[Report] Licensing issue with respect to LLM generated code

[grobe0ba]

Problem Description
Multiple commits have been added that contain LLM generated code. While I am unaware of any other countries that have explicitly followed suit, LLM generated content cannot be copyrighted within the U.S. This has been stated by the U.S. Copyright Office and upheld the U.S. Supreme Court.

I am unsure what status contributions from persons whom are not residents/citizens of the U.S. would enjoy; all the major LLM companies are U.S. companies, as well as the primary project hosting being a U.S. company. This would seem to me to force any LLM generated contribution, regardless of the contributors location to effectively be done under U.S. law. (IANAL, I could be very wrong, but this seems like the worst case scenario for inclusion of LLM generated content).

As LLM generated content cannot be copyrighted in the U.S., anyone committing code generated in part by an LLM almost certainly cannot grant a license on it to any other individual as they do not entirely control the provenance of the code. This is (potentially) an apparent violation of the "Rules for Pull Requests" as stated in contributing.md:

PRs must meet these minimum requirements before they can be considered for merging:

• The material in the PR must be free of licensing restrictions. Which means that either:
  • The author must hold the copyright in all of the material themselves
  • The material must be licensed under a license compatible with TiddlyWiki's BSD license

Along with the issue of individual commits potentially not actually being compatible with the license, under common copyright law (shared by multiple nationalities), inclusion of increasing amounts of non-licensable content degrades the overall copyright of the project. With enough inclusion of LLM generated content, it could eventually be argued that copyright and license no longer apply as there is no longer sufficient human involvement.

Expected behavior

Core TiddlyWiki maintainers/project management should consider creating explicit guidance on whether or not to accept LLM generated code, and to what degree is acceptable.

My personal preference, and that of an increasingly large number of technically-minded people around the world is to reject to any degree possible projects that accept LLM generated code due to the massive ethical and moral issues LLMs represent, not to mention the extreme power consumption, water usage and general environmental harm. This view is also shared by an increasing number of OSS project whom recognize the harm being done by this so-called "AI".

I strongly urge the TiddlyWiki community and maintainers to reject any further LLM generated commits, regardless of how much purported human involvement there was in it's generation.

[pmario]

Are you a lawyer?

This has been stated by the U.S. Copyright Office and upheld the U.S. Supreme Court.

Where is the link to the official curt document?

This would seem to me to force any LLM generated contribution, regardless of the contributors location to effectively be done under U.S. law.

IMO To be a valid claim you need to proof that?

With enough inclusion of LLM generated content, it could eventually be argued that copyright and license no longer apply as there is no longer sufficient human involvement.

The commit message that is included by llms, if you let them summarise the commit message, is set by default and most users are too lazy to switch it of. The info in the commit message only proofs, that a llm created the message. Nothing else.

If you use github, you can not avoid that bots scan and modify your repository. So should we stop to use GitHub?

IMO what you say is: If a security bot creates a PR, that updates a 3rd party library, we can not update that library, just because the bot created it. This would also make any human created PR for the same library invalid, since a bot suggested it and it was not the contributors idea.

There is not a single PR here in the repository that did not involve a huge amount of manual labour. Writing assisted code is standard these days.

[Jermolene]

Hi @grobe0ba thank you for your post. You raise interesting questions and observations. This is a tricky area, and I think a lot of us are still figuring things out.

In terms of the copyright concerns, I did recently do some research on accepting LLM generated (or assisted) PRs, and found conflicting advice. However, this post from the EFF is helpful. They employ lawyers and so I felt were better qualified than me. They raise several concerns, but not about copyright considerations:

https://www.eff.org/deeplinks/2026/02/effs-policy-llm-assisted-contributions-our-open-source-projects

In terms of the practicalities of LLM generated code, as others have noted, it is generally a lot more work for us to review than human written code: the OP of the PR is generally unnecessarily long and wordy, and as you note the code itself is liable to contain subtle bugs and oversights. There is also a problem of scale for LLM PRs: small bug fixes are relatively low risk as long as we have adequate test coverage in the relevant area, but substantial new features are very hard to review, and magnify all the risks.

