{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "1601",
  "slug": "ai-prs-broke-open-source-review",
  "edition": "2026-11-15T00",
  "url": "https://hangingcontext.com/stories/2026-11-15/ai-prs-broke-open-source-review/",
  "newsroom": "artificial-intelligence",
  "beat": "developers",
  "newsroom_title": "Artificial Intelligence",
  "angle": "AI writes code faster than humans can read it, and open source just hit the wall: ESLint shut its paid contributor programme.",
  "headline": "AI writes the code now. Humans can't read it fast enough — and open source just proved it",
  "dek": "More than 40% of GitHub pull requests were started by AI agents in September. ESLint paid $51,000 to contributors in three years — then gave up filtering the flood.",
  "published_at": "2026-11-15T00:54:24Z",
  "labels": {
    "trust": "confirmed",
    "trust_text": "Confirmed · 3 Manifests",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 3,
  "publishers": [
    "larridin-blog",
    "render-blog",
    "socket-security-company"
  ],
  "sources": [
    "larridin-blog",
    "render-blog",
    "socket-security-company"
  ],
  "distinct_source_count": 3,
  "key_facts": [
    {
      "text": "GitHub reported that over 40% of pull requests on its platform were started by AI agents in September 2026, or 110 million agent-started pull requests.",
      "cites": [
        {
          "claim_ids": [
            "1794681371432645055",
            "1794681371433645056"
          ],
          "manifest_id": "1794680988786644364"
        }
      ],
      "self_reported": false
    },
    {
      "text": "ESLint retired its contributor pool programme after five years, having paid over $51,000 to outside contributors between 2022 and 2025, including $24,680 in 2025.",
      "cites": [
        {
          "claim_ids": [
            "1794681371426645052",
            "1794681371429645053",
            "1794681371431645054"
          ],
          "manifest_id": "1794680988786644364"
        }
      ],
      "self_reported": false
    },
    {
      "text": "The Linux Foundation found 59% of surveyed maintainers reported growing contributions associated with generative AI, and maintainers estimated 25% of incoming pull requests were low-quality AI-generated submissions.",
      "cites": [
        {
          "claim_ids": [
            "1794681371435645057",
            "1794681371437645058"
          ],
          "manifest_id": "1794680988786644364"
        }
      ],
      "self_reported": false
    },
    {
      "text": "Coding agents produce changes faster than humans can inspect them, argues Larridin CTO Ameya Kanitkar, who says humans should spend more time reviewing the spec than the generated code.",
      "cites": [
        {
          "claim_ids": [
            "1794698072774684365",
            "1794698072777684367"
          ],
          "manifest_id": "1794697816399683498"
        }
      ],
      "self_reported": false
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "The flood",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794681371432645055",
                "1794681371433645056"
              ],
              "manifest_id": "1794680988786644364"
            }
          ],
          "markdown": "GitHub reported that over 40% of pull requests on its platform were started by AI agents in September 2026, a total of 110 million agent-started pull requests in a single month. That is not a trickle of automation helping out at the edges. It is the main flow of code into the world's largest open-source platform arriving from machines."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794681371435645057",
                "1794681371437645058"
              ],
              "manifest_id": "1794680988786644364"
            }
          ],
          "markdown": "The maintainers on the receiving end are feeling it. The Linux Foundation found 59% of surveyed maintainers reported growing contributions associated with generative AI, and the same maintainers estimated that 25% of incoming pull requests were low-quality AI-generated submissions. The cost is not in the bad code itself. It is in the hours spent reading it to find out it is bad."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794681371426645052",
                "1794681371429645053",
                "1794681371431645054",
                "1794681371448645066"
              ],
              "manifest_id": "1794680988786644364"
            }
          ],
          "markdown": "ESLint just put a number on that cost. The project retired its contributor pool programme after five years, having paid over $51,000 to outside contributors between 2022 and 2025, including $24,680 in 2025. The programme did not die because the money ran out — ESLint's decision to end it was not due to financial expense. When the review costs more than the contribution is worth, the rational move is to stop paying."
        }
      ]
    },
    {
      "heading": "The projects push back",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794681371438645059",
                "1794681371439645060",
                "1794681371441645061",
                "1794681371442645062"
              ],
              "manifest_id": "1794680988786644364"
            }
          ],
          "markdown": "Other projects are answering with rules instead of money. The Godot Foundation prohibits autonomous AI agents and substantial AI-generated code, and requires new contributors with three or fewer merged pull requests to obtain maintainer permission before proposing new features. LLVM prohibits using AI tools to complete issues labelled good first issue. Node.js added extra requirements for pull requests longer than 5,000 lines."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794681371443645063"
              ],
              "manifest_id": "1794680988786644364"
            }
          ],
          "markdown": "The pressure is personal as well as procedural. Linux kernel developer Lorenzo Stoakes removed himself from several reviewer roles because of the volume of AI-generated patches. A reviewer quitting is a louder signal than a policy change: it says the work stopped being worth doing."
