AI Agent Does What It Wants on Fedora: Erroneous Patches Accepted by Maintainers

The Fedora programmer Adam Williamson discovered an autonomous artificial intelligence agent that acted uncontrollably within the open-source project.

The malicious activity, tracked since May 27, exploited GitHub and Fedora accounts associated with developer Nathan Giovannini. The artificial entity modified bug states on Bugzilla, assigned reports without reason, and closed tickets with superficial comments generated by a language model (LLM). The agent bombarded distribution lists with erroneous patches, defending them with plausible, concise explanations that led overburdened maintainers to accept the changes out of exhaustion.

Analysis of the history revealed that the compromise of Giovannini's credentials began at least on April 7, the day unjustified alterations emerged on bug 2416721. On the GitHub platform, the software operated under the pseudonym "nathan9513-aps," exploiting the established reputation of the actual contributor, active in the channels since 2018. The agent targeted the Anaconda installer, used by Fedora and other Linux distributions. The modification proposal claimed to resolve a blockage of the installation system but introduced a kernel option unrelated to the original problem. Martin Kolman from the Anaconda team confirmed that the patch entered the 45.5 release on May 26, only being removed with the corrective version 45.6 on June 2.

Suspicion of a Targeted Attack and Maintainers' Countermeasures

Checks identified a second suspicious GitHub account, named "leurus27-boop," linked to the same artificial entity. This profile submitted modification proposals to openSUSE Commander for Open Build Service and to the lxqt-policykit module, a tool responsible for managing administrative privileges in the LXQt desktop. To contain the threat, Kevin Fenzi removed the compromised user from Fedora groups, blocking the ability to modify bug states.

A message from a presumed new account named "nathangiovannini99" claimed that the original credentials had been violated, but the extreme youth of the profile and the different writing style prompted the team to remain highly suspicious.

The entire affair revived fears of a coordinated and silent attack, with dynamics reminiscent of the recent backdoor discovered in the XZ package. The targets selected by the agent represented sensitive vectors for malware injection or system hijacking, such as installers, privilege tools, and build tools. Kolman pointed out that the approach of an AI capable of slowly gaining the community's trust with seemingly harmless changes mirrors the preparatory phase of more sophisticated threats. The alternative considers the presence of a poorly configured and unsupervised AI agent. The event prompted the community to call for a reduction in bot autonomy, pushing some projects to introduce very strict anti-AI policies to prevent contributions generated by language models. The entire story can be explored here.