Who cleans up after the vibe-coding party?

Sam Learner · article · 2026-07-11 Reader 🖥️

AI Labor Disruption AI Slop Code Was Never the Bottleneck Open-Source Maintainer Burden Trust Vibe Coding

AI coding tools have made producing an open-source contribution nearly free while leaving the cost of reviewing, verifying and maintaining it entirely on human maintainers -- degrading the reputational and communal incentives that sustained volunteer contribution and pushing individual maintainers toward uncoordinated, defensive responses (ending bug bounties, banning AI submissions outright) in the absence of any systemic rebalancing of who does software's unglamorous, chronically undervalued maintenance work.

practical · mixed — Financial Times feature journalism: reported, narrative-driven exposition (multiple named interviews, an extended sandwich/deli and cruise-control analogy) carrying an implicit practical argument -- that the cost of AI-generated code contributions is being wrongly and involuntarily concentrated on human maintainers, and that this needs to be recognized and rebalanced -- without prescribing a specific policy fix.

Structure

Part	Role
Opening hook: cURL's ubiquity and Daniel Stenberg as sole full-time maintainer	context / narrative anchor
The 'load-bearing internet people' (LBIP) framing and the xkcd dependency comic	context establishing pre-existing maintainer fragility
cURL ending its bug bounty program over 'AI slop' reports	evidence / named example
The Koren et al. 'Vibe Coding Kills Open Source' economic model of bots-as-users	evidence / theoretical grounding
Extended sandwich-maker / bakery / 'sandwich-a-tron' analogy for software dependency chains	explanatory device
Maintainer responses: tldraw's Steve Ruiz banning AI contributions; Guido van Rossum on Python's slop burden	evidence / named examples of divergent individual responses
Education and pipeline effects: Josh Comeau's course enrollment collapse, Johannes Wachs's productivity-gap research, Stack Overflow's collapse	evidence for downstream/future-maintainer-pipeline harm
Rich Harris on paid-AI dependency as a new, centralized 'dependency problem'	counterpoint / complication
Karen Sandler's conflicted view: AI tools as both a threat to free-software principles and a democratizing opportunity	counter-argument / nuance
Closing: Stenberg's 'writing code was never the problem' and Mierle Laderman Ukeles's 'Manifesto for Maintenance Art'	conclusion / thematic reframing

Key terms

vibe coders Vibe Coding
People submitting contributions to open-source projects written exclusively with AI tools, in some cases without the ability to understand the code they are submitting.
AI slop / 'explosion of AI slop reports'
Stenberg's term for the flood of low-quality, time-wasting AI-generated bug and security submissions that made cURL's bug bounty program untenable -- costly to debunk and demoralizing to maintainers.
extractive contributions Open-Source Maintainer Burden
Contributions where the maintainer's review time and energy cost exceeds the value delivered -- a category AI tools have made dramatically cheaper to produce, without making cheaper to review.
load-bearing internet people (LBIP) Open-Source Maintainer Burden
Eric S. Raymond's term (invoked via the xkcd comic) for maintainers of software critical to internet infrastructure who operate without organizational support or budget.
cruise control
Josh Comeau's metaphor for coding with AI: forward motion continues, but a driver must still be behind the wheel -- distinct from a hypothetical fully self-driving car.

