Related ToolsClaudeClaude CodeCursorCody

systemd Rejects Call to Ban AI Code, Maintainers Say Claude Finds Real CVEs

Claude by Anthropic
Image: Anthropic

A GitHub issue demanding that the systemd project ban all AI-generated code contributions was closed today as "not planned," capping a heated debate that cuts to the heart of how open-source infrastructure projects are grappling with AI tools.

The trigger: systemd recently added an AGENTS.md file to its repository. This is a configuration file that gives instructions to AI coding agents like Claude Code and Cursor, telling them how to build, test, and contribute to the project. To critics, adding this file was an endorsement of AI-assisted development in one of Linux's most critical components.

The Case Against

The issue, filed on March 13, quickly drew community members raising three main objections.

First, licensing risk. AI models train on code under many different licenses. If a model outputs code originally written under GPLv3 or AGPL, it could create license conflicts with systemd's LGPLv2.1 codebase. And in the US, AI-generated content may not be copyrightable at all, following a Supreme Court decision in March 2026.

Second, code quality. Contributors cited a December 2025 CodeRabbit study finding that AI-generated code produced 1.7x more issues than human-written code and was 1.4x more likely to contain critical bugs. For a project written in C that runs as PID 1 (the first process the Linux kernel starts, responsible for managing every other service on the system), the tolerance for memory corruption bugs is essentially zero.

Third, a separate study found 62% of AI-generated code had security vulnerabilities when LLMs were tasked with building a secure backend.

Several commenters pointed to the Zig programming language's strict no-AI policy as a model to follow.

Poettering's Defense

Lennart Poettering, systemd's creator and lead maintainer, pushed back directly. "It would be dishonest to not accept the fact that Claude code reviews actually got really really good recently," he wrote. He described AI code review quality shifting from "95% slop and 5% ok" to "80% really good, and 20% garbage," and said Claude had been finding real CVEs (publicly disclosed security vulnerabilities) in recent weeks.

Another systemd maintainer, Luca Boccassi, backed this up with a concrete example from that same day. He had introduced a bug while applying review comments from other human contributors. Four core maintainers reviewed the code and none caught it. When he ran the AI review bot out of curiosity, it flagged the mistake immediately. "Had I asked the bot for a review in the original PR, so much time would have been saved," he wrote.

The project's AGENTS.md file does require AI disclosure: contributors must add a Co-developed-by: Claude tag to commit messages when using AI tools, and all AI-generated output requires human review before submission.

A Proxy War for a Bigger Question

This fight is not really about systemd. It is about whether open-source projects that form the backbone of modern computing should adopt AI tools at all. The Linux kernel itself now has an official policy for AI-generated content, as systemd maintainer Daan De Meyer pointed out in the thread.

The practical reality is that maintainer bandwidth is the bottleneck for most open-source projects, not ideology. systemd's team is small relative to the codebase's importance, and if AI review tools genuinely catch bugs that four experienced humans miss, rejecting them on principle has a real cost in shipped vulnerabilities.

But the licensing and copyright concerns are not hypothetical. Until there is legal clarity on whether AI-generated code can carry a license at all, projects accepting AI contributions are operating in a gray area. The systemd team has chosen to move forward anyway, with disclosure requirements as a safeguard. That bet will look either pragmatic or reckless depending on how the legal landscape develops.