AI Agents Are Changing Open Source in a Way We Barely Talk About

I'm still not sure how I feel about AI agents contributing to open source. On one hand, they're genuinely helpful. Many projects are drowning in issues and pull requests, and maintainers don't have enough time to review everything. If an AI agent fixes a typo, improves documentation, adds tests, or even solves a simple bug, that's real value.On the other hand, every pull request has a cost - someone still has to review it, think about edge cases, understand whether the change fits the project's architecture, evaluate new dependencies, and decide whether the solution actually solves the problem or just moves it somewhere else. A pull request isn't just code. It's another decision a maintainer has to make.Last week, I noticed something I hadn't thought about before. While reading comments on one of my pull requests, I saw another contribution mentioned during the review. I opened the contributor's profile out of curiosity.I was surprised by the number of open pull requests. First, because there were many, but also almost all of them targeted CNCF projects.Trust Chain Attack That made me think about something I experienced when I was maintaining open source projects myself. Whether we like it or not, maintainers build trust over time - a first-time contributor usually gets a much closer review. Every design choice, every line of code, every assumption gets questioned. But when someone has dozens of accepted pull requests, the review process changes. Not because maintainers stop reviewing their code, but because they already have confidence that this person understands the project, listens to feedback, and generally acts in good faith.In the way you can consider trust as an optimization.This brings us to the XZ Utils incident. In March 2024, the open source community narrowly avoided one of the largest supply chain attacks we've ever seen. A backdoor was introduced into XZ Utils (liblzma), a compression library used by OpenSSH on many Linux distributions. But the most interesting part about it wasn't just the technical sophistication of the backdoor.The attacker had spent nearly two years building credibility inside the project before gaining enough influence for the malicious code to be accepted.It was an attack on the trust, and it is an expensive resource. It required years of participation, discussions with maintainers, bug fixes, documentation improvements, and consistently good contributions.And that’s what AI is changing as well. Today, one person can deploy hundreds of autonomous agents that continuously open issues and submit pull requests across dozens of projects simultaneously. Most of those contributions may be completely legitimate, and it drops the cost of building contributor reputation dramatically.For years, reputation has been one of the strongest social security mechanisms in open source.Now, we're entering a world where building that reputation can be partially automated, and it changes the threat model.I'm not suggesting that AI agents are malicious; most of them are trying to solve real problems.The risk is different since pen source has always relied on social trust as much as technical review. Maintainers recognize familiar names and remember previous discussions. They become more confident in contributors who have consistently done good work.That's our human nature, but if reputation itself becomes cheap to manufacture, should we still treat it as the same security signal?There's another angle that worries me. Even if today's AI agents operate with good intentions, what happens tomorrow? What if the company behind an agent shuts down?What if its GitHub credentials are compromised? What if someone hijacks the infrastructure controlling thousands of trusted agent accounts? An account that has spent years earning trust could suddenly become a supply chain attack vector.The attacker wouldn't need to build credibility from scratch anymore.They would inherit it.This isn't a prediction; it's simply a consequence of changing the economics of trust.Most discussions around AI contributions focus on code quality - Can AI write good code? Can it understand context? Will maintainers waste more time reviewing generated pull requests?Don’t get me wrong - those are important questions, but I think we're overlooking a bigger one.For decades, open source evolved under the assumption that earning trust was expensive. And now AI is making trust cheaper.I don't think we've fully considered what that means for the security of the software supply chain. Photo by Growtika on Unsplash