The latest criticism of the increased burden placed on open-source software project maintainers caused by AI / LLM agents is around too many bug reports effectively causing a "denial of service" attack on project maintainers.

Open-source Linux virtualization software engineer Daniel Berrangé of Red Hat's virtualization engineering team brought up this interesting analogy with the influx of bug reports today affecting QEMU. In a matter of minutes were 125+ separate bug reports sent in by one user for QEMU. They ultimately were about Undefined Behavior Sanitizer (UBSan) outputs and assertions without any really pressing bug report. These bug reports were without any proposed patches/fixes and just low effort submissions.

The Red Hat engineer [1]explained on Mastodon:

"QEMU has been hit by a single reporter filing over 125 separate bug reports in under 10 minutes, all for ubsan reports. The reports ignored the bug template and showed no sign of any human analysis of the ubsan output and had no proposed fix."

Ultimately, Daniel concluded, " this is effectively a denial of service attack on the project maintainers. "

[2]

For this user C4oy1zZ / anwardawa981 and the [3]132 bug reports created today, was reported to GitLab as abusive behavior. With the 132 bug reports, many of them were created simply seconds apart.

Daniel went on to suggest GitLab enact rate limiting the number of bug reports that can be opened by a single reporter if they are not a project member.



[1] https://hachyderm.io/@berrange/117155755806497654

[2] https://www.phoronix.com/image-viewer.php?id=2026&image=qemu_bug_spam_lrg

[3] https://gitlab.com/qemu-project/qemu/-/work_items?sort=created_date&state=all&author_username=anwardawa981&first_page_size=20