You’ve felt it, haven’t you? The internet you grew up with—the one built on the promise of open access and shared knowledge—is slowly being walled off. You fire up your browser to check a public repository, and suddenly you’re staring at a login screen or a CAPTCHA. The friction isn’t a bug. It’s the new business model.
This week, GitLab announced changes to its rate limits on GitLab.com. Unauthenticated requests are being throttled to 60 per hour per IP address. That’s one request per minute. The community reaction was immediate and furious. Commenters pointed fingers at LLM scraping, lamenting the performative data extraction that is degrading the open web. “Congrats on making the world worse with AI,” one user wrote.
We are watching the death of the digital commons in real-time, and AI is the perfect scapegoat.
Most people read this as standard anti-scraping hygiene. They think GitLab is just protecting its servers from runaway bots. But if you look at the structural tension at play here, the reality is much darker—and much more calculated. GitLab’s core value depends on providing open, low-friction access to developers. But by making the platform less open to protect it from AI, they are undermining the exact experience that attracted users in the first place.
Why would they intentionally degrade their own product? Because the era of the human developer seat is ending, and the era of the AI agent is beginning.
Think about it. Developers are building agentic flows that automate code review, testing, and deployment. An AI agent doesn’t need a $50/month human seat. It just needs API access. As platforms see their human seat counts stagnate or drop, they need a new way to monetize the machines replacing us.
Rate limits aren’t shields against AI; they are the foundation of usage-based pricing.
If you want your AI agent to interact with a repository at scale, it can’t do it anonymously. It will need credentials. And once access is credential-mediated, it can be metered. It can be billed. The rate limit isn’t a wall; it’s a gate, and the gatekeeper is holding out his hand.
This isn’t just a GitLab problem. We’re seeing the exact same weird bot detection creeping across GitHub and other public code infrastructure. The shift is happening across the board. Public APIs and open repositories are being squeezed.
When the user stops being a human and starts being a script, the platform stops selling a subscription and starts selling a toll.
You feel frustrated because the shared digital commons you depend on is being paved over to build a highway for machines. Every platform you rely on is slowly becoming a toll booth. They aren’t just keeping the AI scrapers out; they are setting up the infrastructure to charge the AI agents that are already replacing your seat.
Prepare for a future where infrastructure is designed for machines, priced by the call, and fundamentally hostile to the curious, unauthenticated human developer. The open web is dead. Welcome to the metered web.
FAQ
Q: Isn't this just necessary infrastructure management to prevent DDoS and server overload?
A: No, it's a strategic pivot. If it were just about server load, they would invest in better infrastructure. Instead, they are specifically targeting unauthenticated, machine-driven traffic to set the precedent for credential-mediated access—which is the foundation of a paid, metered API tier.
Q: What does this mean for my dev team right now?
A: Prepare for your infrastructure costs to shift. You're going to be paying for agent API calls and usage-based metering instead of flat human seat licenses. Audit your automated workflows now, because the era of free, frictionless public code access is ending.
Q: So AI is actually helping these platforms make more money?
A: Exactly. AI extractivism is the perfect excuse. Platforms couldn't suddenly lock down the open web without a massive user revolt. But by pointing at the 'AI scraping' bogeyman, they get to implement toll booths while looking like the good guys protecting their community.