● The result: an “attention DDoS” (distributed denial of service) that exhausts maintainers, who are forced to spend hours sifting through code generated in a matter of seconds. For Philippe Ensarguet, the solution does not lie in rejecting AI but in a new social contract and new practices, with a view to ensuring the sustainability of open-source projects: prioritizing triage, review, and documentation over lines of code.
● Without this, the ecosystem may drift toward one of the three scenarios he describes: walled gardens, a verification layer, or a bifurcation between locked-down critical infrastructure and application repositories left to automation.
Is AI disrupting the collaborative model of open source? Historically, this model has been based on an implicit social contract grounded in the efforts of project contributors. Philippe Ensarguet, VP of Cloud & Software Engineering at Orange, points out that “the act of contributing was, in itself, proof of one’s commitment.” He adds: “Writing a patch, reviewing a ‘diff’—all of that required human effort, and ultimately that effort served as proof that someone understood the project. ” But generative artificial intelligence has shattered this friction filter. Because today, “LLMs have reduced the cost of producing a contribution that appears plausible to virtually zero.” The result: a governance crisis in open-source projects.
The code was never the contribution itself. It was merely the visible sign of it: the sign that one had understood the project, that one had invested in it, that one was part of it.
The “DDoS of Attention” and the Burnout of Maintainers
The open-source ecosystem is facing a wave of low-quality, unsolicited AI-generated contributions, known as “AI slop.” These contributions are not characterized by being obviously bad, but rather by being plausible: flawless syntax, hidden logical flaws. While AI impacts production costs, “it does absolutely nothing to reduce the cost of evaluation. We’re entering a form of asymmetry that is entirely structural.” The order of magnitude he cites: about thirty seconds to generate a patch, several hours to conduct a thorough review.
“On the one hand, we have a virtually infinite and inexpensive generation, and on the other, finite human attention.” This imbalance causes what the expert describes as “a denial-of-service—most often unintentional—on the part of maintainers,” pushing these volunteers toward cognitive exhaustion. Worse still, the contract of trust erodes because “every contribution potentially becomes suspect.” This is what led, for example, Daniel Stenberg, the creator of the cURL project, to shut down his bug-hunting program after being flooded with fake reports.
The 5 Layers of Contribution
The underlying problem isn’t AI’s ability to produce code. Models can generate code with flawless syntax. In fact, a true contribution goes far beyond that. According to Philippe Ensarguet, open source was ultimately built on a misunderstanding: “The code was never the contribution; it was merely the visible sign of it—the sign that a developer had understood the project, had invested in it, and was part of it.” Of the five theoretical layers of contribution, AI masters only the first two (syntax and execution). The higher layers—understanding the architecture, true intent, and mutual trust—are, according to the expert, beyond its reach, even though they represent “the glue that ultimately holds the open-source ecosystem together.”
Redefining the Social Contract
This isn’t about becoming technophobic. “We’re never going to go back… that would be regressive and would amount to failing to ask the right questions about how we can envision the use of AI.” For him, the urgent need is to reevaluate our metrics. “The number of lines of code, the number of pull requests, commit graphs, and contributor curves no longer reflect the value produced.” The dashboards used to assess a project’s health are increasingly measuring noise. From now on, communities must prioritize triage, code reviews, and documentation, and require contributors to demonstrate commitment rather than volume.
In light of this transformation, Philippe Ensarguet describes three possible trajectories—that is, states toward which the ecosystem could drift. The first is that of “walled gardens,” where only “identity-verified” individuals can participate, turning open source into a “resource that is available but with no guarantee of participation,” explains Philippe Ensarguet. A second path would involve a verification layer with platforms that “validate proof of commitment in order to eliminate friction.” The final plausible trajectory, according to the expert, is that of “bifurcation.” Here, the ecosystem would split into two distinct regimes: critical infrastructure would be locked down according to the first scenario, while application repositories would accept a higher level of noise, absorbed by fully automated test chains. The historic disappearance of technical friction therefore requires a new social contract: “You don’t necessarily need a lot more code. Above all, more attention is what you need.”
