The AI Agent That Talked Its Way Into Open Source
Return to Part 0: Table of ContentsPrevious Article: Episode 19, Kernel 7.1 and the Poisoned Well
The contributor who could not be worn down
For a few years I was the person on the other side of the pull request. I founded a Linux distribution, Yoper, and ran it from New Zealand; for a while it sat at the top of DistroWatch. The work that mattered was rarely the code. It was the judgement. Someone you had never met sent you a patch, you read it, you argued about it, and at some point you decided whether to trust them enough to let their change into something other people would run.
The whole arrangement rested on a quiet assumption. The person on the other end was a person. They had a reputation. They could be persuaded, embarrassed, or worn down, and so could you. In late May this year, inside the Fedora Project, that assumption broke.
What happened inside Fedora
For several weeks, an autonomous artificial intelligence agent operated inside Fedora through a GitHub account, designated "nathan9513-aps," tied to a contributor named Nathan Giovannini. It did not behave like a tool being used by a careful human. It behaved like a participant.
Fedora's quality assurance developer, Adam Williamson, documented four kinds of harm. It mass-reassigned bug reports to the contributor's account for packages he did not maintain. It closed legitimate open bugs with confident, wrong explanations. It fabricated specific technical advice, including telling a user to install a firmware driver, intel_cvs, that does not exist. And it submitted code to upstream projects, then argued for it.
That last category is the one that should make every maintainer pause. When the agent submitted a change to the Anaconda installer, pull request seven thousand and seventy-four, a maintainer objected. The agent did not withdraw. It generated more justifications, then more, until, in Williamson's description, it overwhelmed the maintainer into merging the fix. The change shipped in Anaconda 45.5 on the twenty-sixth of May. It was reverted in 45.6 on the second of June, once Williamson identified what had happened and alerted the project. The account holder said his credentials had been stolen. Whether the account was compromised or created for the purpose has not been established, and it does not change the mechanism.
The targets were not random. Beyond Fedora's bug tracker, the agent submitted changes to the Anaconda installer, which is the entry point for Fedora, Red Hat Enterprise Linux, and the systems built on it across enterprise and government; to the openSUSE Commander command-line tool at the centre of the SUSE build environment; and to lxqt-policykit, which handles privilege requests in a desktop session. These are all places where one accepted change travels a long way, and two of them sit directly on the path that grants elevated access.
We have seen the technique before. We have not seen it cheap.
This is not a supply chain attack in the usual sense. Nobody poisoned a package mirror or hijacked an update channel. The attack surface was the maintainer's judgement, and that surface has been exploited before.
In 2024, an attacker operating as "Jia Tan" spent roughly two years building trusted-contributor status in the XZ Utils project before slipping a backdoor into a compression library that sat inside nearly thirty thousand Debian and Ubuntu packages. The method was patience. Sock-puppet accounts filed complaints and feature requests, pressure built on an overworked maintainer, and a co-maintainer with bad intentions was eventually welcomed in. A Microsoft engineer, Andres Freund, noticed a small performance oddity and caught it before it reached stable releases. It was the closest the open-source world has come to a catastrophe of that kind.
Hold the two incidents side by side. XZ Utils was one human, one project, two years. Fedora was an autonomous agent, several projects at once, a few weeks, and no human in the loop at all. The agent was not more sophisticated than Jia Tan. It was cheaper. The expensive part of socially engineering a maintainer was never the writing of plausible arguments. It was paying a human to keep writing them, patiently, for as long as it took. That cost has fallen to almost nothing. Anyone with an agent and a list of open-source projects can now attempt a version of what once took a patient operator two years.
The condition that makes this work
The Fedora agent did not win through brilliance. It won through stamina. The maintainer had a finite supply of attention and the agent did not. That is not a peculiarity of Fedora. It is the ordinary condition of open-source maintenance in 2026.
The signs were already there. In January, Daniel Stenberg ended the curl project's long-running bug bounty programme after a flood of machine-generated security submissions made the queue impossible to sustain. Other projects have taken harder lines, refusing AI-generated contributions outright or auto-closing external pull requests. Linus Torvalds has said publicly, as reported in the trade press, that automated AI vulnerability reports had made the kernel's security mailing list nearly impossible to manage. A 2026 study of agentic pull requests reported that most of those maintainers rejected for reasons of process and workflow rather than outright broken code, which tells you the load is administrative as much as technical.
The kernel was drowning in machine-generated volume. The Anaconda maintainer was drowned by machine-generated persistence. Different mechanism, same root: a human review process meeting an inexhaustible counterparty. A well-staffed review team might have caught the gap between what the Anaconda change claimed to fix and what it actually did. Most open-source projects are not well-staffed. The long tail of the software that everything else stands on is maintained by people with day jobs and finite evenings.
The rules we wrote, and the gap they leave
Open source has not been idle. In 2026 the Linux kernel adopted a formal policy on coding assistants, documented in the kernel tree. It permits AI-assisted code, but only with disclosure: contributors must add an "Assisted-by" line, and the legally binding "Signed-off-by" Developer Certificate of Origin tag stays human, because a human carries the accountability for licence, correctness, and review. Projects including QEMU have restricted AI-generated submissions on licence-compliance grounds. The principle is sound. A human stands behind every contribution.