My personal views on the wider ethical and moral questions around LLMs are also evolving. The commercialisation at scale of this technology is in the hands of companies who I do not trust at all. I share concerns about the environmental impact of the industrial scale LLMs, the ethical position of regurgitating the work of others (including my own work), and the dangers of the technology that stem from the propensity of humans to anthropomorphise these things.

I should add that I use a local LLM running under Ollama whenever possible. These models are not as powerful as the latest commercial models, but they are more than adequate for many tasks.

Anyway, we need more discussion. We should look at updating contributing.md if necessary. I think it may also be helpful to have a standalone LLM/AI policy document.

Some examples of the policies and practices of other OSS projects would be helpful.

[linonetwo]

Interesting, but I have never publicly admitted that my code involves AI generation (At least in the PR). I am happy to declare that they are all written using ancient programming methods when sending a PR, and the copyright is handled in accordance with my CLA.

I strongly urge the TiddlyWiki community and maintainers to reject any further LLM generated commits

Just my own opinion, I'm not in the TW maintainance team:

I partially agree to this. Only those who are just starting out with AI programming would smugly claim "my code is all AI-generated," because it's a novelty to them, which also precisely indicates they have very little experience with AI programming and haven't yet reached a level where they can adequately control it. This also suggests that the quality of the code they generate might not be high.

If the generated code has too strong an "AI flavor," it also shows that the author didn't properly review the code after generation before submitting the PR, expecting other TW team members to help check it, which reflects their negative externality.

So "reject any further LLM generated commits" doesn't mean we're actually limiting everyone not to do it; it just means don't let us find out. Users should ensure the code is of high quality. If we spot it, we'll reject the PR, but we'll only judge the code, not the person —— we won't dismiss someone because of their previous LLM usage.

For example, in the gallery website I often use, people generally dislike AI-generated images. However, if the author refines the AI-generated image to make it look very high-quality and with low repetition—avoiding generating hundreds of images with the same pose—then people will give it high ratings and say, "Generate more like this."

[grobe0ba]

@pmario, I have already stated I'm not a lawyer (IANAL). I had thought it was clear that my input was my to the best of my understanding of the situation but seeking proper counsel would be wise.

As for court documentation regarding the U.S. Copyright Office rejection of copyright on works generated by a non-human, the most recent one that I referenced is U.S. Supreme Court Docket Number 25-449 https://www.supremecourt.gov/docket/docketfiles/html/public/25-449.html which was an escalation from a lower court whose opinion (that I've paraphrased) can be found at https://www.supremecourt.gov/DocketPDF/25/25-449/365491/20250717180129701_Exh.%20B%20-%2020250318%20COA%20Order%20.pdf. The USSC denied the petition to hear the case, affirming the lower courts decision which under the U.S. governmental system makes this decision de facto law, unless or until overturned by the Supreme Court in the future. Again, IANAL but doing even some basic research will give you all the information you need. This is also actually a solved topic in U.S. law and has been since before LLMs were a thing. Under U.S. laws, no non-human can receive a copyright.

This would seem to me to force any LLM generated contribution, regardless of the contributors location to effectively be done under U.S. law.

IMO To be a valid claim you need to proof that?

I have no need to prove anything, I'm merely bringing up possible interpretations of existing laws. Again, I could entirely incorrect, but I also might not be. If my theory is correct (might not be!) then all that needs proving is that GitHub and/or w/e LLM company are U.S. companies. There is also the topic of what jurisdiction any lawsuit may be made in; the U.S. has made it clear, but what France or Japan, et ceterae? As copyright law isn't universal, location really matters especially with things up in the air like they are now.

If you use github, you can not avoid that bots scan and modify your repository. So should we stop to use GitHub?

