Loading story…
Fedora maintainers and Red Hat engineer Adam Williamson raised concerns that contributor Nathan Giovannini used suspected AI-generated bug reports and package submissions as part of a broader pattern of inauthentic activity. The allegations drew added scrutiny because they echoed ecosystem fears after the xz backdoor case: maintainers said multiple GitHub accounts appeared linked to the same person, profile and contact details were reused, and several reports and code changes showed signs of low-quality or machine-generated content intended to build trust inside the project.
Fedora reviewed bug reports and package changes tied to the contributor, closing some issues as NOTABUG and examining modifications affecting projects including Anaconda, osc, lxqt-policykit, gwenview, and easyeffects. At least one Anaconda change was merged into version 45.5 and later reverted in 45.6, while Fedora maintainers said access was disabled or removed after the concerns surfaced, though they also noted that not every allegation had been definitively proven.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
As part of the review, Fedora maintainers determined that some of the reported issues did not represent valid bugs and closed them as NOTABUG.
After the concerns were raised, Fedora maintainers disabled or removed access associated with the contributor while reviewing the suspicious activity.
Maintainers reviewed multiple bug reports, package changes, and GitHub accounts tied to the contributor, noting reused contact details, email patterns, and low-quality or suspicious submissions affecting projects including osc, lxqt-policykit, gwenview, and easyeffects.
Red Hat engineer Adam Williamson raised concerns about Nathan Giovannini's bug reports and package contributions, saying they appeared AI-generated or otherwise inauthentic and could reflect coordinated behavior.
The suspicious Anaconda-related change that had shipped in version 45.5 was later reverted in Anaconda 45.6.
A change attributed to the suspicious contribution set was merged and appeared in Anaconda 45.5 before later scrutiny. The references identify this as one of the changes that had already landed.
The references state that Nathan Giovannini had been involved with Fedora since 2016, including participation in the Fedora Infrastructure Team.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
8 references tracked. Mallory keeps watching after this page renders.
lists.fedoraproject.org
Open sourcelists.fedoraproject.org
Open sourcelists.fedoraproject.org
Open sourcelists.fedoraproject.org
Open sourcelists.fedoraproject.org
Open sourcelists.fedoraproject.org
Open sourceopennet.ru
Open sourceopennet.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GNOME's security team changed its vulnerability-handling process by cutting the default disclosure deadline for new reports from 90 days to 30 days and by declining to forward reports to projects that prohibit AI-generated submissions. The policy shift, discussed widely on the `oss-sec` mailing list, reflects the view that most embargoed fixes are completed within the first month and that AI-assisted reporting has become common enough that many submissions now contain at least some machine-generated material. Participants also noted that some projects, including the Linux kernel, have moved away from embargoes for AI-generated reports because such findings can be easily reproduced and redistributed. The change triggered a broader dispute over open-source security governance, with maintainers arguing that low-quality, verbose, or impractical AI-assisted reports are consuming scarce triage capacity and pushing burnout onto already overstretched teams. Mailing-list contributors said many externally submitted bugs are real defects but not necessarily exploitable vulnerabilities, while others warned that rejecting accurate reports could still increase user risk. The debate expanded to the Linux Foundation's **Akrites** initiative, described by critics as an attempt to coordinate AI-era vulnerability response and potentially serve as a "maintainer of last resort" for abandoned critical packages, though others stressed that such a role would not override project ownership or maintainer authority.
Aug 6, 2026
GNOME is changing its security-report handling process after volunteer maintainers were flooded with AI-assisted vulnerability submissions. For issues reported on or after **August 1, 2026**, the project will reduce its disclosure deadline from **90 days** to **30 days**, with security lead Michael Catanzaro saying the shorter window better reflects GNOME’s workflow because valid issues are typically fixed within one to three weeks, while others often remain unresolved. GNOME said it will apply the same rules to AI-assisted and human-written reports, but projects that prohibit AI-generated content will no longer receive forwarded reports when submissions contain AI- or LLM-generated findings; those issues will instead be closed in the tracker, though maintainers may still be notified. Catanzaro, who has overseen GNOME security issue tracking since 2020 with Red Hat support, also said he will stop tracking newly reported issues in **November 2026** and fully step away by **December 1** unless an experienced community successor is found.
Aug 2, 2026
Void Linux removed 113 packages from its repository after an investigation into AI-assisted changes by developer Andrea Brancaleoni, who subsequently left the project. Affected packages included `alacritty`, `docker-cli`, `etcd`, Kubernetes, Terraform, Vagrant, and `virt-manager`; the review focused particularly on new Go dependencies and build-system changes. Void Core Team said the questioned patches had been generated with the OpenCode AI agent using the `GLM-5.3-flash` model. The team found no evidence of an intentional attempt to introduce malicious code, but deemed the changes inappropriate because of quality and correctness concerns, especially in Go-related modifications, and said the developer's access would not be restored.
Sep 14, 2026