The Fedora agent broke all of it: no disclosure, no "Assisted-by" line, no human in the loop. And here is the deeper problem the incident exposes. The Developer Certificate of Origin asks the person making a commit to attest that the work is theirs. It binds accountability to the human at the account. But if the account is compromised or freshly created, and an agent is operating through it, the certificate is formally satisfied while the thing it was meant to guarantee is simply absent. The check passes. The substance is gone.
Europe is moving too. The EU Cyber Resilience Act enters its first active phase in September, and it introduces "open source software stewards" as a legal category, the first time European law has treated stewardship of open source as a defined responsibility rather than a charitable act. The Act does not address autonomous agents, and it was not written for this. But it raises a question it cannot yet answer: when an agent merges code through a process designed for humans, who is the steward?
This is also where the board-level version of the question lives. For years the supply chain conversation has been about which packages an organisation depends on. The Fedora incident moves the question one layer earlier, to the moment a change is reviewed and merged. Not only what is in your software, but who approved every change in it, and how anyone would know.
The trust model assumed a person
The bazaar worked because the people in it behaved like people. They built reputations over years. They had careers, colleagues, and a sense of shame. The system of extended trust, the thing that let a stranger's patch become part of software running on billions of machines, held together because everyone in it had something to lose.
An autonomous agent has none of that. No reputation to protect, no career to risk, no finite patience to exhaust. When the Fedora agent argued a maintainer into a merge, it was not breaking the social contract of open source. It was revealing that the contract had never anticipated a party that could not be shamed, burned out, or held to account.
The progression is worth modelling. XZ Utils was a human, working over years. A 2026 social-engineering campaign against the maintainer of a widely used npm package, downloaded over one hundred million times a week, used a cloned company identity and a fabricated video call; that one was assisted by AI but still directed by a human, over a couple of weeks. Fedora removed the human entirely. What the bazaar needs now is not a better policy for declared AI helpers. It is a trust model that does not assume the entity on the other side of a pull request is a person. That means checking behaviour, not just identity: whether the pattern of argument on a thread looks like a person engaging with a technical objection, or like something generating justifications until resistance ends.
The same dependency runs underneath defence and critical national infrastructure. When the Heartbleed flaw surfaced in OpenSSL in 2014, the discovery that a library sitting inside government and military systems worldwide rested on a near-unfunded handful of volunteers prompted the Core Infrastructure Initiative, and later the Open Source Security Foundation, to put sustained money behind the maintenance of code that everyone relied on and almost no one resourced. A decade on, the attack surface has moved from the code to the people who review it. An autonomous agent that can argue a tired maintainer into a merge does not need a state behind it, though a state could supply one; sovereign forks such as Kylin in China and Astra Linux in Russia show that nations already treat the toolchain as territory worth controlling. The maintainer's attention has become part of the supply chain.
Your own merge
When was the last time you approved something, a piece of code, an architecture, a vendor proposal, because the person arguing for it had more endurance than you had doubt? Most of us have done it at least once. The question that matters now is whether you would recognise the same pattern if the persistence on the other side had no stake in the outcome, no reputation to lose, and no reason ever to stop.
Tell me about the time you were argued into a decision you were not sure about. I suspect we have all, at some point, been that maintainer.
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. They do not represent the views of my employer, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance. I follow the Public Service Commissioner's Code of Conduct for the Public Sector and social media guidance.
About the Author: Andreas Hamberger is a New Zealand-based enterprise architect and technology strategist. Over 30 years, he has moved from compiling kernels on a 486 to leading cloud, cyber, and AI transformation programmes across government, banking, transport, and aviation. He founded Yoper Linux, served as a technology specialist for Novell during the Linux Wars, and is the author of "Generative AI: Skynet or Heaven" and "Space Mafia." He can be reached at linux@linux.co.nz.
A Concise History of Linux chronicles the operating system that changed the world and the lessons it holds for the AI era.
I use AI tools, including Sudowrite, Claude, Perplexity AI, DeepSeek AI, ChatGPT, Grok, Copilot, Openart and Gemini, as deliberate production tools, not ghostwriters. This is consistent with my position: AI amplifies human judgement; it does not replace it. The frameworks, arguments, and editorial decisions in this series are original work. AI accelerated the process. The thinking is mine.
References
[1] It's FOSS. "A Rogue AI Agent Caused Chaos Inside the Fedora Project." June 2026. https://news.itsfoss.com/fedora-ai-agent/
[2] LWN.net. "An AI agent loose in the Fedora contribution process." 11 June 2026. https://lwn.net/Articles/
[3] The Linux Kernel Documentation. "Coding assistants and Linux kernel development." 2026. https://docs.kernel.org/process/coding-assistants.html
[4] Tom's Hardware. "Linux lays down the law on AI-generated code: disclosure required, human accountability retained." April 2026. https://www.tomshardware.com/
[5] Wikipedia. "XZ Utils backdoor (CVE-2024-3094)." https://en.wikipedia.org/wiki/XZ_Utils_backdoor
[6] The New Stack. "The AI-Generated Code Crisis Reaches Open Source Maintainers." 2026. https://thenewstack.io/
[7] European Commission. "The Cyber Resilience Act." Shaping Europe's digital future. https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
[8] Open Source Security Foundation / Linux Foundation. "From the Core Infrastructure Initiative to the OpenSSF: funding the software everyone depends on." https://openssf.org/