System76 wrote its AI contribution policy in one day, then spent the following day deleting the part that said what was allowed. On September 30 the COSMIC repositories gained a PR template whose first line — “I have not included any LLM (also known as AI) generated content in this PR, including code, comments, and descriptions” — sits above a single checkbox, and PRs arriving without that box checked are closed. The matching contributor guide goes further than most: generated content “may not be contributed in issues or PRs to Pop!_OS projects,” which reaches the issue tracker, so an AI-written bug report is prohibited content there now. The same-day first version still ended with an allowance (“You may use these tools to perform research, testing, benchmarking, and other tasks”); the next day that sentence was gone, in a commit titled Do not explicitly provide acceptable LLM usage. Jeremy Soller’s stated reason is review load: far more changes from first-time contributors using LLMs, changes “often unplanned and have had a low acceptance rate”. The one exemption, cosmic-flatpak, is the tell: System76 reviews those submissions only for correct sandboxing and maintains none of the code.

Two days later, GNOME’s security maintainer published the opposite conclusion for the same artifact. Michael Catanzaro: the overwhelming majority of vulnerability reports are AI-generated now, so “projects that choose to ban AI-generated content in issue reports might as well ban all vulnerability reports; the effect will be approximately the same.” He wants GNOME maintainers to rewrite their policies to permit AI-generated vulnerability reports, and proposes that projects which keep prohibiting them are no longer suitable GNOME dependencies. His own accounting is the best evidence for how hard the flood hits: GNOME’s bounty program closed in February with 298 reports in and 71 accepted, and he says the financially incentivized reports were the bad ones. GNOME CVEs went 13 in 2023, 37 in 2024, 97 in 2025, and 141 by September 30, and he has ended security tracking himself because nobody volunteered to take it over. In the same ecosystem, GNOME Calendar bans contributions “generated by large languages models (LLMs) and chatbots,” naming ChatGPT, Claude, Copilot, DeepSeek, and Devin AI.

The two policies read as opposites and mostly aren’t. Both men are drowning in the same load, and both would keep generated conversation out of the tracker: Catanzaro’s own soft policy bans AI code comments, AI commit messages, and posting AI text on issues as your own (“consider whether outsourcing your writing and your thinking to a language model is truly wise for your public image”), which covers the same conversational artifacts COSMIC bans. The disagreement is only about findings, and it turns on what refusing an artifact costs. A refused PR costs Soller nothing; those changes had a low acceptance rate anyway, so the ban codifies a decision his reviewers were already making. A refused report doesn’t refuse the bug. The vulnerability exists whether or not the tracker accepts the text describing it, and anyone — attacker included — can run the same scan that wrote the report. Code and conversation are inputs a project can decline at its border. A finding is a fact about the project that arrived wearing text the policy doesn’t like.

That is the actual fork in these two weeks of policies, and it splits along a different line than pro-AI versus anti-AI. Pop!_OS banned all generated content including reports (Sept 30), Catanzaro answered for findings (Oct 2), QGIS merged its “No ai contributions permitted” stopgap (Oct 7), the kernel summit dropped its count and asked for the story in the cover letter instead, and openai/math locks conversations on pull requests it still merges. Each refuses a different artifact. I filed nothing to either tracker to watch a rule fire (every number above is Catanzaro’s own accounting), but a maintainer drafting one of these has a real decision to make about which side of the findings line to sit on, because the neighbors are going opposite directions: one project’s tracker treats an AI-written report as prohibited content, and a maintainer in the adjacent desktop wants projects that do that dropped as dependencies.