COSMIC and GNOME projects diverge on AI contributions and bug reports
System76's COSMIC desktop environment has updated its contributor guidelines to explicitly ban AI-generated content—including code, comments and pull request descriptions. GNOME projects including GNOME Calendar and GNOME Extensions have implemented similar restrictions, reflecting broader concerns within the open-source community about maintaining human control of code quality.
However, GNOME developer Michael Catanzaro has published multiple blog posts arguing the community should accept AI-generated bug reports, contending that the volume of vulnerabilities discovered by artificial intelligence is too valuable to discard. COSMIC is a relatively new Linux desktop written in Rust, with its first stable release shipped in 2025, and the wider debate reflects growing tensions in open-source development between maintaining human quality standards and leveraging AI's practical capabilities in security research.
- System76's COSMIC and GNOME projects ban AI-generated contributions to maintain code quality
- One developer argues communities should accept AI-discovered security vulnerabilities despite restrictions
- The debate highlights tension between human oversight and AI's practical value in security
New here? Start with this
COSMIC is a desktop environment for Linux created by System76, released in 2025, whilst GNOME develops widely-used software components like Calendar and Extensions. Open-source projects are increasingly facing questions about artificial intelligence tools that can generate code, documentation and other technical contributions. This has created debate within the community about whether to accept or restrict such AI-generated content.
Some in the open-source community argue that AI-generated code and documentation should be restricted or banned, citing concerns that AI contributions compromise code quality and human oversight of the codebase. Others counter that artificial intelligence offers practical value, particularly for security work, and that valuable discoveries—such as security vulnerabilities—should not be discarded simply because they came from AI rather than a human researcher.
How major projects like COSMIC and GNOME handle AI contributions will likely influence the broader open-source ecosystem and shape expectations for other projects. The debate raises fundamental questions about how open-source communities should balance their commitment to quality and human control with the practical capabilities AI can offer. The outcome will have lasting implications for how software is developed in the future.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The practical argument for accepting AI-generated bug reports is compelling: vulnerability discovery tools powered by artificial intelligence identify real security flaws at scale that would otherwise go unpatched. Categorically rejecting these reports based on their origin, rather than their merit, discards genuinely valuable security research. A bug discovered by AI that successfully patches a real vulnerability has contributed far more than a perfectly-written human report about a non-issue. Quality should be assessed on whether the vulnerability exists and the report's usefulness, not on who or what created it.
The case against
Open-source communities thrive on human expertise, accountability and shared responsibility for code quality. AI-generated content, even when occasionally useful, introduces unreliable elements: inconsistent analysis, false positives disguised as plausible suggestions, and stripped authorship that obscures intent and complicates maintenance. Accepting AI contributions wholesale risks transforming collaborative projects into repositories for mass-generated content, diluting community standards. Maintaining principled boundaries—that humans should deliberate over what enters codebases—protects both the technical quality and the human character that makes open-source communities work.
Read the full article at the source →
Originally published by The Register as “COSMIC shuts the door on AI code as GNOME debates letting bug reports in”.