AI robot captures GitHub open source warehouse: Use Git `--author` to counter spam comments
The Archestra team was forced to close the free contribution channel of the open source warehouse due to spam comments by AI robots. One issue received 253 AI-generated implementation plans, and the maintainer spent half a day every week cleaning up AI garbage. They finally implemented a contributor whitelist system using Git's `--author` flag, which effectively blocked AI robots.
Core conclusion
The proliferation of AI-generated code and comments is destroying the foundation of trust in the open source community. The real-life experience of the Archestra team speaks for itself: a bounty issue used to recruit contributors received 253 AI-generated "implementation plans", more than half of which were completely fictional. This forced the team to move from "anyone is welcome to contribute" to a "strict contributor whitelisting system."
Key Points
- Time of incident: May 2026
- Impacts: All teams maintaining open source AI/automation projects
- Core changes: The "AI contribution growth" in the GitHub report is actually a quality disaster, and maintainers are forced to use the nuclear option - closing the free contribution channel
Background: How AI compromised an open source warehouse
Archestra is an enterprise-level platform company focusing on MCP (Model Context Protocol) security. They open sourced their project on GitHub. At first, like many teams, they hoped to encourage community contributions through bounties.
The problem started with a simple goal: they released a $900 bounty to recruit developers to implement new features. Soon, legitimate contributors began to discuss technical solutions and propose plans. But then—the AI robots arrived.
These AI accounts not only flooded into this bounty issue, but also spread to the entire warehouse. Each AI-generated spam comment triggers a GitHub notification sent to every team member in the repository. The Archestra team’s GitHub notification bar became a dumping ground for AI spam.
One issue received 253 comments, almost all generated by AI. Contributors are too lazy to even test the code - a PR can't even do the most basic compilation.
Key Impact (by Dimension)
| Dimensions | Change | What it means to us | Recommended actions |
|---|---|---|---|
| Maintenance costs | Clean up AI garbage half a day a week | If you maintain OSS projects, AI robots are already consuming your time | Consider a contributor whitelisting mechanism |
| Contributor experience | Real contributors are drowned by AI noise | Newcomers will give up directly when they see a confusing issue list | Join contributor identity verification |
| Security | AI bots can guide conversations and create chaos | Attackers can use AI bots to manipulate community opinion | Use technical means to isolate AI accounts |
| Warehouse metrics | GitHub's "AI contribution" data misleads managers | Your "activity" metrics may be highly distorted | Focus on code quality rather than the number of PRs |
Countermeasure: Git --author whitelist system
After many trials and errors (including building a "contributor reputation score" robot and an "AI Sheriff" automatic shutdown robot - the latter mistakenly closed legitimate PRs), the Archestra team finally came up with a surprisingly simple solution:
Core Mechanism
Each commit in Git has two identity fields - author and committer. They can be different people. GitHub allows you to create commits as someone else via the --author flag:
git commit --author=" <id+@users.noreply.github.com>" -m "chore: "email GitHub ， GitHub ——"prior contributor（）"。
Archestra
- ** Archestra ** CAPTCHA + AI
- ** GitHub Actions** GitHub ID
- **** handle
EXTERNAL_CONTRIBUTORS.md - **Git **
--author， - ****GitHub "prior contributor"， issue/PR/
AI
** AI ** AI Agent ，。"AI "， DDoS 。
**** AI PR issue，——。
** AI ** AI Agent ，。。
， tools
GitHub、Git、AI Agent、OpenAI、Claude、MCP
Internal link guidance
- Want to know how to use AI Agent for responsible automation? Watch: AI Agent Tools 2026 Complete Tutorial: 5 Tools to Build an Automated Pipeline in 30 Minutes
- Real case: Indie Developer: n8n + OpenClaw Automation Workflow Earning $5,000/mo
Reference video/material
Monetization angle
How can you make money from this trend?
WayToClawEarn focuses on verified earn playbooks—not just news. Start from these cases.
AI code review & spec-driven agency
Offer migration consulting as Copilot pricing shifts
Claude Code 48h Micro SaaS
Validate products fast with a low-cost agent stack