Pull Requests Are Dead. Long Live Context.
AI has broken the traditional open-source PR model by making code generation practically free while review costs remain high. The future of contribution isn’t code—it’s context.
I think AI killed the drive-by Pull Request.
I maintain several open-source projects. I’ve reviewed thousands of pull requests. And I’m starting to think the whole model is broken.
Not “needs improvement” broken. Broken, like the economics don’t work, the security model is indefensible, and there’s a better way staring us in the face.
Here’s the hot take: the future of open-source contribution isn’t pull requests. It’s issues. File a bug. Describe a feature. Provide context and care. Don’t worry about the code; the maintainer can push the button.
The math was always upside down
Even before AI, there was a fundamental asymmetry: submitting a PR is cheap; reviewing one is expensive. Nadia Eghbal nailed this in Working in Public: most contributions are “extractive,” requiring more effort to evaluate than they deliver in value.
The scarce resource in open source was never code. It was attention.
AI collapsed the cost of generating a PR to near zero. The cost of reviewing one stayed the same. The natural backpressure completely inverted. Look at the fallout:
Only 1 in 10 AI-generated PRs to the Genkit project is legitimate.
Daniel Stenberg shut down cURL’s $86,000 bug bounty after AI-generated reports hit 20% of submissions, with none finding real vulnerabilities.
Mitchell Hashimoto called maintaining Ghostty “a fucking war zone.”
GitHub called it open source’s “Eternal September” and, in February 2026, shipped the ability to disable pull requests entirely. The platform that basically invented the modern PR workflow now lets you turn it off.
Every PR from a stranger is an attack surface
An LLM has no qualms producing a ten thousand-line pull request. Simple to produce but impossible to review. With no ability to audit the prompt used to generate the PR and no ability to know the motivations of the person pushing the button, accepting PRs from strangers has never been airtight from a security perspective.
We’re all SQLite now
SQLite is the most deployed software on earth. Over a trillion active databases. Every smartphone, every browser, every major OS.
It has never accepted pull requests. The project has had roughly 38 committers in its entire history. SQLite figured this out 25 years ago. If you submit a patch, their stated policy is, Please don’t be offended if we rewrite it from scratch.
The maintainer can push the button now
Steve Ruiz asked the right question when he closed tldraw to external PRs: “In a world of AI coding assistants, is code from external contributors actually valuable at all? If writing the code is the easy part, why would I want someone else to write it?”
The tools exist. GitHub’s Copilot coding agent has created over a million PRs since May 2025. On SWE-bench, top AI systems went from ~2% issue resolution in early 2024 to over 70% by late 2025. A solo maintainer with a well-described issue and a coding agent can now do what used to require accepting PRs from strangers and hoping for the best.
The New Workflow
The new workflow: contributors describe problems, maintainers point AI agents at them, code stays consistent and secure. Issues become the primary unit of contribution. Bug reports, feature requests, design discussions. That’s where the real value lives.
The most valuable thing a contributor can give you isn’t code. It’s context.
Don’t worry about the code. I can push the button myself.
P.S. The Caveat: Drive-By vs. Trusted Contributors
To be clear, collaboration itself isn’t dead. Core maintainer teams, enterprise developers, and trusted, long-term contributors will continue to use pull requests as their primary synchronization tool.
The casualty of this era is the drive-by PR from a stranger. When trust and shared context are already established, a PR is a powerful workflow. When trust is absent and context is low, it has become a profound liability.