NetBSD, the AI-Free OS: What Its Rule Says and How Debian, OpenBSD and FreeBSD Differ

NetBSD presumes that code written by a large language model is tainted and must not be committed without prior written approval from its core team. That one sentence in the project's commit guidelines is why The Register argued on October 13, 2026 that NetBSD "may have found a new role" as the AI-free open-source operating system.

This is a policy story, not a product launch, and the details matter. NetBSD did not just announce something this week. It has had the rule since 2024, and a mix of timing (a record donation month, a Debian vote that went the other way) is making that old rule newly visible. This post lays out the exact wording, the reasoning, how the other BSDs and Debian differ, and what the split means if you build with AI tools and also depend on open-source software.

Quick answers: NetBSD and AI code

What the NetBSD rule actually says

Two reviewers checking a commit, illustrating the NetBSD AI-free commit review rule

The text lives in the NetBSD Commit Guidelines, under the heading "Do not commit tainted code to the repository." The guidelines first tell developers that if they commit code they did not write themselves, they must double-check the license permits import and free distribution, confirm with the authors that they were the sole authors, and verify that they did not copy other code.

Then comes the AI clause. Code generated by a large language model or similar technology, "such as GitHub/Microsoft's Copilot, OpenAI's ChatGPT, or Facebook/Meta's Code Llama, is presumed to be tainted code, and must not be committed without prior written approval by core."

Three details are worth noticing:

• It is a presumption, not an absolute ban. Core can approve an exception in writing, in advance.
• It sits inside the project's existing provenance rules. The logic is the same as for code taken from a foreign tree or a patch of unknown origin.
• It names specific vendors, which dates the wording to the 2024 tools. The principle applies to "similar technology" more generally.

Nothing in the guidelines talks about quality, ethics or the environment. The framing is purely about whether the project can trust the origin and license of what it ships.

Why licensing is the core of the argument

The Register's 2024 report described the NetBSD concern as mainly one of licensing. NetBSD is BSD licensed. If GPL code reached the tree through generated output that closely reproduced training data, the project would face relicensing or having to replace that code. The report said the project lacks the manpower for that cleanup.

That logic is specific to permissively licensed projects. A BSD-licensed operating system promises downstream users, including commercial vendors, that they can use the code with almost no obligations. A single stretch of copyleft code in the tree breaks that promise for everyone who builds on it. The risk is asymmetric: the productivity gain from an AI-written patch is small and local, while the licensing downside is global and hard to unwind.

The same 2024 report covered Gentoo, which banned AI-generated code in mid-April 2024 citing copyright, quality and ethics. Those are three separate arguments, and projects weigh them differently. NetBSD's is the narrowest and arguably the easiest to defend, because it does not depend on a judgment about how good model output is.

Why the story is back now

According to The Register's October piece, NetBSD reported a record 120 donations in the previous month, raising $120,282 against a $50,000 target, as stated in the project's own Mastodon post. The article links the interest to people asking about NetBSD after Linus Torvalds said in July 2026 that Linux is not an anti-AI project. It does not give a direct cause for the donations, and we would not claim one either.

The article's author also reports attending Open Source Summit Europe, where AI was the dominant theme and the BSDs were barely mentioned. That is the author's account, and the piece is an opinion-flavored analysis, not a survey. The honest summary is: there is a visible appetite for a no-AI option in open-source infrastructure, and NetBSD happens to already have the policy. Whether that appetite is large is unmeasured.

How other projects handle AI code

Two branches merging into one line, a picture of how open-source AI policies converge or split

The October 13 article and its links give a useful comparison. Treat this as the state of play as reported on that date, since these policies change.

Debian: allow, with accountability

After a ballot reported by The Register on August 30, 2026, Debian developers chose a proposal called "Responsible Use of Generative AI." Eight options were on the ballot, from an outright ban to cautious use to avoiding LLMs over environmental impact. Just under 600 people voted, many ballots were rejected, and almost 450 valid votes were counted.

The winning text takes a neutral stance: the project "neither endorses nor prohibits" generative AI tools. Contributors stay fully accountable and must review, test and where needed modify AI output. "AI made a mistake" is not an excuse for a poor contribution. Disclosure is encouraged, not required.

OpenBSD: refuse

Theo de Raadt has said OpenBSD cannot accept AI-generated code because a submitter cannot license code whose human origins are untraceable. The Register notes that tmux, which ships with OpenBSD, has accepted AI-assisted changes, and de Raadt declined to comment on that. It is a reminder that a policy for the base tree does not automatically cover every bundled component.

FreeBSD: still debating

FreeBSD's core team has debated allowing AI-generated code since at least September 2025, with no consensus yet, per The Register. No decision means the status quo applies, and the status quo is ambiguity.

Gentoo, COSMIC, QGIS: bans of different shapes

Gentoo's 2024 ban is the oldest of the group. More recently we covered System76's COSMIC desktop banning LLM-generated code and QGIS adopting QEP 428, where the maintainers closed about 40 AI-tagged pull requests. Their motivation is closer to review load and quality than to licensing, which shows how many different reasons end in a similar rule.

The kernel is going the other way on tooling

Not every large project is drawing a line. Linus Torvalds has said Linux is not an anti-AI project, and we covered his comments on what he is bad at, vibe coding and review. A proposal to drop the Assisted-by tag for AI patches was reported on October 13, and we separated what is verified from what is not. Read together, the kernel's direction is to treat AI-assisted patches like any others, with the human submitter accountable. That is closer to Debian's accountability model than to NetBSD's presumption.

What this means if you build with AI

Three practical takeaways, none of which require you to pick a side.

1. Check the policy before you contribute. If you use an AI assistant to prepare a patch, a pull request to NetBSD, OpenBSD, Gentoo, COSMIC or QGIS can be rejected on policy alone. Debian and the kernel expect you to own the result. Read the contribution guidelines first, not after the review comment.
2. Provenance is becoming a feature. For regulated or license-sensitive deployments, "no AI-generated code in the base system" is a statement a compliance team can understand. It does not prove the code is better. It does reduce one specific legal uncertainty.
3. Agent-written pull requests are a maintainer problem. Maintainers are dealing with volume as well as legality. Our piece on AI-assisted pull requests and agent safety in the AnyPS5 project and the Google open-source bug bounty freeze over AI slop reports show the same pressure from different directions.

If you run AI coding agents against your own repositories, keep a review gate between the agent and your main branch. AgentBeam is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions.

Limits and open questions

• The Register piece is analysis, not a policy change. Nothing new was decided by NetBSD this week, as far as the article reports.
• "AI-free" is a label, not an audit. A presumption of taint relies on contributors disclosing. The guidelines cannot detect model output by themselves.
• Policies are moving. Debian voted in August; FreeBSD has not decided. Check the project pages for the current text.
• Licensing law is unsettled. Whether model output can infringe, and who is liable, is still being litigated more broadly; see our AI lawsuit tracker.

Bottom line

NetBSD's position is the clearest example of a project turning a licensing worry into a one-sentence rule. Whether it becomes a selling point depends on how many users care about provenance more than convenience. For builders, the useful lesson is simple: open-source projects now differ sharply on AI, and the contribution policy is part of the documentation you read before sending a patch.

Related reading

• COSMIC desktop bans AI-generated code
• QGIS bans AI-assisted contributions (QEP 428)
• Linux kernel plans to drop the Assisted-by tag
• Linus Torvalds on vibe coding and kernel review
• AI-assisted pull requests and agent safety
• Google's open-source bug bounty freeze over AI slop
• AI lawsuit tracker

Policies and figures are as reported on October 14, 2026. Check each project's own guidelines for current wording.