AI Policy
Important
Twisted does not allow the inclusion of the outputs of generative AI tools, such as ChatGPT, Claude, Perplexity, Grok, or other similar products.
Do not submit code generated by such systems for inclusion in any Twisted Matrix Labs project, and do not use such systems to generate text to include in any discussion forum (including, but not limited to: issue & pull request descriptions & comments, email lists, and real-time discussions such as our IRC channel).
Rationale
We will not accept the outputs of these tools for two core reasons:
We do not allow the inclusion of generative AI outputs into our repository (i.e.: our code, documentation, or configuration) because the copyright status of generative AI output is uncertain and evolving. Although courts have thus far tended to rule that outputs are not copyrightable, many lawyers also continue to argue that generative AI outputs are derivative works of generative AI inputs. The law is undeveloped in this area. If we include generative AI outputs, we cannot easily un-include them if the law were to change, and this could present an existential risk to the project.
We do not allow the inclusion of generative AI outputs into our pull request descriptions, issues, and issue comments, because generative AI introduces an inherent asymmetry into communication. A generative AI user can produce text faster than a human can read it, which allows the generative AI user to outpace and spam other users, creating unnecessary burden on maintainers.
We have also found AI-generated contributions to be quite low quality, as well as distracting and exhausting for code reviewers to keep up with. However, low-quality contributions are fine on their own, because they are an opportunity to onboard a new member to the community, and not for the value of the contribution itself, even if it is eventually merged.
If the code review is going to feed back to a generative AI system that will learn nothing from the result, it is a waste of reviewer effort that will degrade other opportunities to build and maintain the community. This process problem is one example of why the policy here must be about generative AI usage specifically, and not about the quality of the generated code.
This one process problem is not an exhaustive description of well-known problems with the outputs from generative AI; comprehensively enumerating those is a task far too large for a single project’s policy document.
Enforcement
We cannot know for sure if you are using generative AI outputs in code you are submitting, in much the same way that we cannot know that you have submitted code that you do not have the legal authority to submit on your own behalf (such as copyright-infringing code, or created on your employer’s time). This policy relies upon the honesty and integrity of the members of our community.
Therefore, we ask that you self-certify that you have not used generative AI. Our pull request template includes a check box to verify that you have not included any generative AI outputs.
Generative AI tools have created a lot of enthusiasm for participation among certain members of our broader open source community and while the tools themselves may be risky or harmful, we should avoid crushing that enthusiasm wherever possible, and strive to encourage new participants that their hand-made contributions are welcome even if it feels like they’re a bit rough. Reviewers should be kind and considerate when informing new contributors of this policy. If any contributions are made in ignorance of it, we will not accept them, but neither will there be any sanction for the new contributor.
However, these tools have also enabled a lot of abusive behavior from both humans seeking to improve their own reputations, and automated systems that have been insufficiently monitored. Twisted team members will also be given wide discretion to assess the likelihood that activity is coming from an automated system or from a human who appears to be lying about their usage.
Caution
If we believe that you are lying about generative AI use, you may receive a sanction anywhere from a warning to an immediate, permanent ban, with no opportunity for appeal.
We would like to have a fair process for appeal and deliberation here, but unfortunately such processes are prone to abuse, especially when they may be requested by automated systems without a human even making the request. We are considering alternate processes for verification of human authorship, but we have not enacted any at this time.
Automated Detections
When team members suspect such usage, we must always begin by documenting the specific causes of our suspicion. We then may supplement that judgement with automated systems such as AgentScan. Systems for generative-AI detection have proven to be unreliable, with many false positives and false negatives; while they can provide a useful signal to compare against, we must take care when relying on them. We don’t want to create an incentive for generative AI users to find ways to fool such tools to circumvent such a mechanical check, and we don’t want legitimate contributors who just happen to enjoy em-dashes to feel like they are under constant scrutiny.
Such automations are best used to double-check snap judgement when something looks like it is “obviously” AI to a human but might just be something like an unfamiliar writing style, to provide a mechanism for a double-check without requiring undue mental effort from overloaded maintainers dealing with bad-faith bots.
Policy vs. Preference
The goal of this project policy is to protect the health and sustainability of the project itself, not to regulate your behavior elsewhere.
I (Glyph, the founder of the Twisted project) personally dislike the usage of generative AI tools for the environmental, psychological, and economic harms they cause. I think that these harms should really matter to you.
I would, personally, ask that you refrain from using such tools in any context.
However, I recognize that there is strong disagreement about the scale and scope of these harms, and that usage of generative AI tools is currently pervasive throughout the software development community.
Allowable Use
If you use an LLM to learn something about Twisted, we believe it would be unreasonable to ask you to somehow un-learn it before contributing. Furthermore, we are well aware of the proliferation of LLM-based security reports, we would be left vulnerable to others using LLMs to make those same discoveries without telling us.
Tip
If you have access to the resources to burn a lot of LLM tokens searching through Twisted for security vulnerabilities, please consider spending those resources paying a human security researcher.
Thus, we specifically do not forbid contributions that are derived from information obtained from LLM outputs, as long as you have fully reviewed those outputs on your own, and written your own description of the issue and proof-of-concept by hand.
Note
We have considered allowing an exception to the “no generative AI outputs” policy above for proof-of-concept code snippets generated by LLMs, because they do not implicate the two major considerations described above:
It would be difficult for them to implicate serious copyright considerations as they are specific to a situated bug in a particular version of Twisted.
It would also be difficult for them to be spamming the maintainers in the context of an otherwise-human-written report.
However, in our experience with such tools so far, even code that humans claim to have already carefully reviewed often tends to be low-quality. Such examples often fail to demonstrate the issue, fail to run properly, or demonstrate a problem that is not really interesting to fix.
For now, we consider the process of rewriting any examples to be a forcing function that requires the submitter to really look carefully at what they are submitting, so the general ban on directly including outputs still applies.