After months of fierce internal debate, Linus Torvalds and the Linux kernel maintainers have officially codified the project’s first formal policy on AI-assisted code contributions. The result is a carefully calibrated framework that neither bans AI tools nor embraces them without conditions: developers may use GitHub Copilot, Claude, ChatGPT, or any other AI assistant to help write kernel code — but every single line that comes out the other end is entirely their legal and ethical responsibility.
The move marks a historic turning point for one of the most consequential open-source projects in computing history. For decades, the Linux kernel has been maintained by a community of engineers who treated code quality as a near-religious commitment. Now, the project is grappling with the same AI-driven transformation reshaping software development everywhere — and it has chosen pragmatism over prohibition.
The Incident That Sparked a Crisis
The catalyst for the new policy was an incident involving Sasha Levin, an NVIDIA engineer and respected kernel maintainer. In early 2026, it came to light that Levin had submitted a patch to kernel 6.15 that was written almost entirely by a large language model — without disclosing that fact in the patch submission or its changelog.
The patch passed review and was accepted. But it contained a subtle performance regression that, in hindsight, kernel contributors attributed to the kind of plausible-but-imprecise reasoning that AI models sometimes produce. More troubling to the community than the bug itself was the opacity: maintainers had spent time reviewing and approving code that none of them knew had been machine-generated.
The backlash was swift. Torvalds himself commented that the patch had not been “properly reviewed,” in part because reviewers didn’t know what they were looking at. Levin, to his credit, acknowledged the misstep and became one of the strongest advocates for formalizing a disclosure standard. At the 2025 North America Open Source Summit, he proposed the first draft of what would eventually become the kernel’s AI policy.
The New Rules: “Assisted-by” and Full Accountability
The formal policy, now documented in the kernel’s contributor guidelines, centers on a new tag: Assisted-by. When a developer uses an AI tool to help generate code, they must include this tag in their commit message, formatted as:
Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]
For example, a developer using GitHub Copilot powered by GPT-4o might write:
Assisted-by: Copilot:gpt-4o
Critically, AI agents are explicitly prohibited from using the legally binding Signed-off-by tag — which represents a developer’s formal certification that the contribution complies with the Developer Certificate of Origin (DCO). Only a human can sign off. This means that regardless of how much of the code an AI wrote, the human submitting it bears full legal responsibility for every line, every bug, and every security flaw that results from it.
Torvalds summarized the philosophy bluntly in a mailing list post: “We’re not banning AI. We’re banning dishonesty about AI. If you use a tool, say so. And then stand behind what you submit.”
Why a Ban Was Never Realistic
The Linux kernel community didn’t arrive at this policy naively. Torvalds had long expressed skepticism about AI-generated code, particularly around the risk of “AI slop” — low-quality, plausible-sounding contributions that waste maintainers’ time and introduce subtle defects. As recently as January 2026, he argued that the problem couldn’t be solved with documentation policies alone.
But the reality is that AI coding tools have become ubiquitous. Trying to detect and ban AI-assisted code — when there’s no reliable way to do so — would have been unenforceable and counterproductive. Experienced contributors would simply stop disclosing their tool usage, making the problem invisible rather than managed.
The new policy acknowledges that developers are going to use AI assistants the same way they use static analyzers, compilers, and automated testing frameworks — as tools that augment human judgment, not replace it. The goal is to make that usage visible and to ensure accountability stays with the humans in the loop.
Big Tech Steps In With $12.5 Million
Alongside the kernel’s internal policy shift, the Linux Foundation announced in March 2026 a $12.5 million funding initiative aimed at helping open-source maintainers cope with a related but distinct problem: the flood of AI-generated bug reports.
The funding came from seven of the world’s largest technology companies: Anthropic, Amazon Web Services, GitHub, Google, Google DeepMind, Microsoft, and OpenAI. The money will flow through Alpha-Omega and the Open Source Security Foundation (OpenSSF), two security-focused organizations housed within the Linux Foundation.
The problem the funding addresses is real and growing. As AI tools have become capable of scanning codebases and generating vulnerability reports at scale, maintainers of widely used open-source projects have been inundated with low-quality, duplicate, or outright fabricated bug reports. The maintainer of cURL — a foundational networking library used on billions of devices — shut down their bug bounty program entirely after being overwhelmed. The Python Software Foundation raised similar alarms in late 2024.
The initiative’s goal is to use AI to fight AI: channeling the same capabilities that generate the flood of reports into triage and analysis tools that help maintainers sort signal from noise more efficiently. Early results, according to Linux kernel maintainer Greg Kroah-Hartman, are promising. Writing in late March, he noted that something shifted in recent months — the quality of AI-assisted bug reports has measurably improved, and some reports are now genuinely useful rather than noise.
A Precedent With Wide Implications
The Linux kernel’s AI policy doesn’t exist in a vacuum. It sets a precedent that other major open-source projects are likely to watch closely — and potentially adopt. The combination of a formal disclosure standard, a new metadata tag, and an explicit human accountability requirement offers a template that projects from the Apache Foundation to the CNCF ecosystem could adapt.
For enterprise developers, the implications are equally significant. Many organizations contribute to or maintain forks of the Linux kernel, particularly those building embedded systems, automotive software, or cloud infrastructure. Those contributors will now need to review their own internal policies on AI-assisted development and ensure their engineers are complying with upstream disclosure requirements.
The broader message from the kernel community is clear: AI is here, it’s being used, and pretending otherwise helps no one. What the Linux kernel has done is create a framework for honesty — a way to embrace modern tools without sacrificing the transparency and accountability that have kept one of the world’s most critical software projects running reliably for more than three decades.
In a world where AI is increasingly writing the code that runs everything, that may be the most important policy the kernel community has ever published.
