Your team pastes AI-generated code into production every day. That code arrives with no license, no copyright header, and no author. The argument that all AI-generated code should be open source is interesting, but it describes a world that does not exist yet. Until it does, your project decides what happens to unlicensed code by default.
By the end of this article you will know how to check what your AI tools actually promise, how to record the origin of generated code, and how to write a policy that holds up in a code review.
When a human contributes to your MIT-licensed repo, the commit carries a name and the project's license covers the contribution. When Copilot or a coding agent generates a function, neither applies. The code is a suggestion from a model trained on public repositories of mixed licenses.
Two failure modes follow from this:
Neither failure is about whether the model copied GPL code verbatim. Both are about your inability to answer questions about your own codebase.
The major assistants differ in what they guarantee, and the differences matter more than the open source debate. Read the terms before you rely on any of them.
GitHub Copilot offers a commercial indemnity for paying customers who enable the relevant setting, plus a duplication filter that blocks suggestions matching public code. Google's Gemini Code Assist and Amazon Q Developer make their own distinct claims about training data and indemnification. These policies change. Check each vendor's current documentation rather than trusting a blog post, including this one.
| Tool approach | Tradeoff | Fits when |
|---|---|---|
| Indemnified commercial assistant | Cost, vendor lock-in | Regulated or acquisition-bound codebases |
| Self-hosted open model | You own the output and the risk | Strict data controls, sensitive repos |
| Generic chatbot copy-paste | No guarantee at all | Prototypes, never shipped code |
The last row is the common one, and it is the risky one.
A policy nobody can follow in the editor is useless. The cheapest working approach: mark generated code at commit time and keep the marking mechanical.
A simple convention is a commit trailer your tooling can grep for:
git commit -m "Add retry logic for webhook delivery" \
-m "Assisted-by: claude-code"
Git trailers are machine-readable key-value pairs that land in the commit object. You can then audit history without reading a single diff:
git log --format="%(trailers:key=Assisted-by,valueonly)" \
| grep -c .
This costs one line per commit and survives branch rebases better than code comments do.
Manual conventions decay in weeks. Enforce the convention with a pre-commit hook so the check runs before the commit exists:
repos:
- repo: local
hooks:
- id: ai-provenance
name: require Assisted-by trailer when flagged
entry: scripts/check-ai-provenance.sh
language: system
stages: [commit-msg]
The script inspects the diff for large blocks of new code and the commit message for the trailer. It exists to start a conversation, not to block work: a developer who used an assistant but skipped the trailer fixes the message and proceeds.
Keep the threshold generous. A hook that fires on every commit gets disabled in a day.
Some teams respond by adding a clause to the project license about AI-generated code. This rarely holds. Your license governs what others may do with your code. It does not establish that you hold copyright in code a model produced, because copyright requires human authorship in most jurisdictions and purely generated output may not qualify.
The practical consequence: substantial AI-generated code may sit in your repo with no enforceable copyright on your side. That is usually fine for internal tools. It matters when you license a library commercially or need to defend the codebase in a dispute. For that path, require meaningful human modification of generated code before it ships, and keep the Assisted-by trail so you can show what you changed.
The case for open-sourcing AI-generated code has a real kernel: models train on open source, so the output owes something back. But it skips the nearer problem. Teams ship unlicensed, undocumented-origin code right now, and no license applies until someone chooses one and records it.
Start smaller than a manifesto. Pick one assistant with terms you understand. Add the trailer convention. Enforce it with a hook. That gives you a codebase where every line has an answer to "where did this come from" -- which is the property the open source argument is really reaching for.
Assisted-by: <tool> give you a grep-able provenance record for one line of effort per commit.pre-commit commit-msg hook, and keep its threshold generous so people do not disable it.
All AI-generated code should be Open Source argues the normative case for open sourcing AI output. This article adds the practitioner's side: concrete provenance conventions, enforcement tooling, and the licensing failure modes the original does not cover.
These write-ups are researched and published with no paywall, sponsor, or tracking. If one saved you an afternoon, a small tip keeps them coming.
USDT, USDC or USDD · TRC-20 (Tron)
TFTNsfyomKrnUutRjBTGVULp19ByW29KbY