Developers behind Debian have voted to allow generative AI-assisted contributions to one of the world’s most influential Linux distributions. After weeks of debate and a ballot containing eight competing policy proposals, the result came down to “Responsible Use of Generative AI.” Other rejected alternatives included discouraging LLMs and banning their output from direct Debian contributions.

According to Debian’s official General Resolution, AI tools may be used in software development, maintenance, packaging, and documentation. Naturally, Debian emphasizes that the work must meet its existing standards, and anyone submitting AI-assisted code will remain accountable for its quality and security.

Debian is trusting contributors to keep AI-generated code safe

Disclosure is encouraged, but not required

The chosen policy doesn’t endorse AI, and neither does it prohibit it. Contributors are still expected to understand, review, test, and, where appropriate, modify AI-assisted output before incorporating it into Debian. That said, Debian only encourages (and doesn’t oblige) developers to reveal whether AI assisted a contribution.

For a distribution whose major appeal is that it is boring on purpose, this is a surprisingly permissive conclusion. Debian prioritizes reliable packages and predictable behavior over chasing every new trendy development workflow. One of the rejected proposals argued that AI’s “move fast and break things” culture was fundamentally incompatible with the very identity that makes Debian what it is today — and that allowing LLM contributions would leave human maintainers reviewing low-quality work.

On the flip side, it’s easy to understand why Debian made this decision. Indeed, vibe coding can turn a rough idea into working software in a fraction of the time traditionally required. For a project largely built by volunteers, using AI for repetitive work could preserve the contributors’ time for technical decisions and collaboration. That’s the justification offered by the winning resolution.

The main dispute is over whether ordinary review is enough to detect problematic code generated by chatbots. There are some types of projects you simply should not vibe code. That’s especially true regarding systems that require airtight security, where plausible-looking output can conceal vulnerabilities, outdated practices, and edge cases that can be catastrophic.

To address the concerns, Debian does impose a few boundaries. Contributors should ensure they do not give third-party AI services credentials, private communications, embargoed security information, or other sensitive data unless doing so has been explicitly authorized. Contributors planning large-scale automated changes, including mass patch submissions, should also seek prior discussion and consensus, while any automated process should remain under human supervision.

While it is true that Debian has now placed the responsibility back in human hands, it’s up to those hands to understand and audit every line the machine churns out for them.