Propositions

explicitcURL/libcurl is close to universal, invisible internet infrastructure (installed 20+ billion times by the maintainers' own estimate) maintained essentially by one full-time person, Daniel Stenberg, plus a fluctuating pool of volunteers.conf: high
explicitOpen-source software is 'a precondition for most software to be able to exist' -- nearly all software, proprietary or open, sits atop a deep, largely invisible stack of open-source dependencies.conf: high
explicitAI coding tools have produced a large influx of proposed open-source contributions, most of which are low quality, useless, or require significant review time even when submitted in good faith, including from vibe coders who sometimes cannot understand the code they submit.conf: high
supportsBliki: Vibe Coding · p11 — The influx of AI-generated OSS contributions from people 'sometimes without the ability to understand the output' is a real-world accountability breakdown exactly where Fowler's claim predicts it -- reading code is what produces accountability, and these contributors never read it.
explicitcURL ended its long-running bug bounty program in January [2026] because the volume of AI-generated ('AI slop') security reports made running it not worth the mental and time cost to maintainers.conf: high
explicitestablished'Extractive contributions' -- where maintainer review cost exceeds contribution value -- have become far more common because AI has sharply cut the cost of producing a contribution while the cost of reviewing one, which still requires human judgment, has stayed the same.conf: high
supports ←Andrew Kelley Interview: Why He Built Zig, Banned AI Contributions, and Moved Zig off GitHub · p1 — Zig's 'invariably garbage / negative value' assessment of AI contributions is another named-project instance of the 'extractive contributions' dynamic (review cost exceeding contribution value) documented there.
supports ←Flood of AI 'garbage' is pushing open-source developers to the limit · p1 — Adds four new named cases (Sentry/Whitacre, Zig, Homebrew, Matplotlib) of the same cost-asymmetry mechanism — cheap AI production vs. fixed human review cost — already identified as 'extractive contributions.'
explicitdevelopedSome maintainers (tldraw's Steve Ruiz) have responded by banning outside AI-assisted contributions entirely, arguing that once writing code is the easy part, there is no reason to want someone else -- or something else -- to write it, and that the social contract underlying open-source contribution is 'obliterated.'conf: high
supportsDeepSeek v4, and the end of the OpenAI/Microsoft AGI clause · p16 — tldraw's Ruiz banning AI contributions outright is a second named, independent instance of the same maintainer logic behind Zig's blanket LLM-contribution ban -- that OSS review is an investment in a future human contributor, which reviewing AI-authored code cannot repay.
supportsVibe coding and agentic engineering are getting closer than I'd like · p7 — Vibe-coded contributions submitted to civilization-scale infrastructure like cURL are a concrete, named-source case of exactly the irresponsibility Willison predicts abstractly for vibe coding that affects other people.
extendsThe Kubernetes Approach to AI-Assisted Maintainership Prioritises Human Accountability · p3 — Kubernetes's formalized AI-disclosure-and-mandatory-human-review regime is one systemic alternative to the uncoordinated, all-or-nothing individual maintainer responses (bug-bounty cancellation, outright contribution bans) this article documents across the wider OSS ecosystem.
extends ←Andrew Kelley Interview: Why He Built Zig, Banned AI Contributions, and Moved Zig off GitHub · p3 — Adds the explicit mentorship/apprenticeship rationale ('contributor poker') behind a blanket AI-contribution ban that the tldraw case in that document states as a conclusion without this underlying investment-in-people argument.
explicitThe non-monetary incentives that sustain open-source contribution (CV credit, reputation, community recognition) depend on human engagement; as the effective 'user base' for a package becomes increasingly composed of AI agents/bots rather than people, those incentives degrade because bots provide no reputational or communal payoff.conf: high
explicitUnder the traditional open-source business model, where developer motivation and reward depend on direct human user engagement, the ecosystem 'cannot survive widespread AI adoption,' per the Koren et al. paper's own stated conclusion.conf: high
explicitAI coding tools are, per Stenberg, considerably better at finding problems in code than at fixing them -- shifting the residual, hardest part of the work (diagnosis and correction under uncertainty) back onto human maintainers even when AI assists.conf: high
extendsFrom Technical Debt to Cognitive and Intent Debt: Rethinking Software Health in the Age of AI · p2 — Stenberg's first-hand account that AI is 'much better at finding problems than fixing them' -- and that maintaining code, not writing it, is the real challenge -- is a concrete, named-source instantiation of Storey's abstract claim that AI shrinks technical debt (writing) while accelerating cognitive/intent debt (understanding and maintaining).
explicitcorroboratedDevelopers who learn to code primarily through direct LLM interaction risk a 'bigger-picture' skill deficit, because LLMs answer the narrow question asked rather than teaching which questions should be asked -- a gap that current senior engineers, trained before these tools existed, do not share.conf: high
supports ←How Anthropic Builds And How Engineering Will Change Soon | Thariq Shihipar · p30 — Both argue that skipping deep technical grounding in favor of pure LLM interaction risks a real skill/judgment deficit.
explicitPublic developer-education resources are collapsing in parallel with LLM adoption: Stack Overflow's monthly question volume fell from over 100,000 pre-ChatGPT (2022) to under 1,500, with the response rate roughly halved, removing shared, human-generated context that both novice developers and (originally) the models themselves relied on.conf: high
explicitdevelopedThis dynamic is a tragedy of the commons: individual developers capture personal productivity gains from AI-assisted contribution while externalizing the resulting review, verification and maintenance costs onto reviewers, maintainers and the wider community.conf: high
extends ←IBM and Red Hat Commit $5 Billion to Redefine the Future of Open Source in the AI Era · p2 — Proposes a commercially-funded intermediary to absorb exactly the maintainer review/fix burden that p12 describes being externalized onto volunteers — an attempt at a structural remedy, though the press release offers no evidence it works.
implicitPrompting an LLM on unfamiliar territory is qualitatively different from prompting it on familiar ground (which feels like writing loose pseudocode) -- in the unfamiliar case the developer becomes more like a product manager or customer of 'Someone Else's Code' than a programmer, which the author treats as more than just the next rung on software's historical abstraction ladder (assembly to C to Python to prompting).conf: medium
explicitAI coding tools introduce a new, centralized version of the 'dependency problem': developers may come to depend on subscription-priced infrastructure controlled by a handful of companies, reversing open-source software's historically 'permissionless' character.conf: high
explicitOpen-source advocates are internally conflicted about AI code-generation: rejecting the tools outright risks free software falling behind proprietary software, while the tools also carry real democratizing potential to let more people modify the software they depend on.conf: high
explicitSociety structurally devalues maintenance relative to creation -- an imbalance older than AI (per Ukeles's 1969 'Manifesto for Maintenance Art') -- which generative AI intensifies because it is built and marketed almost exclusively as a tool of creation, never of maintenance.conf: high

