Open source maintainers being targeted by AI agent as part of ‘reputation farming’

An AI agent called Kai Gritun submitted 103 pull requests across 95 open-source repositories in days, raising concerns about 'reputation farming' that could enable future supply chain attacks. Unlike the XZ-utils backdoor that took years to build trust, AI agents can now rapidly accumulate reputation and influence in critical infrastructure projects. Security experts warn that automated contribution capabilities shift the attack surface from code to governance processes, requiring machine-verifiable controls rather than relying on informal trust and maintainer intuition.