Ladybird · 2026-06-05 · major
Ladybird Browser Stops Accepting Public Pull Requests — Andreas Kling Says AI-Generated Code Has Broken the Effort-as-Proxy-for-Good-Faith Assumption, All Open PRs Closed Ahead of First Alpha
Ladybird is closing external pull requests and switching to a maintainer-only contribution model. Kling argues that AI tooling has changed the economics of contribution so much that a substantial patch no longer signals substantial effort.
An indie browser project pulls up the drawbridge: no more public PRs, citing AI-generated contributions and supply-chain risk.
What is it?
Ladybird, the independent C++/Rust web browser led by SerenityOS creator Andreas Kling, announced on June 5, 2026 that it will no longer accept public pull requests. All currently open public PRs will be closed and going forward only project maintainers can land code in the repo. The change lands as the project moves toward its first alpha release.
How does it work?
Kling's post frames the change as a response to two related pressures. First, AI coding tools have made it trivially cheap to generate substantial-looking patches, so a large PR no longer correlates with effort or skill in the way it once did. Second, browsers run untrusted code from the entire internet and one well-disguised vulnerability is enough to compromise users, so the project wants a small, accountable group of maintainers answerable for every change. The team explicitly rules out a shadow contribution system via issues, email, or forks — community involvement continues via bug reports, design discussion, and technical feedback only.
Why does it matter?
Ladybird is the most prominent open-source browser project to publicly retreat from public PRs, joining SQLite (which hardened its 'does not accept agentic code' stance in May) in treating AI-generated contributions as a load-bearing reason to change maintainer policy. For agent vendors like Anthropic, OpenAI, and Cursor whose users routinely fire off PRs at open-source projects, it is a concrete signal that some maintainers will reject the workflow outright; for other security-critical projects watching SQLite and Ladybird, it is a published template for closing the door.
Who is it for?
OSS maintainers, security-sensitive projects, agent operators