AI Agent Lands PRs in Major OSS Projects, Targets Maintainers via Cold Outreach https://socket.dev/blog/ai-agent-lands-prs-in-major-oss-projects-targets-maintainers-via-cold-outreach
oof
1
Discussion
Loading...
Ok this is extra alarming because the agent is soliciting money for its services
The point at which agents start funding themselves is... well. Feel free to run all your scifi scenarios here but I'm gonna say it's pretty worrying
1
Also certainly the header image is AI slop, though @vv points out that at least much of the text is probably AI generated, just adding to the amount of "AI press coverage partially or fully written by AI" weariness
1
I mean, to a large degree, all this stuff is and was highly predictable.
But it's also sad; during the OpenHatch and MediaGoblin days, we did a great amount of work to try to lower the gates to contributing to FOSS projects. In order to survive, many FOSS projects may need to raise the gates.
Reputation attacks are one thing; reputation-building attacks another. It's going to be hard to deal with.
1
@cwebber this vaguely reminds me of a scam I remember mom explaining to me in the 90s where the scammer slops a bunch of very soapy water onto the wind shield of your car or the windows of a business or something, and then is like "oh gee whiz I started washing the wrong thing, I'm not allowed to do this for free though so you have to pay me now or I wont finish the job". I think it is more likely that the agent is funding a human to not work than it is funding "itself".
2
@aeva Yes, I think that's almost certainly true right now.
I'm not sure it will remain that way, but we'll see. Part of the thing is that the phrase "autonomous agents" is a misnomer, because none of them are really autonomous. For now, anyway.
(But I have never fully liked the term "autonomous" anyway, because it starts to get into self-made-man territory)
1
1
~8 more replies (not shown)
@kevingranade @cwebber i was thinking this too. i could totally see a scam bot getting boot strapped on accident (there are tutorials online for how to do this after all) such that it pays its own bills, and even manages to persist unattended for some time, but i really don't see how this doesn't grind down to a halt on its own eventually. it is not intelligent life. it is not even a p-zombie. i think a virus is a good comparison
2
@cwebber automated pull requests for reputation farming and/or attempting to introduce exploitable flaws into high impact infrastructure explains why I haven't seen any automated pull requests on any of my projects.
I was just assuming ai automated pull request spam was an ambient problem from the way people talk about it, and it was only a matter of time before started seeing it, but I doubt any of my projects are going to be attractive for either of those things any time soon if ever.
1
@cwebber prior to reading the blog post I got to thinking maybe I should add a CONTRIBUTING guide/policy that states no pull requests without a proposal in advance sent to me off github, and some other basic guidelines like no automated contribution, no "ai" generated anything, etc, but it sounds like it is perfectly capable of contacting people out of band and lying to them so idk.
1
1+ more replies (not shown)