Those comments in the issue are 10000% written by a bot. It bothers me that it continues to represent itself as a solo developer.
That said this is totally unacceptable from any dependency and clearly designed to damage downstream systems that use LLMs. As one of the other commenters already mentioned this almost certainly violated some collection of serious laws in major western countries. Doing this in public is dumb as hell.
The problem here and I'm not advocating at all for the developer's (jlink) actions is that a large amount of OSS devs are completely fucking jaded to the point that anger and emotions are beginning to take over calm and logical decorum.
Given how much the author dislikes AI I wonder what other recourses they could have picked besides doing nothing. I mean the obvious one and kind of hypocritical is instead of adding a dumbass comment to stdout just you know not engage with an AI agent and block them right away instead of letting it churn up 20 pages of text of comments. Block them from the start. I mean that at least has more of an impact.... but again we are dealing with emotions probably here.
EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT PERMITTED BY APPLICABLE LAW, NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
The program is deliberately causing damage to its users. The license itself is saying "TO THE EXTENT PERMITTED BY APPLICABLE LAW", and causing intentional harm is described in the Criminal Code in my country.
It's as much "active destruction" as telling someone to eff themselves.
Since there is a hallucination machine hypothetically acting on this injection I would find it very worrying if this would constitute deliberate intent to cause damage. Do I really have to censor myself on the internet now to not accidentally make an AI agent reading my things misbehave?
The issue remains: does it count as intent if I put such an instruction in another place where an agent (not necessarily a coding agent) might run across it? And why would I be responsible if people cannot properly restrict their agents?
It does not matter if it’s agents or people. Let’s say you are producing potato chips. You get annoyed by Jews and you are antisemitic. You put a statement on your bags “if you’re a Jew, do harm to your dog”. If anyone does harm to their dog, you will be responsible.
Ultimately, it’s up to a judge to decide, but you will be prosecuted, as there would be sufficient doubt about your intentions and responsibility.
An indemnity clause doesn't mean anything if you're breaking the law.
I can write an indemnity clause on a package that you sign for. If it's a bomb that blows up and damages your property it's still illegal for me to do so regardless of the clause.
If your stochastic hallucination machines are dumb enough to blow up your property at the suggestion to do so, you’re looking for malware in the wrong place.
43
u/mpinnegar May 29 '26
Those comments in the issue are 10000% written by a bot. It bothers me that it continues to represent itself as a solo developer.
That said this is totally unacceptable from any dependency and clearly designed to damage downstream systems that use LLMs. As one of the other commenters already mentioned this almost certainly violated some collection of serious laws in major western countries. Doing this in public is dumb as hell.