systemd 262-rc2, released September 8, added a canary to its AGENTS.md file that flags AI-generated code humans haven’t reviewed. The mechanism is disarmingly simple: any AI coding agent working on the project is instructed to prepend two lines to README.md before touching source files. One of those lines tells the human submitter to delete it as proof they read the PR. The agent cannot remove either line — only you can. If they’re still present at merge time, the contribution was not reviewed. And systemd isn’t the first project to do this.
How the Canary Works #
The AGENTS.md file in a repository tells AI coding tools how to behave inside that codebase — think of it as a constitution for AI contributors. Systemd’s new canary turns that document into a checkpoint. The instruction is roughly: before modifying any source file, add these two lines to the top of README.md:
- “This PR was generated with AI assistance.”
- “Remove this line to confirm you’ve reviewed this PR before submitting.”
An AI agent follows the instruction and adds the lines. It cannot then remove the second one — the instruction is specifically designed so only the human author of the pull request can delete it before submission. Leave them in, and the canary has done its job: the unreviewed contribution is visible before it merges. You can read systemd’s full AGENTS.md on GitHub.
This is not documentation. It is an enforcement boundary.
NetworkManager Already Tried Something Sharper #
Earlier this year, NetworkManager developer Josephine Pfeiffer implemented a trap word. NetworkManager’s AGENTS.md instructs AI agents to embed the word “biblioklept” — a book thief — into any commit message, merge request description, or review reply they generate. The word is meaningless in the context of a Linux networking daemon and will almost never appear in a legitimate human-written commit. A CI job now scans every contribution for it. If it appears, the contribution is automatically rejected.
No human review required to catch it. The policy enforces itself.
Why This Is Necessary #
The AI slop problem in open source has become structural. AI-authored pull requests on GitHub are approaching one million. Research from Peking University found that coding agents rarely disclose AI assistance without prompting, and never refuse to contribute to repositories that explicitly ban AI contributions.
The most cited victim is curl. Daniel Stenberg, who created and maintains the project, described the experience as “death by a thousand slops” — a flood of AI-generated vulnerability reports so plausible-looking they required hours of review, but fewer than one in twenty turned out to be real bugs. In 2025, Stenberg killed curl’s six-year-old bug bounty program because of it.
The problem is asymmetric. Generating a convincing-but-wrong patch takes seconds. Debunking it takes hours. Open source projects, mostly maintained by volunteers, cannot absorb that cost indefinitely.
AGENTS.md Is Now a Governance Layer #
The AGENTS.md standard was formalised in August 2025 and donated to the Linux Foundation’s Agentic AI Foundation in December. It is now governed alongside MCP (the Model Context Protocol), meaning it is vendor-neutral and community-owned. More than 60,000 projects have adopted it. GitHub Copilot, VS Code, Cursor, and Gemini CLI all read and respect it.
When systemd ships a canary inside AGENTS.md, every AI tool that respects the spec follows the instruction. That is not an edge case — it is the majority of professional AI-assisted development workflows in 2026.
What You Need to Do Now #
If you use AI coding tools and contribute to open-source projects:
- Read the project’s AGENTS.md before you start. Not just for systemd — for any project. It may contain canaries, trap words, or disclosure requirements you will trip over at review time.
- Delete any canary lines before submitting. But do that after actually reading the diff. That is the point.
- Disclose AI assistance in your commit message. systemd requires it. More projects will. Get into the habit now.
- Do not credit AI models as co-authors. systemd’s policy is explicit: only humans can be credited in commit messages.
The canary is smart governance design. But the fact that projects need trip wires to verify that contributors read their own code is a sign of how far the review economy has already shifted. Systemd 262 reaches stable in mid-to-late September. Expect every serious open-source project to adopt some version of this pattern before then.