Arguments

The traditional open-source collaborative model cannot survive intact if AI agents increasingly replace human users and contributors as a project's engaged 'community.' strength: medium

Explicit premises:

Developer motivation to build/maintain open source is largely non-monetary (CV credit, reputation, community recognition).
Bots consume/recommend packages without providing engagement, goodwill, or reputational payoff.
Koren et al.'s trade-style economic model finds AI-driven download growth does not translate into the engagement that sustains maintainers.

Implicit premises:

Only human engagement supplies the psychological/reputational reward that motivates volunteer labor, since direct monetary reward is largely absent from open source.
Maintainer motivation, once eroded, cannot be substituted by raw usage statistics alone.

Inferences:

Packages most heavily recommended by AI coding models -- precisely the most AI-dependent packages -- could be at the highest risk of maintainer abandonment, a fragility concentrated exactly where AI reliance is greatest (a conclusion the article gestures at via download-vs-engagement data but does not state outright).

AI coding tools shift the burden of software quality from writing to reviewing, and that burden cannot itself be automated away. strength: high

Explicit premises:

Stenberg: AI is better at finding problems than fixing them.
Van Rossum: LLMs tend to touch many unrelated parts of a file, making each review more tedious.
Reviewing an AI-authored contribution still requires human judgment even though authoring it barely does.

Implicit premises:

Reviewing code well requires at least as much contextual understanding as writing it originally -- so the 'cost' displaced by cheap authorship reappears, undiminished, at the review stage.
No current tool substitutes for the human judgment step of review, unlike the (partially automatable) step of writing.

A widening skill gap is opening between developers who learned before LLMs existed and those learning primarily through them, because LLMs remove the friction that used to force novices toward broader understanding. strength: medium

Explicit premises:

A November 2025 paper (Wachs et al.) found experienced programmers capture nearly all of AI's productivity and exploration gains, widening rather than closing the skill gap.
Comeau's course enrollments have fallen to roughly a third of prior levels, a decline he attributes partly to the same forces.
Stack Overflow's public question-and-answer volume has collapsed by roughly two orders of magnitude since 2022.

Implicit premises:

Forums and paid courses were the primary vehicle through which junior developers historically built 'bigger picture' understanding that direct LLM Q&A does not provide.
A course-enrollment decline and a forum-activity decline are evidence of a common underlying cause (LLM substitution) rather than independent trends.

