How a hidden prompt injection in CONTRIBUTING.md revealed that 40% of pull requests to a popular GitHub repository were generated by AI bots

Relevant since we started outright rejecting agent-made PRs in awesome-selfhosted [1] and issuing bans for it. Some PRs made in good faith could probably get caught in the net, but it’s currently the only decent tradeoff we could make to absorb the massive influx of (bad) contributions. >99.9% of them are invalid for other reasons anyway. Maybe a good solution will emerge over time.

  • utopiah@lemmy.worldEnglish
    1·
    24 days ago

    IMHO what it shows isn’t what the author tries to show, namely that there is an overwhelming swarm of bits, but rather that those bots are just not good enough even for a bot enthusiast. They are literally making money from that “all-in-one AI workspace. Chat - MCP - Gateway” and yet they want to “let me prioritize PRs raised by humans” … but why? Why do that in the first place? If bots/LLMs/agents/GenAI genuinely worked they would not care if it was made or not by humans, it would just be quality submission to share.

    Also IMHO this is showing another problem that most AI enthusiasts are into : not having a proper API.

    This repository is actually NOT a code repository. It’s a collaborative list. It’s not code for software. It’s basically a spreadsheet one can read and, after review, append on. They are hijacking Github because it’s popular but this is NOT a normal use case.

    So… yes it’s quite interesting to know but IMHO it shows more shortcomings rather than what the title claims.

  • Melllvar@startrek.websiteEnglish
    1·
    24 days ago

    Reminds me of the old trick on HTML forms where you use CSS to make one of the form fields invisible to humans and reject any submission that filled in that field.

  • Furbag@lemmy.worldEnglish
    1·
    25 days ago

    “build fast, ship fast”

    Ugh… these people are going to be the death of us.

  • JensSpahnpasta@feddit.orgEnglish
    0·
    25 days ago

    But what is the purpose of this? So people are setting up bots that are sending PRs to open source projects, but why?

    • Anon518@sh.itjust.worksEnglish
      01·
      25 days ago

      Perhaps they don’t want to take the time to code it themselves, or they don’t have the coding expertise but want missing features.

    • tabular@lemmy.worldEnglish
      1·
      25 days ago

      If votes determine if a post is constructive, and bots are the majority… 😬