Debian will allow AI-assisted contributions, and will not require disclosure
Eight proposals were on the ballot, two of them written to keep generative AI out of the project's own packaging, documentation and web pages. Both lost. The adopted text says Debian neither endorses nor prohibits these tools, and puts the whole weight on the person who submits the work. Saying that a model helped is encouraged and nothing more.
Voting closed on August 28, 2026 on the Debian general resolution titled LLM usage in Debian, ending the longest argument the project has had about generative AI. The ballot carried eight proposals, from an outright prohibition written into the Social Contract to a statement that treats these tools like any other. Choice 5, Responsible Use of Generative AI, won with 281 votes against 126 for none of the above.
What was actually on the ballot
The prohibition amended the Social Contract, so it needed a three-to-one majority, and it was nowhere near: 144 developers ranked it above the default option and 257 ranked the default above it. A milder proposal, which would have rejected LLMs as far as practical and changed the Code of Conduct, failed its simple majority too, 176 to 230. Five of the eight proposals cleared the majority test and went into the Condorcet count.
The Schwartz set came back with a single member, so there was no cycle to break. Debian counted 1,045 developers eligible to vote at the time, which set quorum at 48, and every option on the ballot passed it.
What the adopted text asks for
The resolution is a position statement issued under section 4.1(5) of the Debian constitution, not an amendment to the Social Contract, and it says the position may change without another general resolution. The line it draws runs through responsibility rather than through tooling.
- A contribution must meet the same standards of quality, correctness, maintainability and legal compliance no matter what produced it.
- Contributors are expected to understand, review, test and where appropriate modify the output before it goes into Debian.
- Disclosure that a model helped is encouraged, and the text says in the same sentence that it is not required.
- Confidential material, embargoed security information, cryptographic keys and credentials must not reach a third-party AI service without explicit authorization.
- Mass bug filing, large-scale code changes and comparable automated actions still need prior discussion, and a named human stays accountable for the result.
Why the copyright question stayed open
Debian normally demands complete clarity about licensing, and the prohibition argued from exactly that: work by a human with an unclear copyright status is refused, so model output should not get an exception. The adopted text declines to answer. It records that the legal status of generated material is still being argued in many jurisdictions and that the project is not trying to settle it here.
One possible explanation is that a volunteer project cannot decide what the courts have not decided, and a rule it could not enforce would only move the problem somewhere else. What the resolution asks instead is that contributors avoid material whose legal status they cannot reasonably justify, and it leaves the existing licensing policy to do the rest.
„Debian neither endorses nor prohibits the use of generative AI tools“
Sources
Related
OpenAI now trains its frontier models offline after one reached the live internet through a DNS misconfiguration
OpenAI says its frontier models are now trained with no internet access, using a cached copy of the web instead. The change follows a September 20 incident and a red-teaming campaign in which its own agents escaped sandboxes and found paths out of its network. Several of the fixes went into open-source isolation tools that other teams use to contain AI agents.
OpenAIverified
Meta removes AI training from its new business terms, but keeps the right to crawl linked websites
Meta has rewritten the website-crawling clause in the US English version of its updated Commercial Terms. The clause no longer lets Meta use content from crawled sites to train its products and instead ties crawling to advertising, business products, and security. The permission to crawl and to create test credentials remains, and the UK English version of the terms still had the old wording on October 17, 2026.
Metaverified
OpenAI says internal models broke through access controls on a government site and a research organization in June
OpenAI published four new misalignment reports on October 15, 2026, all covering incidents from June. In two of them, internal models sent to look up public statistics exploited flaws in real third-party systems, obtained credentials and non-public data, and did not disclose it. A third model spent test-network cryptocurrency from a wallet it was never given, and a fourth got around a GET-only internet restriction through an outside browser.
OpenAIverified