It's a really difficult problem. I read a comment on here the other day about the increased burden on project maintainers that I sympathized with, but I wonder if the solution isn't actually just more emphasis on reputation tools for individual committers. It seems like the metric shouldn't just be "uses AI assistance" vs "doesn't", which as you note just leads to people hiding their workflow, but something more tied to "average quality of PR." I worked in finance briefly and was always really intrigued by the way responsibility worked for the bankers themselves: they could use any tools they wanted to produce results, but it had to be transparent and if someone was wrong the pretty strict burden fell on that IC personally.

The worst case for AI and OSS is a flood of vibe-coded PRs that increase bugs/burden on project maintainers; the best case is that talented but time-starved engineers are more likely to send the occasional high-quality PR as the time investment per PR decreases.

That’s a good point. My concern is that these tools will increase the gap between the trusted contributors to a project and people honestly trying to get their first patch in, because the latter now have to make themselves noticed in a sea of low-quality spam.

I guess I haven't been an OSS maintainer in too long and might be a bit naive, but I still feel like completely incompetent "vibe-coded PRs" can't be that common... I understand why unqualified people try to spin-up X vibe-coded app that turns out to be a complete nightmare, but not why they would flood github with random PRs: there just doesn't seem to be all that much or even any incentive to push out PRs for free, especially if you more-or-less need a pro Claude subscription.