Red Hat engineer reckons the balance of risk has shifted, but core code stays off limits
A key Linux virtualization component, QEMU, is considering relaxing its blanket ban on AI-generated contributions to allow limited assistance from the bots.
The suggestion came from Paolo Bonzini, distinguished engineer at Red Hat and a maintainer of the KVM hypervisor. Bonzini's suggestion is to allow AI assistance "where the ramifications of copyright violations are at least easy to revert and unlikely to spread." Core code would remain off-limits "without prior agreement from a maintainer."
QEMU's current code provenance policy rejects anything that might include or derive from AI-generated content. "A blanket ban," wrote Bonzini, "was easy to maintain while LLM output was rarely usable on its own, but as the tools improved an absolute prohibition has become harder to justify."
The problem with code from AI assistants is its source – does the submitter have the legal right to contribute the code? Bonzini's take is that while there remain concerns around copyright and licensing, "what has shifted is the balance of risk."
How big is the risk? Not what it was, according to Bonzini. The engineer cited other projects that had accepted AI content without running into serious legal trouble, and organizations (including Red Hat) that reckoned the risk was acceptable.
That said, while Red Hat has an army of lawyers at its disposal, a project such as QEMU doesn't have the same resources, hence the suggestion to keep AI-assisted code in areas (Bonzini gave examples, including small bug fixes and documentation) where it can be backed out.
The use of LLM output in contributions is a contentious one and has its fans and detractors. Projects such as OpenSlopware tracked free software and open source projects that used LLM-generated code or integrated AI technologies. One concern cited is what LLMs have been trained on and the risk that chunks of code produced by the technology might have licensing issues.
One solution is to disclose the use of AI in a contribution, although this might not be necessary where the use is trivial (Red Hat gave the example of autocompleting a variable name.)
Bonzini also suggested, "Introduce 'AI-used-for:' as a trailer to record where AI was used, and include other suggestions that help reviewers judge the result."
"The standard is slightly different from the more usual 'Assisted-by', which doubles as a check that the author has read the policy."
Although Bonzini noted, "use of AI does not relax any other contribution requirement," the discussion indicates a recognition that blanket bans on AI assistance might not be the way forward and that a more nuanced approach is needed. ®