Generative AI tools are cutting coding time by up to 50% on open-source projects while flooding them with low-quality submissions, with maintainers estimating that 25% of incoming pull requests are "AI slop," according to a new study from the Linux Foundation's research arm. The share rises to 31% on large projects. The report, sponsored by Red Hat with support from Futurewei, OpenSSF and LF AI & Data, concludes that governance, not tooling, is now the critical gap: only 35% of projects have a formal policy permitting GenAI use, and 32% have no policy and no plans to create one.
The productivity side of the finding is genuine and, in places, being put to good use. LF Research reports a 52% reduction in time spent on code authoring, and says developers are reinvesting the recovered time: 66% toward paying down technical debt and 63% toward new features. The gains are uneven, though. For high-complexity tasks, 21% of respondents said GenAI made them slower, a reminder that the tools help most on routine, well-specified work and least on anything requiring architectural judgment or undocumented context.
The slop problem is better read as a governance failure than a model failure. When a third of projects set no rules, contributors face no friction in submitting AI-generated code, and maintainers absorb the full cost of reviewing it. The report found 53% of maintainers disagree that GenAI has improved community trust, and that their workload is growing. One project's open contribution norms, built for an era when submitting a patch took real effort, become a liability once a model can generate a plausible-looking one in seconds.
The consequences run downstream to nearly every company, because nearly every company builds on open-source components. The integrity of that supply chain has always rested on trusting that contributors understood what they committed; AI-assisted submissions that lack disclosure, testing or documentation erode that assumption at scale. Automated software composition analysis catches known vulnerabilities, but not code that compiles cleanly and passes surface tests while embedding incorrect or undocumented logic. The report frames this as a provenance problem that enterprises are now inheriting whether or not they have noticed.
The study is a leading indicator rather than a crisis already arrived. Its authors argue the projects that keep enterprise trust over the next two to three years will be those that build automated verification, clear attribution requirements and contributor testing into their pipelines now. Red Hat's sponsorship is not incidental; the commercial open-source ecosystem has a direct interest in the upstream commons not degrading. What the report cannot yet say is how fast the signal-to-noise ratio will shift, though it estimates a measurable change within 12 to 18 months as AI coding tools spread further. The faster contribution volume grows, the sooner manual review stops being able to keep up.