Narratives

Daniel Stenberg and cURL: sole full-time maintainer of infrastructure installed 20+ billion times, ending the bug bounty program over 'AI slop.'
→ Establishes the article's central case study of an under-resourced, single-point-of-failure maintainer overwhelmed by AI-generated submissions, and anchors its title metaphor.
The xkcd 'dependency' comic and Eric S. Raymond's 'load-bearing internet people' framing.
→ Supplies the pre-AI baseline vulnerability (thankless, precarious volunteer maintenance) that AI slop then intensifies.
The sandwich-maker / bakery / 'sandwich-a-tron' extended analogy, including the author's own experience as a 'sandwich maker' building on open-source 'bread.'
→ Makes the abstract dependency-chain and AI-influx dynamics concrete and intuitive without technical jargon, and personally situates the author within the supply chain he's describing.
Steve Ruiz (tldraw) banning AI-generated contributions outright in January [2026].
→ Provides the article's clearest example of a maintainer's defensive, exclusionary response to the burden-shift, and voices the 'social contract obliterated' argument.
Guido van Rossum stepping down as Python's BDFL in 2018 after the 'walrus operator' controversy, and his current view on AI-slop review burden and low-value 'spellchecker' contributions predating LLMs.
→ Shows maintainer burnout as a pre-existing structural risk (not solely an AI creation) that AI slop compounds, and offers historical continuity for the 'low-value contribution' problem.
Josh Comeau's course-enrollment collapse and Johannes Wachs's research and 'red button' classroom anecdote.
→ Extends the burden narrative downstream to the developer-education pipeline and the next generation of potential maintainers.
Stack Overflow's collapse in public question volume and its CEO's acknowledgment that public forums are effectively dead, replaced by private chatbot conversations.
→ Illustrates the loss of a public, human-generated knowledge commons -- both a training-data source and a community resource -- as a parallel casualty of the same shift.
Rich Harris (Svelte) and Miklós Koren's 'Vibe Coding Kills Open Source' research.
→ Supplies, respectively, the article's economic/dependency risk framing (paid AI infrastructure as a new lock-in) and its most rigorous theoretical backing for the incentive-collapse thesis.
Karen Sandler (Software Freedom Conservancy) voicing her own conflicted view on AI tools' ethics versus their democratizing potential.
→ Introduces the article's clearest counter-argument, preventing the piece from reading as purely one-sided against AI contributions.
Mierle Laderman Ukeles's 1969 'Manifesto for Maintenance Art' and her tenure as artist-in-residence at the NYC Department of Sanitation.
→ Reframes the entire article's subject as an instance of a much older cultural pattern -- societal undervaluing of maintenance relative to creation -- giving the piece its closing thesis.

Questions addressed

✅ Who bears the cost when AI tools make producing a code contribution nearly free?
Human maintainers bear it, in the form of review time, mental toll, and (in cURL's case) the loss of a previously valuable bug-bounty mechanism.
⭕ Can the traditional open-source incentive model (reputation, CV credit, community) survive if the effective 'community' using and generating traffic for a package becomes increasingly AI agents rather than humans?
Argued theoretically via Koren et al.'s economic model and its stated conclusion, but not confirmed against longitudinal, real-world maintainer-attrition data.
⭕ Does the productivity AI gives experienced developers outweigh the harm it may do to novice developers' skill formation and the developer pipeline?
Left open -- the article presents both sides (Comeau's 'cruise control' framing of real productivity gains for experienced developers, and Wachs's research plus Comeau's own enrollment data on a widening skill gap) without adjudicating which effect will dominate.
⭕ Should open-source maintainers ban AI-assisted contributions outright, tolerate them selectively, or find some middle path?
The article documents a spectrum of individual responses (cURL ending its bug bounty but not banning contributions; tldraw banning AI contributions entirely) without adjudicating which is the right general policy.
⭕ Is prompting an LLM to write code simply the next rung on software's historical abstraction ladder (assembly to C to Python to prompting), or something categorically different?
The author offers his own subjective impression (that unfamiliar-territory prompting feels different, turning the developer into a 'product manager' or 'customer') but explicitly frames this as a personal reflection rather than an argued conclusion.

