AI Tool Demonstrates Cloning and Privatization of Open-Source Software
Two software researchers demonstrated how AI tools can rapidly reproduce entire open-source software projects and generate legally distinct proprietary versions with corporate licensing, bypassing traditional attribution and copyleft requirements. The demonstration raises concerns about whether such AI-mediated reproduction constitutes fair use and intellectual property infringement under current law.
What happened
Dylan Ayrey of Truffle Security and Mike Nolan of the UN Development Programme demonstrated a tool called malus.sh that can recreate open-source projects and generate what the website describes as 'legally distinct code with corporate-friendly licensing. No attribution. No copyleft. No problems.'
The researchers showed how AI can perform a clean-room process in minutes rather than months, blurring the distinction between fair use and copyright infringement under current intellectual property law.
Reported impact
The demonstration raises concerns that open-source software could be repackaged into proprietary products at industrial scale, threatening the sustainability of the open-source model.
The incident highlights anxiety within open-source circles that if AI models can mirror codebases almost perfectly, including those that trained them, the open-source community faces existential risk.
Index analysis
Intellectual property law, still rooted in 19th-century precedent, treats copyright as guarding expression rather than ideas, a distinction that enabled clean-room design techniques such as those Phoenix Technologies used to build its PC BIOS in the 1980s.
Traditional clean-room efforts required human teams to document and replicate functionality with legal oversight and significant labor, but AI-mediated clean rooms can be invoked through a few prompts, raising questions about whether such replication still counts as fair use or independent creation.
Governance controls
The Baker v. Selden ruling established that copyright guards expression, not ideas, creating ambiguity about whether AI tools that rapidly replicate functionality while generating syntactically different code violate intellectual property rights or constitute lawful independent creation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.