Godot Just Banned AI Contributions, and the Reason Isn't What You Think

Godot Just Banned AI Contributions, and the Reason Isn't What You Think

If you only read the headline, open source game engine bans AI code, you'd assume this is an ideology story. Anti-AI holdouts drawing a line in the sand, principles over pragmatism, the usual comment section war.

But it isn't. Read the actual blog post the Godot Foundation published on June 30 and you'll find something much less romantic and much more interesting: a resource allocation problem that got bad enough to require a policy change.

Godot didn't ban AI because AI is bad. They banned it because their reviewers were running out of reasons to show up. Godot's reviewers are volunteers. They aren't paid, so their compensation is the sense that a review teaches someone.

That the person on the other end absorbs the feedback, gets better, sticks around, and eventually becomes a reviewer too. That's the succession pipeline the Foundation says it's protecting.

When the PR came from a model, or from someone who feeds your feedback back into a model, that payoff disappears. You spent your Saturday writing a careful critique and nothing on the other end learned anything. Do that enough times and you stop opening the review queue.

What the policy actually says

There are four rules, and they're refreshingly unambiguous:

No autonomous AI agents, no vibe coding. This one was already enforced informally, it triggers an automatic ban from the GitHub repo, and that isn't changing. The June announcement just wrote it down.

No AI-generated code of any substance. All code has to be human-authored. AI assistance gets confined to what the Foundation calls menial work: code completion, regex, find-and-replace. If you used AI at all, you have to say so in the PR discussion.

No AI-generated text in human-to-human communication. Maintainers volunteering their time to review your PR don't want to read something a model wrote for you. Machine translation is still fine, as long as a human wrote the original.

Every PR gets human review and approval before merge. Already true, now explicit.

There's a fifth change that got less coverage but might matter more day-to-day: new contributors can't submit new features or significant refactoring without explicit maintainer permission first. A "new contributor" is anyone with three or fewer merged PRs. Fix bugs, write docs, build some trust, then propose the thing.

The part that's actually the argument

Here's the sentence that matters the most in Godot's post, and it's worth sitting with:

"AI cannot take responsibility"

Everything else follows from that. Godot's stated goals are to keep growing new contributors into future maintainers, and to make sure whoever submits code can be held accountable for it and is able to fix it when it breaks. Neither of those survive contact with a workflow where the contributor doesn't fully understand what they submitted.

And then there's the emotional economics, which the Foundation is unusually honest about. Reviewing pull requests is tedious. It's always been tedious.

An LLM can't learn from your specific feedback. So when a reviewer writes three paragraphs explaining why an approach is wrong and that feedback gets fed back into a model by someone who doesn't understand either the code or the critique, the reviewer has just spent their evening producing nothing durable.

Godot calls this demoralizing, and maintainer Rémi Verschelde had said much the same earlier in the year, that AI PRs were becoming draining and demoralizing wastes of time.

The problem is that the effort required to produce a PR collapsed while the effort required to review one stayed exactly the same. Generation got cheap. Verification didn't. The economics inverted, and the volunteer side of the ledger is where the cost landed.

Godot is late, not early

This is the context most coverage skipped. Godot is joining a line that's been forming for over a year.

curl is the loudest case. Daniel Stenberg shut down the project's six-year HackerOne bug bounty in January 2026 after roughly $86,000 in payouts, with valid submissions collapsing to around 5% as AI-generated reports climbed.

His post "Death by a thousand slops" is the canonical text here. He'd concluded that a bounty gives people too strong an incentive to invent problems in bad faith.

The pressure got worse from there. In June he announced the "curl summer of bliss": from July 1 to August 3, curl accepted no vulnerability reports at all. HackerOne form closed, security email a dead end, no exceptions. Sebastian Pipping's libexpat announced it was taking the same break.

