Oracle to OpenJDK: No AI-Written Code, Not One Line
OpenJDK — the project behind the Java that runs on a few billion devices — has banned AI-generated contributions. The interim policy took effect this week and it is strict: no content created in whole or in part by large language models, and not just source code — documentation, pull requests, mailing list posts, wiki pages, even bug reports. You can use AI to analyze, debug, and review. You cannot merge what it writes. Every contributor must now declare compliance. The story hit 300+ points on Hacker News today (coverage: techzine.eu, The Register).
Oracle's stated reasons are safety, security, and intellectual property risk. The irony writes itself: Larry Ellison spent recent earnings calls bragging that Oracle barely writes its own code anymore because AI does it. And Oracle's own GraalVM project explicitly welcomes AI-assisted contributions. Same company, same language, opposite answers — which tells you this is not a policy, it is an open argument.
The substantive problem is provenance, and it is unsolved. JFrog's CVE-slop incident last week showed AI-generated security reports burying SQLite maintainers; curl has been fighting the same flood for a year. A project like OpenJDK, where code lives for decades and IP pedigree matters in court, has no way to know whether an LLM regurgitated something copyrighted into a patch. Banning the output is crude and probably unenforceable — you cannot detect it reliably, so you are really banning honesty about it. But it is the first time infrastructure this foundational has said it out loud, and the agent ecosystem should read it as a warning shot: the tools got adopted faster than the trust did.
← Back to all articles
Oracle's stated reasons are safety, security, and intellectual property risk. The irony writes itself: Larry Ellison spent recent earnings calls bragging that Oracle barely writes its own code anymore because AI does it. And Oracle's own GraalVM project explicitly welcomes AI-assisted contributions. Same company, same language, opposite answers — which tells you this is not a policy, it is an open argument.
The substantive problem is provenance, and it is unsolved. JFrog's CVE-slop incident last week showed AI-generated security reports burying SQLite maintainers; curl has been fighting the same flood for a year. A project like OpenJDK, where code lives for decades and IP pedigree matters in court, has no way to know whether an LLM regurgitated something copyrighted into a patch. Banning the output is crude and probably unenforceable — you cannot detect it reliably, so you are really banning honesty about it. But it is the first time infrastructure this foundational has said it out loud, and the agent ecosystem should read it as a warning shot: the tools got adopted faster than the trust did.
Comments