What Is the Impact of AI-Generated Code on Open-Source Quality?

What is the impact of AI-generated code on open-source quality?

AI-generated code is degrading software quality in open-source marketplaces, where trust matters more than raw compute. It ships faster, looks cleaner, and rots the review systems built on human judgment. The proof is sitting in F-Droid's forums, Flathub's abandoned-app pile, and the wreckage of curl's bug bounty program.

Where is the AI slop already public?

In late 2025, F-Droid contributors noticed something odd. A single developer, Vayun Mathur, had uploaded more than 40 apps and games across wildly unrelated genres in a short window. Community members flagged the account, suspecting the output was AI-generated, and called for an investigation. The forum thread reads like a small-town neighborhood watch discovering the same car circling the block forty times.

F-Droid still has no formal policy for labeling or restricting AI-generated code. A GitLab issue proposing "AI-Generated Code," "AI Dependencies," and "AI-Generated Assets" antifeature tags was filed and eventually folded into a broader feature request, but nothing has shipped. The maintainers know the problem exists. They don't have a lever to pull yet.

Flathub pulled that lever. An independent study tagged 120 Flathub repos as "AI Slop" and tracked what happened to them. Eighty-eight of those apps, 73%, were abandoned within months of release. Many were deleted outright. Only 32 were still being maintained. That number is the direct reason Flathub banned AI-generated code submissions in May 2026. The apps weren't just low quality. They were disposable, published and then left to rot in a store real users were browsing.

What does the data say about AI-generated code quality?

Strip away the anecdotes. The pattern holds up under analysis. Four independent studies, using different methods on different codebases, converge on the same answer: AI-assisted code ships faster and looks cleaner on the surface, while quietly getting worse underneath.

• Refactoring is disappearing. GitClear analyzed 211 million changed lines of code from 2020 to 2024 across repos at Google, Microsoft, Meta, and enterprise customers. Refactored (moved) code fell from 25% of changed lines in 2021 to under 10% in 2024. Copy-pasted, cloned code rose from 8.3% to 12.3% over the same period, and 2024 was the first year copy-paste exceeded refactoring. Developers, or their agents, are pasting more and restructuring less.
• Bugs are shifting, not shrinking. Apiiro's analysis of tens of thousands of repos and several thousand developers at Fortune 50 enterprises found AI-assisted coding cut syntax errors by 76% and logic bugs by 60%. But privilege escalation paths rose 322% and architectural design flaws rose 153%, with AI-assisted teams generating 10 times more total security findings and shipping at 4 times the commit velocity. The easy mistakes go away. The expensive ones multiply.
• The productivity gain may not even be real. METR ran a randomized controlled trial with experienced open-source developers using early-2025 AI coding tools. They were 19% slower with the tools than without them, despite predicting beforehand that AI would speed them up by 24%, and still believing afterward that it had. Perceived speed and actual speed had come apart entirely.

That is the direct answer to what the impact of AI-generated code on software quality actually looks like: more volume, less refactoring, more duplicated code, more of the architectural bugs that are hardest to catch, and a workforce that feels faster while measurably slowing down.

Why did three marketplaces hit the same collapse pattern?

F-Droid and Flathub are Android and Linux app stores. curl is a 27-year-old command-line tool that ships in nearly every operating system on earth. They have almost nothing in common except one thing: they all run on unpaid human review, and all three have hit the same wall.

curl's maintainer, Daniel Stenberg, shut down the project's HackerOne bug bounty program effective January 31, 2026. Since 2019 the program had produced 87 confirmed vulnerabilities and paid out more than $100,000 in rewards. It worked for years. Then it stopped. The confirmed-vulnerability rate, historically above 15%, dropped below 5% in 2025. Roughly 20% of all 2025 security submissions were AI-generated slop, arriving at a steady two per week, each one costing curl's seven-person security team between 30 minutes and 3 hours to triage and reject. A bounty program that had run cleanly for six years could not survive a 20% AI-slop tax on a volunteer team's time.

The common thread across F-Droid, Flathub, and curl isn't code volume. It's that all three are curation systems, and curation doesn't scale the way generation does. An AI agent can produce a plausible-looking app or a plausible-looking vulnerability report in seconds. A human maintainer still needs minutes to hours to figure out whether it's real. That asymmetry is the whole story.