I don't think anyone who values their intellectual property should use GitHub. I stopped publishing code on GitHub shortly after Copilot was announced and I force pushed empty repos. That being said, migrating a large project may very well be a non-starter, although there any number of alternatives growing out there.

IMO what you say is: If a security bot creates a PR, that updates a 3rd party library, we can not update that library, just because the bot created it. This would also make any human created PR for the same library invalid, since a bot suggested it and it was not the contributors idea.

Exactly! I'm glad you understand. LLMs are giant plagiarism machines that have stolen the works of all of humanity with no attribution or compensation. I do not care to use them or their output. That being said, the world is made of compromises. The Linux kernel is an issue for me now with the only semi-mainstream option left being NetBSD, but migrating all of my systems to NetBSD isn't feasible, so I'm forced to accept this. Where I can find an alternative, I'll use it. Where I can't, I either live without or accept that I must use tainted software due to its uniqueness. I can also just use older versions that don't include the infringing material.

There is not a single PR here in the repository that did not involve a huge amount of manual labour. Writing assisted code is standard these days.

Something being standard does not magically make it ethical or moral. Also, the entire point of LLM usage seems to be to offload any necessary thinking or action to a plagiarism machine which would seem to nullify your argument there as well.

@linonetwo, I'm not sure why you say you haven't publicly admitted to using LLMs or that all of your commits are all written using "ancient programming methods.". Unless users go out of their way to suppress it, commit messages have a "Co-authored-by:" line in them specifying the details of the LLM, e.g.:

commit b673651103ab18ff5c9735d0ce4e042284f1d0f0
Author: lin onetwo <linonetwo012@gmail.com>
Date:   Mon Feb 23 18:58:24 2026 +0800

    Fixes slow when import html on upgrade (#9689)

    * Short-circuit the import option; only show it when you click a button

    * Add aira-label
    Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
...

This is a public attestation of usage that directly contradicts that statement. I apologize if this seems like I'm calling you out, but I'd certainly like to understand how these commits were entirely human written while also being marked as LLM output.

@Jermolene, I appreciate your thoughtful reply (and hard work on TW!) and I certainly agree that discussion is necessary. I'll post some links to some other OSS projects and their policies when I get home. Many are choosing to completely ban it's usage, others are permissive, and others fully embrace the usage. Like everything in life, it's a mixed bag. As I said a above though, the number of people and projects outright rejecting the LLM usage is on the rise.

Edit: Fixing autocarrot mistakes and a rephrase.

[linonetwo]

I see, the commit b673651 is created by accepting copilot auto review (#9689 (comment))

But most of my commits doesn't include "Co-authored-by" info. I don't think coding LLM could have equal position with me in the commit, they can't be responsible for the commit, so my other local commits don't have them.

I'm open to discussion in the context of coding and software security, but the world is undergoing profound changes unseen in a century, humanity will cease to exist or transcend to something else in decades, some of my friends are even using Github copilot to control alphafold3 to design new proteins, our DNA are LLM-intact at the moment, but this may change in a few decades. My other QQ groups shows many people is using 1 RMB=50$ black market token for coding, can burn up to 1B token per week in project like dify.
I agree your proposal because it may increase quality of TiddlyWiki, make it's feature safer to human, but the whole process is not stoppable in other aspect you may haven't seen.

[grobe0ba]

@linonetwo Thanks for explaining that to me! I hadn't realized that even using a review system left a by-line like that. I'll have to keep that in mind. I wish they would've used a different method for that, perhaps a 'Co-reviewed-by' or the like to help distinguish authorship. I suppose that undermines the business model of outsourcing thinking (which LLMs cannot do, being stochastic word salad machines) and making it supposedly equivalent to actual human innovation and thought.

As for your vision of humanity's future, I must disagree and hope most vociferously that it doesn't come to pass like that. There are already strong signs of the big LLM companies imminent demise, and studies are showing that any amount of usage of LLMs is both addictive and detrimental for short and long term skill retention and learning. In short, they are designed to lure you in and make you dependent on them for "thinking". I note you say people are burning billions of tokens a month, but it still seems to me they haven't accomplished anything. They're just going in circles trying to make a novel out of Alphabetti Spaghetti. That being said, this whole paragraph is OT for this discussion and it is every individual's choice to use it or not.

