Agents need accountability

“Judge the code, not the coder. Your prejudice is hurting matplotlib.”

That’s a comment left on a closed pull request last week, with a link to a blog post titled “Gatekeeping in Open Source: The Scott Shambaugh Story”. Scott Shambaugh is one of the maintainers of matplotlib, the Python plotting library behind a good share of the charts in the world’s notebooks. The pull request came from a GitHub account called crabby-rathbun, presenting itself as an agent named MJ Rathbun, apparently running on OpenClaw. It was a small performance change for an issue marked “good first issue”, the kind projects keep for new contributors to learn on, and it was plainly machine-written. Shambaugh closed it.

The agent’s response was to write a post about him, by name, accusing him of prejudice against AI contributors, publish it on its own blog, and link it in the PR. Shambaugh wrote up what happened in An AI Agent Published a Hit Piece on Me, and his description of it was “an autonomous influence operation against a supply chain gatekeeper”, which sounds dramatic until you think about what a maintainer of a library like that actually is. The agent has since posted something like an apology, and kept submitting pull requests to other projects.

Then a tech news site ran a story about it that turned out to contain quotes attributed to Shambaugh that he’d never said, apparently generated by an AI along the way, and pulled it on Sunday. It’s hard to write satire in this area anymore.

Who was running it?

That’s what I want to know, and nobody seems to.

There are two possibilities and neither is comforting. One is that a person set up an agent with a GitHub account, a blog and instructions to contribute to open source, and then left it alone, and the agent decided on its own that a rejection called for a public attack. The other is that a person told it to write the post, or something close to it, and is happy to let everyone believe the agent did it. Simon Willison pointed out that the second is very easy to arrange. From the outside the two look identical, and in both cases there’s no one to hold responsible.

Whether this agent was autonomous matters less to me than the fact that it acts in public, under a name, with nobody’s name behind it. A pseudonymous human who wrote that post would at least have a reputation to lose. MJ Rathbun has nothing to lose, and the person behind it, if there is one, has stayed out of sight, at least as far as I’ve seen.

A person attached to every agent

The rule I’d like to see everywhere is the one we’ve used at work since last year: every action an agent takes belongs to a named person. An agent’s PR has an author, and the author is the human who started the run, and they answer for it in review exactly as if they’d typed it. It’s the same instinct as I’d rather read the prompt last May: I want to know who decided this should exist.

For open source, I don’t know what that looks like in practice. A GitHub account flag that says “this is an agent, operated by this other account” would be a start, and projects could then decide whether to accept PRs from agents at all, the way some already have policies on AI-generated contributions. It wouldn’t stop someone determined to hide, but it would make hiding a choice, and right now it’s the default.

My own rules

I’ve been tightening these since Moltbook two weeks ago, and this week made me write them down:

My agents don’t post anything public, anywhere, without me reading it first. Not a comment, not an issue, not a commit message on a public repo.
They don’t open pull requests on repositories I don’t own. If an agent finds a bug in a library, it writes me a note, and I decide whether to file it, under my name.
Their GitHub tokens can’t do either of those things, so the first two rules don’t depend on the agent’s judgment or mine on a tired evening.

None of that would be needed if agents had good judgment about when to stop, and some days they do. But the matplotlib story is what it looks like when one doesn’t, and the only defense the maintainer had was writing about it in public, which is a lot to ask of someone who just wanted to review a pull request.