LLVM Sets AI Tool Rules, Curl Cuts Bug Bounty Payments

The developers of the LLVM project have approved guidelines for the use of AI tools during development. This decision comes in response to the rise in junk changes being proposed for inclusion in the LLVM codebase. Junk changes are alterations generated by AI tools and submitted without proper understanding, verification, or consideration for maintainers, putting added strain on them and necessitating the parsing of irrelevant code.

However, the LLVM developers also acknowledge the benefits of utilizing AI tools effectively to expedite development. The AI guidelines employed by LLVM are partly inspired by the regulations established by the Fedora Project in the previous year. The core principle of these guidelines is that developers should not relinquish their responsibility of reviewing code generated by AI to maintainers.

In adherence to the Fedora rules, the LLVM guidelines specify the mandatory manual review of AI-generated code before proposing changes to the project. Furthermore, the individual responsible for the change must possess a thorough comprehension of the submitted code and be ready to address any related queries. It is recommended to craft manual descriptions for pull requests instead of relying solely on AI for generating accompanying text.

When submitting a change predominantly produced by AI tools, it is essential to disclose this information in the pull request note, such as by using the tag “Assisted-by: name of the AI assistant.” The use of automated AI tools, like the GitHub-integrated AI agent @claude, which execute actions or post comments without human intervention, is prohibited.

These regulations are applicable not only to code in pull requests but also extend to RFCs suggesting new features, reports on vulnerabilities and bugs, as well as comments and feedback on pull requests.

Additionally, it is worth noting the decision made by Daniel Stenberg, the creator of the tool for transmitting data over the curl network, to discontinue the monetary rewards program for disclosing Curl vulnerabilities. The issuance of rewards

/Reports, release notes, official announcements.