need also to evolve tools and approaches to consistently deal with the current and future issues, and ensure that aspiring contributors understand our policies and ethos https://en.wikipedia.org/wiki/Ethos .

Some existing reference:

• @ashleywolf acknowledging this as a serious issue for GitHub https://github.blog/open-source/maintainers/welcome-to-the-eternal-september-of-open-source-heres-what-we-plan-to-do-for-maintainers/
• @bagder removing curl from bug bounties because of AI issues https://hackaday.com/2026/01/26/the-curl-project-drops-bug-bounties-due-to-ai-slop/ (he recently stopped by our workshop at https://workshop.aboutcode.org/ to talk about it)
• NLnet AI policy https://nlnet.nl/foundation/policies/generativeAI/
• @mitchellh AI policy for ghostty https://github.com/ghostty-org/ghostty/blob/main/AI_POLICY.md
• matplotlib AI policy https://matplotlib.org/devdocs/devel/contribute.html#restrictions-on-generative-ai-usage
• matplotlib's @scottshambaugh woes at https://theshamblog.com/an-ai-agent-published-a-hit-piece-on-me/ also reported by @sethmlarson https://sethmlarson.dev/automated-public-shaming-of-open-source-maintainers