You installed F-Droid because you were tired of the proprietary black box. You wanted privacy. You wanted security. You wanted an escape hatch from the surveillance capitalism of Google Play. When you download an app from F-Droid, you aren’t just getting software—you’re getting a philosophy.
You didn’t just download an app; you downloaded a philosophy. But that philosophy has been hacked by a zero-cost machine.
But something has shifted in the last two years. The open-source oasis is quietly turning into an automated landfill, and the culprit isn’t just bad code—it’s AI-generated “slop” designed to look exactly like a passion project.
Recently, an investigation into F-Droid’s repository tried to answer a terrifying question: How much of this open-source app store is actually generated by Large Language Models? The findings were a wake-up call. But the real horror isn’t the sheer volume of AI code. It’s the simulated lifecycle.
Take a pair of bizarre apps recently flagged: DuressKeyboard and UnlicenseLauncher. Both are branded with the yellow “Don’t Tread on Me” flag. They’ve been in “development” for quite some time, showing steady activity. To a casual observer, they look like the work of a dedicated, slightly eccentric libertarian hobbyist.
But look closer at the commit history. None of the changes were made locally using git. They were all done through the GitHub web file editor. Why does that matter? Because it reveals a bot simulating human activity over time, drip-feeding superficial changes to build a fake history of social proof.
The most dangerous AI slop isn’t a broken app that crashes on launch. It’s the app that perfectly simulates the life of a hobbyist developer.
This is the real disruption LLMs bring to open-source ecosystems. F-Droid relies on transparency and community vetting to know whether something is a genuine maintainer project or a hollow artifact. We look for commit histories, steady updates, and active maintainers as signals of trust. AI has completely collapsed the cost of manufacturing those signals.
When the cost of faking a human is zero, the cost of verifying a human becomes infinite.
This creates an unwinnable arms race. F-Droid’s human curators have finite time, energy, and resources. AI generation is infinite and costs pennies. The more successful F-Droid becomes as a transparent, community-vetted haven, the more it attracts automated noise. We built an oasis to escape the proprietary desert, only to let automated bots pump it full of industrial runoff.
If you rely on F-Droid for private, secure, or ideological reasons, you can no longer assume “open source” means “human-made and reviewed.” The trust layer of the ecosystem is actively being poisoned, and the provenance tools needed to fix this don’t exist yet.
Trust isn’t a license you can append to a repository. It’s a human connection—and we are losing it to a machine.
FAQ
Q: Isn't all code just code? If it works, why does it matter if AI wrote it?
A: Because we don't know if it works. Open source isn't just about the final binary; it's about the ability to audit the human intent behind the code. AI can generate functional code that hides malicious intent, and it can fake the community trust signals that normally filter out bad actors.
Q: What should I do to protect myself right now?
A: Stop blindly trusting commit histories. If you need high-security apps (like 2FA or password managers), stick to well-known, heavily scrutinized projects like Bitwarden or Yubico's official apps, and scrutinize the commit patterns of new or obscure apps.
Q: Maybe this is just the evolution of coding. Why fight it?
A: Because open source is fundamentally a social contract, not just a codebase. If we accept infinite AI noise, we destroy the signal of human accountability. It's not evolution; it's a tragedy of the commons where bots privatize the attention economy of human curators.