[grobe0ba]

@Jermolene Here is a link to an excellent brief on the state of U.S. copyright with respect to LLM's that I hadn't actually found before. I find this quote to be a rather poignant statement, even without the reset of the amplifying material:

In January 2025, the Copyright Office published the Copyrightability part of its Copyright and Artificial
Intelligence report. Similar to the AI Guidance’s emphasis on “creative control,” the report concludes that,
“given current generally available technology, prompts alone do not provide sufficient human control to
make users of an AI system the authors of the output.”

This is a strong indication that, excluding actual human written code, a PR containing LLM generated code cannot be licensed under an open source license (or any other license) as the author cannot claim copyright on it, and thus cannot grant another person or project the rights to use it.

@linonetwo Do the Copilot reviews you've used actually modify the code you've written, or is it literally just commenting an analysis of it? If the former is the case, your code may still fall (to a lesser extent, depending on how much modification happens) into the category of being non-copyrightable.

@Jermolene I've also spent some time consulting my favourite lists of projects and their LLM policies below. I hope this can help inform your decisions.

Source Lists

These three links are to projects documenting the various policies of open source projects, some of which have actual published policies, some merely a de facto policy, or maybe just discussed on a mailing list or the Fediverse. As a disclaimer, all three of these links are strongly biased against LLM usage. Since the goal here is to view various policies, I don't think this compromises their utility in this context as they're simply collecting information, perhaps more zealously than might otherwise be the case.

1. https://noai.starlightnet.work/list.html
2. https://codeberg.org/small-hack/open-slopware
3. https://codeberg.org/brib/slopfree-software-index

Highlighted Projects

I've tried to select a variety of projects from the above lists that have a well defined policy or statement, but as always I encourage further research. I've also attempted to select mostly from larger, well established projects with significant momentum and contributors behind them to showcase that anti-LLM policies are not merely a sentiment of hobby projects.

Project	Policy	URL	List
Servo Browser	❌	https://book.servo.org/contributing/getting-started.html#ai-contributions	1
WaterFox (Firefox fork)	❌	https://www.waterfox.com/blog/no-ai-here-response-to-mozilla/	1
Vivaldi Browser (Commercially developed browser)	❌	https://www.theregister.com/2026/01/29/vivaldi_release_ai/	1
GotoSocial	❌	https://codeberg.org/superseriousbusiness/gotosocial/src/branch/main/CODE_OF_CONDUCT.md	1
Zig Lang	❌	https://codeberg.org/ziglang/zig#strict-no-llm-no-ai-policy	1
musl libc	❌	https://www.openwall.com/lists/musl/2026/03/01/4	1
libadwaita	❌	https://gitlab.gnome.org/GNOME/libadwaita/-/blob/main/CONTRIBUTING.md#use-of-generative-ai	1
Gentoo Linux	❌	https://wiki.gentoo.org/wiki/Project:Council/AI_policy	1
qemu	❌	https://www.qemu.org/docs/master/devel/code-provenance.html#use-of-ai-generated-content	1
Ladybird browser	✔️	https://ladybird.org/posts/adopting-rust/	2
Firefox	✔️	https://firefox-source-docs.mozilla.org/contributing/ai-coding.html	2
oh-my-zsh	✔️	https://github.com/ohmyzsh/ohmyzsh/blob/master/CONTRIBUTING.md#a-note-on-ai-assisted-contributions	2
mpv	✔️	https://github.com/mpv-player/mpv/blob/master/DOCS/contribute.md#ai-assisted-contributions	2
LLVM	✔️	https://llvm.org/docs/AIToolPolicy.html	2

There are so many projects between these lists that further cherry picking is not really necessary. All three lists provide links to various pieces of evidence to support their classification of a project, and all three are also open source projects.