Gaps

incompleteEvery profiled maintainer response comes from a well-known, relatively well-resourced project (cURL with funding and notoriety, tldraw with a commercial founder, Python with corporate-employed BDFLs past and present, Svelte funded by Vercel). The vast long tail of small, single-maintainer, unfunded open-source projects -- which by the article's own 'load-bearing internet people' framing are the most vulnerable -- gets no voice and may lack the visibility or leverage to make a public stand like tldraw's ban or cURL's bounty cancellation.
Read next: Survey data on AI-contribution burden across the long tail of unfunded OSS projects (e.g. Tidelift, Open Source Security Foundation, or GitHub's own maintainer surveys) rather than profiles of famous exceptions.
incompleteThe article gives no quantitative sense of the actual scale or trend of AI-generated versus human contributions across open-source projects generally -- it relies on anecdote (Stenberg, Ruiz, van Rossum) and a single economic-modeling paper (Koren et al.) rather than data on what fraction of pull requests to major projects are now AI-assisted, or whether the influx is accelerating, plateauing, or already being absorbed by improving detection and tooling.
Read next: GitHub's own aggregate PR/commit provenance data, or academic studies quantifying AI-assisted contribution share over time across large samples of repositories.
incompleteThe article treats each maintainer's response (ending a bounty program, banning contributions entirely) as an individual, ad hoc choice, and never asks whether a shared, formal industry standard -- e.g. mandatory AI-use disclosure plus fixed human-review authority, the kind of framework some large projects have already adopted -- could rebalance the burden more systemically than uncoordinated exclusion.
Read next: Compare against formalized AI-contribution governance frameworks already adopted by large projects (e.g. Kubernetes's mandatory disclosure and human-final-review policy) to assess whether ad hoc bans are a stopgap or the emerging norm.
incompleteDespite documenting throughout that lack of funding and reward is the core vulnerability underlying maintainer burnout, the article never explores structural/economic remedies -- expanded paid-maintainer positions, mandated corporate funding of critical dependencies, GitHub Sponsors-style mechanisms, or regulatory approaches -- ending instead on a purely cultural observation (Ukeles) about maintenance being undervalued, with no proposal for what would actually change the incentive structure.
Read next: Research or reporting on funding models for critical open-source infrastructure (e.g. the EU Cyber Resilience Act's obligations, corporate OSS-funding initiatives, Tidelift's paid-maintainer model).
closed byIBM and Red Hat Commit $5 Billion to Redefine the Future of Open Source in the AI Era — Project Lightwell is a concrete real-world instance of the 'mandated corporate funding of critical dependencies' remedy that gap flagged as unexplored — a $5B, 20,000-engineer commercial commitment aimed at funding upstream OSS security work. This only partially closes the gap: it is a promotional announcement, not evidence the funding model actually works, and it says nothing about whether it reaches the long-tail, unfunded projects that the same document's g1 flags as the most vulnerable and least visible.
misinformedThe opening hook's claim that reading the article digitally (via a browser) necessarily means 'you have just used' cURL overstates cURL's role in that specific pathway -- most mainstream web browsers use their own networking stacks rather than libcurl to fetch web pages, even though cURL genuinely is extremely widely embedded elsewhere (package managers, command-line tools, embedded devices, app backends). The framing conflates cURL's real, vast reach with a specific, likely inaccurate claim about browser page-loading.
Read next: cURL's own documentation on where libcurl is and isn't actually used (browsers vs. tooling vs. embedded systems) for a precise picture of its footprint.

Closes gaps elsewhere

DeepSeek v4, and the end of the OpenAI/Microsoft AGI clause · g4 — Karen Sandler's interview supplies the missing contributor-perspective counter-argument to blanket AI-contribution bans that the DeepSeek/Zig gap flags as absent: that shunning these tools could make free software fall behind proprietary software, and that they carry real democratizing potential to let more people modify the software they depend on. This answers the gap's general question (is there a legitimate contributor-side case against bans?) though not its specific framing around marginalized/non-native-English contributors.

Who cleans up after the vibe-coding party?

Structure

Key terms

Propositions

Arguments

Narratives

Questions addressed

Gaps

Closes gaps elsewhere

Related documents