Security reports are a special kind of poison. You can skim a bad feature PR and close it. You cannot skim a plausible-sounding vulnerability report, because the cost of dismissing a real one is catastrophic. Every fake one gets a full investigation. That asymmetry is why bug bounties broke first.

Nextcloud ended its bug bounty in April 2026 for the same reason.

Ghostty shipped a standalone AI_POLICY.md in January 2026, Mitchell Hashimoto's framing was that it's not an anti-AI stance but rather, in his words, "an anti-idiot stance."

tldraw went nuclear and now auto-closes all external pull requests.

QEMU committed a code provenance policy into the repo that declines contributions where AI use is known or suspected, naming tools directly.

NetBSD requires prior written approval from its Core Team.

Someone is even maintaining a running index of projects that reject AI-generated code. That it exists at all tells you where this is.

If you want the taxonomy, All Things Open sorted the landscape into rough families: outright bans, permissive-with-disclosure, mandatory enforced disclosure via commit trailers, and structural closure.

Fedora, Rocky Linux, OpenTelemetry, the Apache Software Foundation, and OpenInfra all sit somewhere on that spectrum with published guidance. Godot lands near the strict end, but it's a spectrum, not a binary.

The parts nobody has solved

The new policy changes aren't perfect though:

No reliable detection. There is no reliable detector for AI-generated code. Maintainers are pattern-matching on tone, structure, and the way a contributor responds to feedback. That means false positives are inevitable, and the people most likely to get caught in them are non-native English speakers and inexperienced developers who happen to write in a tidy, generic style. Godot's translation carve-out shows they've thought about this, but it doesn't fully solve it.

Disclosure is an honor system. The rule says tell us if you used AI. The people submitting low-effort slop are, definitionally, not the people carefully filling out disclosure fields.

The line is genuinely blurry. Code completion is fine. Substantial generation is banned. Modern completion tools routinely emit ten-line blocks. Where exactly does "menial" end? Godot acknowledges this is a moving target and says they'll re-evaluate as tools change, which is the honest answer, but it leaves contributors guessing in the meantime.

The steelman

The obvious counterargument: AI tools lower the barrier to entry. Someone who doesn't know C++ or GDScript deeply can now attempt a fix they'd previously have skipped. Isn't that exactly the pipeline Godot claims to want to protect?

Maybe, but only if the person learns something in the process, and that's the specific thing Godot is saying doesn't happen. A contributor who can't explain their own patch isn't at the start of a learning curve.

There's also a broader economic version of this argument. Researchers at Central European University and the Kiel Institute for the World Economy published a paper with the extremely subtle title "Vibe Coding Kills Open Source", modeling what happens when AI agents pull in open-source packages without any of the follow-on engagement, docs reads, issue reports, upstream patches, that historically converted usage into visibility, sponsorship, and maintainer income.

What this actually signals

Godot matters here less because of what it decided and more because of who it is: a large, healthy, well-funded, growing project with real corporate sponsors.

This is not a burnt-out solo maintainer rage-quitting. It's a foundation with a board that spent months deliberating and then published a policy with reasoning attached.

That's a template. And the template's core insight isn't "AI bad." It's that open contribution models assumed submission effort was a natural filter.

That anyone willing to spend a weekend on a patch had probably read enough of the codebase to be worth talking to. That filter is gone. It's not coming back. Every project that depends on volunteer review is going to have to rebuild it deliberately, whether through AI policy, contributor tiers, PR rate limits, vouching systems, or something nobody's invented yet.

Godot picked its answer. The interesting question for the rest of 2026 is which projects pick differently, and whether any of those bets pay off better.


Sources

Stay Sharp. Weekly Insights.
New posts, framework updates and weekly software conversations.

No spam. Unsubscribe anytime.
Author profile picture
Walt is a software engineer, startup founder and previous mentor for a coding bootcamp. He has been creating software for the past 20+ years.
No comments posted yet
// Add a comment
// Color Theme

Custom accent
Pick any color
for the accent