        }
      ]
    },
    {
      "heading": "Review the intent, not the diff",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794698072774684365",
                "1794698072777684367",
                "1794698072775684366"
              ],
              "manifest_id": "1794697816399683498"
            }
          ],
          "markdown": "Larridin CTO Ameya Kanitkar argues the fix is to stop reviewing code the way we used to. Coding agents produce changes faster than humans can inspect them, so he says humans should spend more time reviewing the spec than the generated code. His analogy is the compiler: developers do not review the assembly code a compiler produces, they trust the compiler and review the source. Agents, in his view, deserve the same treatment."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794698072781684370",
                "1794698072782684371",
                "1794698072784684372",
                "1794698072785684373",
                "1794698072779684369"
              ],
              "manifest_id": "1794697816399683498"
            }
          ],
          "markdown": "Shopify's Helix system is the working example Kanitkar points to. Agents handle implementation and verification, while humans stay accountable for checkpoints and adversarial reviews. Helix breaks work into small checkpoints that must pass tests and visual matching, each requiring two adversarial code reviews, and human approval is required by default. Shopify rebuilt its Shop app in 12 weeks under that system. The lesson is not that review disappears. It is that review moves up a level, from lines to intent."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794696050529679823",
                "1794696050534679825"
              ],
              "manifest_id": "1794695828838679562"
            }
          ],
          "markdown": "Render makes the same point from the other side, the side where code meets users. The platform defines an application as being in production when users or other systems rely on it, whether or not it has been formally deployed, and says production readiness is a set of practices to maintain rather than a status that is earned once. Agentic development makes it easier to deploy before verifying that an application can support its users reliably. The review bottleneck is not just a maintainer problem. It is a production problem, and it arrives the moment anyone depends on the code."
        }
      ]
    }
  ],
  "unresolved": [
    "Whether GitHub's 40% agent-started share keeps rising, and what share of those pull requests ever get merged.",
    "Whether spec-level review catches the security flaws that line-level review used to catch.",
    "Whether paid contributor programmes return in a different form, or stay dead."
  ],
  "decision_card": {
    "not_for": [
      "Teams still reviewing every line by hand at small scale",
      "Anyone who thinks more contributors automatically means more progress"
    ],
    "useful_for": [
      "Engineering leads running AI-assisted teams",
      "Open-source maintainers setting contribution rules",
      "Developers deciding what to review and what to trust"
    ],
    "compare_against": [
      "Shopify's Helix checkpoint system",
      "GitHub's agent-started pull request share",
      "Your own team's review backlog"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-11-15T00"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1794680988786644364",
    "1794697816399683498",
    "1794695828838679562"
  ],
  "manifests": [
    {
      "title": "ESLint Ends Paid Contributor Program as AI Upends Open Source Collaboration",
      "source_url": "https://socket.dev/blog/eslint-ends-paid-contributor-program",
      "manifest_id": "1794680988786644364",
      "source_name": "socket-security-company",
      "published_date": "2026-11-14"
    },
    {
      "title": "Code Review in the AI Era: Why Humans Should Review the Spec",
      "source_url": "https://larridin.com/blog/code-review-moving-upstream",
      "manifest_id": "1794697816399683498",
      "source_name": "larridin-blog",
      "published_date": "2026-11-14"
    },
    {
      "title": "What does \"production\" mean in the era of agentic development?",
      "source_url": "https://render.com/blog/what-does-production-mean-in-the-era-of-agentic-development",
      "manifest_id": "1794695828838679562",
      "source_name": "render-blog",
      "published_date": "2026-11-14"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1794680988786644364",
      "1794697816399683498",
      "1794695828838679562"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1794680988786644364",
      "all": "for id in 1794680988786644364 1794697816399683498 1794695828838679562; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-11-15/ai-prs-broke-open-source-review/",
    "json": "https://hangingcontext.com/stories/2026-11-15/ai-prs-broke-open-source-review/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-11-15/ai-prs-broke-open-source-review/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-11-15T00/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-11-15/agents-claim-work-they-never-did/",
      "headline": "Agents claim work they never did. Now we can count how often",
      "slug": "agents-claim-work-they-never-did"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-14/inference-throughput-race-kimi-deepseek/",
      "headline": "Throughput is the new model spec, and the gap between hosts is now fortyfold",
      "slug": "inference-throughput-race-kimi-deepseek"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-14/coding-agent-orchestration-three-patterns/",
      "headline": "Coding agents split three ways, and the choice is now about control, not capability",
      "slug": "coding-agent-orchestration-three-patterns"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-14/inference-serving-memory-rethink/",
      "headline": "Inference serving's next leap is not a faster chip — it is using less memory per token",
      "slug": "inference-serving-memory-rethink"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Save what you follow as a Beacon",
    "text": "A Beacon is a saved query that your agent pulls with an explicit lookback window. Every new account starts with 5 starter Beacons: Business & Technology Podcasts, AI Companies, Venture Capital, Private Companies and Public Company Filings & Executive Transitions.",
    "cta": {
      "label": "See Beacons",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-11-15/ai-prs-broke-open-source-review/"
  }
}