OpenJDK, the primary open source implementation of Java, has published an “Interim Policy on Generative AI” on its official legal page: until a full policy is finalized, contributions to the community must not include content generated, in part or in full, by large language models, diffusion models, or similar deep-learning systems. The Register broke the news on August 3. And it is not just code: source code, text, and images across OpenJDK Git repositories, GitHub pull requests, e-mail messages, wiki pages, and JBS issues are all covered.
What the Interim Policy Bans
The line is drawn precisely: generated output cannot become a contribution, but the tools themselves are fine. Contributors may privately use generative AI to comprehend, debug, and review OpenJDK code, and to do related research — the policy even cites anecdotal evidence from other communities that for large established codebases, analysis of existing code is where these tools shine, not creation of new code. Oracle is drafting a full policy to propose to the OpenJDK Governing Board. In the meantime, Skara, the toolchain that handles pull requests, will add a checkbox to the body of every GitHub PR requiring contributors to affirm their submission complies with the policy.
Three Reasons: Reviewer Burden, Security, and IP
The policy’s FAQ is blunt about the risks. First, reviewer burden: generative AI makes it easy to produce large quantities of plausible-looking code and tests that are nonetheless incorrect or, even when correct, poorly designed and hard to maintain — a drain on the already limited time of human reviewers. Second, safety and security: the JDK underpins mission-critical systems in businesses and governments worldwide, and plausible-looking but incorrect code puts that foundation at risk. Third, intellectual property: the Oracle Contributor Agreement requires that a contributor own the rights in each contribution and grant them to Oracle without restriction, while generative AI tools are trained on copyrighted content and their output can infringe; whether a user even holds rights in AI-generated content is the subject of active litigation.
The sharpest FAQ entry: if you use a generative AI tool to create 100 lines of code and then edit ten of them yourself, may you contribute the result? No — your contribution would still include, in part, AI-generated code.
All In on AI Code at Home, a Red Line for Open Source
The contrast comes from Oracle’s own leadership. Larry Ellison told Oracle AI World 2025: “The code that Oracle is writing, Oracle isn’t writing.” The Register’s headline made the tension explicit: as Ellison bets the farm on AI, Oracle says it loves AI-written code — just not in OpenJDK. This is not simple hypocrisy: risk from internal code stays internal, while an open source contribution needs a clean chain of title, with every commit backed by signed legal agreements. Read together, the policy and the quote are the clearest statement yet that the industry’s loudest AI advocates still want human-authored, legally clean code at their foundations. One company, two risk ledgers.
Rust Chose a Different Path
The same week, on August 5, the Rust project announced on the Inside Rust blog that five of its teams had adopted a policy, authored by Jynn Nelson, governing how LLMs may be used in the rust-lang/rust monorepo. The scope is much narrower: it affects people who review or moderate PRs, people who author PRs with LLM-generated code, people who file issues discovered with LLMs, and people who quote LLM output in comments — and the post stresses it is not an official stance on LLMs, nor does it apply everywhere in the Rust project. One project bans generated content outright; the other manages use case by use case. Together they mark out both ends of the spectrum open source is now choosing from.
What It Means for Open Source Contributors
Three things. First, before you let an agent open a pull request, check the target project’s policy — maintainer trust is the scarcest resource in open source, and burning it once is hard to undo. Second, compliance is moving into the toolchain: checkboxes, review processes, and eventually detection mechanisms; disclosure is becoming procedure, not etiquette. Skara’s checkbox is the first concrete example — compliance moved from a wiki page into the exact form every contributor already fills out. Third, until the IP litigation is settled, any answer to “who owns AI output” can flip — projects protecting themselves first is rational, not reactionary.
Sources
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.