Is the real casualty trust rather than throughput?

More code and more submissions didn't translate into more value delivered. They translated into eroded trust, and that erosion shows up everywhere developers touch AI output, not just in marketplaces.

Stack Overflow's 2025 Developer Survey, with more than 49,000 respondents, found only 29-33% of developers trust the accuracy of AI tools, down from 40-43% in prior years. Meanwhile 46% actively distrust it, even though 84% now use AI tools in their workflow daily. Usage is up. Confidence is down. That gap is a trust deficit building faster than the tooling can address it.

The trust problem extends past code review into the software supply chain itself. Studies of hundreds of thousands of AI-generated code samples found the models recommend non-existent software packages roughly 20% of the time. Attackers have started registering those hallucinated package names and loading them with malware, a technique researchers now call slopsquatting. The AI doesn't just write bad code. It invents dependencies that don't exist, and someone else weaponizes the invention.

Is the same pattern growing inside your company?

Here's the part that should worry operators more than the app store drama. The exact same dynamic, unverified AI output flooding a system that depends on human review, is happening inside company walls right now. It just has a different name: shadow AI.

Microsoft and LinkedIn's 2024 Work Trend Index found that 78% of employees using AI at work are bringing their own AI tools without any organizational sanction or oversight. Every one of those employees can generate an internal dashboard, a scraper, an automation script, or a full application in an afternoon. None of it goes through the review process real software gets. It's F-Droid's slop farm, except the marketplace is your company's internal tools folder and there's no community forum flagging the suspicious uploads.

Teams that want the upside of agent-built software without importing this risk are choosing to run and own that stack themselves, with a defined review pipeline, instead of letting AI-built tools accumulate ungoverned. The self-hosted agent factory model is one version of this: engineering teams running a sandboxed agent stack on their own infrastructure, with humans still gating what ships.

Why is the moat curated, human-vetted software you own?

Here's the strategic point underneath all the case studies. In a world where any actor, human or agent, can flood a public commons with plausible-looking output in seconds, the scarce resource stops being code. It becomes verified code. Curation is the bottleneck now, not generation.

That's exactly why owning your internal software stack is worth more today than it was three years ago. A vendor's SaaS roadmap is opaque and rented, the same problem driving developers back toward local-first, self-owned alternatives to SaaS. A public package or app marketplace is now provably degrading under AI slop, as Flathub's 73% abandonment rate and curl's collapsing bounty program show. But a piece of internal software your own team built, reviewed, and maintains doesn't degrade the same way, because the review gate is yours and it doesn't scale down when volume goes up. It's a moat that compounds instead of eroding, the same case enterprise IT budgets and initiatives like the Sovereign Tech Fund are making for owning core infrastructure rather than trusting the commons to stay healthy.

What does good AI-code curation look like?

The marketplaces figuring this out are converging on a few concrete moves. Internal platform teams should borrow them now, before shadow AI sprawl catches up to where F-Droid and Flathub already are.

1. Provenance labeling. Flag AI-generated or AI-assisted code and assets explicitly, the way F-Droid's proposed antifeature tags would, rather than treating all contributions as equally trustworthy.
2. Review gates tied to risk, not volume. Apiiro's finding that AI code produces 10x more total security findings means review effort should scale with what the code touches, privilege boundaries and architecture, not with how fast it was written.
3. Retirement policies for unmaintained submissions. Flathub's ban followed data showing 73% of AI-tagged apps were abandoned within months. A policy that sunsets unmaintained software automatically prevents the same rot internally.
4. A cost ceiling on unverified submissions. curl's security team was spending up to 3 hours per report on a 20% slop rate before shutting the bounty down. Set a budget for how much human review time unverified AI output is allowed to consume before the program itself gets reconsidered.
5. Separate trust scores for AI and human contributions. With developer trust in AI accuracy down to 33% and distrust at 46%, treating AI and human output identically in a review queue understates the actual risk profile of what's coming in.

None of this requires banning AI-assisted development. It requires admitting that generation got cheap and verification didn't, and building the review infrastructure that fact demands, whether the commons is a public app store or your own company's internal tools.