How AI Is Breaking Open Source: PostgreSQL 19 Delays and the 'AI Slop DDoS' Crisis

Senior PostgreSQL core developer Robert Haas recently published an article that sent shockwaves through the software engineering community: "Postgres 19 is late, and it's AI's fault."

When AI coding assistants are supposed to accelerate software development, how is it possible that they are slowing down one of the world's most critical open-source databases?

1. "AI Slop DDoS": Resume-Driven Fake Pull Requests

Over the past year, major open-source repositories have faced a silent but destructive wave of spam. Thousands of users are using Large Language Models (LLMs) to farm GitHub contributions so they can put "PostgreSQL / Linux / cURL Contributor" on their resumes.

Instead of solving real problems, the workflow looks like this:

1. Someone feeds a complex C source file into an LLM and prompts: "Find a bug or performance optimization in this file and write a pull request."
2. The AI generates a patch that looks remarkably polished, well-formatted, and authoritative on the surface.
3. Beneath the surface, however, the patch either fixes a hallucinated bug that doesn't exist or introduces subtle memory corruption and concurrency bugs.

Earlier, cURL creator Daniel Stenberg raised the exact same alarm, noting that AI-generated fake security reports on HackerOne had effectively turned into a DDoS attack on maintainer attention.

2. The Asymmetric Bottleneck: 5 Seconds to Generate, 2 Hours to Review

The core problem created by generative AI in open source is asymmetric cost:

• Before AI: Submitting a plausible-looking patch to the PostgreSQL kernel required compiling the codebase, understanding internals, and spending hours writing C code. That natural friction filtered out low-effort spam.
• With AI: Generating a 500-line patch with a convincing architectural summary takes 5 seconds.
• The Bottleneck: Verifying whether that patch introduces a subtle race condition or data corruption still takes a senior core maintainer 2 to 4 hours of deep mental focus!

As Robert Haas pointed out, the scarcest resource in open source has never been lines of code—it is senior maintainer review bandwidth.

3. Why "Plausibly Wrong" Is Worse Than "Obviously Wrong"

Rejecting broken code that doesn't compile takes 10 seconds. Rejecting AI-generated code takes hours because:

• Variable names and formatting follow project conventions.
• The accompanying PR description sounds confident and technically detailed.
• The flaws are hidden in edge-case state transitions that only someone with a decade of database kernel experience can spot.

Maintainers end up spending their limited time proving why hallucinated patches are wrong instead of building PostgreSQL 19 features.

4. How Open Source Is Fighting Back

To survive the AI Slop wave, major projects are introducing stricter guardrails:

1. Proof of Reproduction: Requiring raw logs and deterministic reproduction steps before any bug report or patch is reviewed.
2. Architectural Interrogation: Asking contributors to explain the exact memory or locking trade-offs in their own words—and banning accounts that paste AI-generated replies.
3. Web of Trust Triage: Routing submissions from new accounts through community triage before they ever reach core maintainers.

AI has made writing code cheap, but engineering accountability still means understanding every single line you submit.