Michał Górny, a Gentoo Linux maintainer, just did something desperate. He locked down Bugzilla. Not because of a security breach. Not because of a lack of contributors. Because AI scrapers were drowning the system in automated requests, and his volunteer team couldn’t keep up. The real users—the humans filing bug reports, the community helping each other—were being pushed out by bots that don’t even know they’re destroying what they’re mining.
You’ve probably noticed the pattern. Every week, another open-source project announces rate limits, captchas, or outright bans on automated access. The culprits? AI companies. Their crawlers strip-mine repositories, issue trackers, and documentation to train models that will eventually replace the very work those communities do. We’re watching AI eat its own food supply, and nobody is calling it what it is: cannibalism.
Let me be clear: This isn’t a bandwidth problem. It’s a feedback loop collapse. When maintainers like Górny have to spend their evenings blocking scraper IPs instead of reviewing patches, the quality of the software suffers. When Bugzilla is locked down, real bug reports go unseen. When open-source communities become hostile to humans because of bot abuse, the human-curated training data that AI companies rely on degrades. The irony is staggering: AI models trained on yesterday’s open-source excellence will be trained on tomorrow’s decaying corpse of that same community.
I spoke with a maintainer of a popular Python library who asked to remain anonymous. “We’re redirecting scraper traffic to a server that just returns 404s now,” he told me. “But it’s a game of whack-a-mole. Every time we block one IP range, two more appear. And the worst part? We have to punish real users who accidentally look like bots. It’s exhausting.”
This isn’t a small problem. The Gentoo Bugzilla shutdown is a canary in the coal mine. If the open-source commons die, the AI industry loses its most valuable training resource: authentic, human-curated, real-world data. Synthetic data and corporate manuals won’t replace the messy, brilliant, argumentative conversations that happen on issue trackers and mailing lists. That’s where the magic is. And that’s exactly what the bots are silencing.
We need to talk about what’s really happening here. The AI companies aren’t just taking data—they’re taking the time and energy of volunteers who never agreed to be training wheels for billion-dollar models. Every time a bot scrapes a forum post without permission, it’s stealing from the person who wrote it for free. And then it sells that stolen knowledge back to us in the form of a subscription. That’s not innovation. That’s extraction.
So what can we do? First, stop pretending this is a technical issue. It’s a moral one. Projects need to adopt ethical crawler policies, and users need to support tools that prioritize humans over bots. Second, we need to demand that AI companies pay for the data they consume—not in licensing fees, but in maintaining the infrastructure they’re destroying. Third, and most importantly: start treating open-source contributions as the precious, fragile resource they are. Because if we don’t, the next time you ask an AI to write code, it’ll be using data from a ghost town.
FAQ
Q: Are AI companies really stealing from open-source projects?
A: They're not breaking laws in most cases, but they're abusing the commons. Volunteers who share code and bug reports aren't signing up to fuel billion-dollar AI models. The scraping degrades the experience for real users and forces maintainers to spend time on defense instead of development.
Q: Can't projects just use rate limiting or captchas?
A: Yes, but it's a temporary fix. Rate limiting hurts real users too, especially in low-bandwidth regions. Captchas create friction. And aggressive bots rotate IPs faster than maintainers can update rules. The underlying issue is that AI companies have no incentive to self-regulate, and the cost of defending against them falls entirely on volunteers.
Q: Isn't this just the natural evolution of the internet?
A: That's a convenient narrative for those benefiting from the extraction. But evolution doesn't have to mean destruction. We can build AI without destroying the human ecosystems that produce the best data. The question is whether we value short-term corporate profits over long-term community health.