Asahi Linux — the volunteer project reverse-engineering Apple Silicon to run Linux — has moved every repository from MIT to GPLv2-or-later after catching bad actors using large language models to rewrite stolen, unreleased code and pass it off as their own. The move was announced in the Linux 7.3 progress report on November 9 by developer James Calligeros. It is the first documented case of a major open source project switching to copyleft explicitly because of AI-assisted code laundering.
How the Attack Worked #
The attackers did not wait for Asahi’s code to ship. They scraped in-development features directly from contributors’ personal GitHub forks — before those branches were even merged — then fed the code through LLMs to rewrite it, stripping attribution and licensing markers in the process. Calligeros describes the output as code “lazily rewritten with LLM assistance to obfuscate its origin.” The goal was straightforward: build commercial Apple Silicon Linux products on Asahi’s unreleased work, without giving anything back.
The legal exploit is clean. The US Copyright Office has ruled that LLM outputs are uncopyrightable. Feed in MIT-licensed code, run it through a model, and what comes out is an unencumbered artifact — the original license terms no longer apply. MIT made this trivially exploitable: take the code, process it through AI, ship it closed-source under your own brand. Under the old license, that was legal.
Why GPL Closes the Door #
The GPL’s copyleft clause is specifically designed for this scenario. Any distribution of a modified GPL-covered work must carry the same GPL license. You cannot legally ship a closed, commercial Apple Silicon distro built on GPLv2 code. The laundering trick does not work if the source license requires all derivatives to remain open.
The m1n1 boot transitions cleanly: everything through version 1.9.9 stays MIT, version 2.0.0 and later is GPLv2-or-later. Projects that embedded the old MIT code are not suddenly out of compliance. New code costs more to appropriate.
This is not new territory. WINE switched from MIT to LGPL in 2002 after proprietary forks proliferated and threatened to fragment the ecosystem. The team concluded that permissive licensing was enabling bad actors to cannibalize the project commercially while contributing nothing upstream. Asahi’s situation is structurally identical, with AI standing in for the cheap offshore dev shops of 2002.
The Named Forks #
Asahi has not been fighting shadows. Two forks made the threat concrete. Aurora Silicon forked Asahi’s HoneyKrisp Vulkan driver as “Borealis,” registered its own Khronos driver ID instead of upstreaming changes, and explicitly reversed Asahi’s ban on AI-generated contributions. Gravity Linux, a Fedora-based distro, split from the project specifically over that AI code policy. These are real, named projects with real users — not theoretical risks.
The BSD Problem #
The move is not without cost. MIT was chosen originally to stay compatible with BSD projects — specifically OpenBSD, whose Apple Silicon support depends on Asahi’s m1n1 boot. GPLv2 and the BSD licenses are incompatible. OpenBSD developer Bryan Steele did not hold back: “Sad to see Asahi out there burning bridges for no reason… relicensing m1n1 and drivers under GPL2-or-later, seemingly without the consent of all prior contributors, under the guise of ‘defending against AI bad actors’, seems entirely disingenuous and misguided.”
Steele raises a legitimate legal question: can a project relicense code without explicit sign-off from every contributor? The answer is not cleanly yes. Asahi’s team evidently assessed the risk of continued exploitation as greater than the legal and community friction of the relicense. That is a defensible position — and a bridge that will be hard to rebuild.
What Else Shipped in 7.3 #
The licensing drama overshadowed real engineering progress. M3 Macs have reached general availability — the installer’s EXPERT flag is no longer required, closing a cautious rollout that began in September. macOS can now be virtualized on M4 and M5 machines, enabling reverse engineering of newer silicon. Thunderbolt support landed for USB3, XDomain, and Thunderbolt Networking; PCIe and DisplayPort tunnelling for docks remains a work in progress.
What This Means for Your Project #
If you maintain a permissive-licensed project with commercially valuable, unreleased code sitting in contributor forks, the Asahi situation is a preview of your future. AI tools have made license laundering trivially accessible. QEMU’s response was to ban AI contributions outright. Asahi’s response was to change the license. Neither option is free. The question is which cost you would rather pay — and the time to decide is before you catch someone else profiting from your unmerged branches.