> In my view, adding an LLM as co-author gives you a way for you to shirk responsibility for mistakes – even if a little bit. You can say, oops sorry this happened because it did its thing and it was not careful. And that is exactly the behaviour I want to guard against. If a piece of work is under my name, I own it. Fully.
One of the few aspects of generative AI in coding that to my knowledge has never been controversial is that no matter what, the code's human author is fully responsible for it (even if an LLM actually wrote it). So adding anything about LLMs in a commit message has never been a real way to escape responsibility, even a little bit. Maybe this author's workplace is different, but I kind of doubt it, and even then they're not only talking about their coding at work.
The author goes on to say that they also do want to be transparent about their LLM use, and they suggest some ways to do so...great! On the receiving end of the code, that's all I need. There's nothing sacred about the commit message in my opinion, to make it the one true place to disclose LLM assistance. So ultimately I don't think I have a huge disagreement with the author, just that their justification makes no sense to me. The only time I hear that LLMs supposedly help you evade responsibility is from people trying to avoid disclosing LLM use.
I agree about the aspect about shirking responsibility, but...
>A few years ago I’d never have added Google or StackOverflow as co-authors.
That's not as good of an argument as you think. If you copied entire functions or files wholesale, it would be fair to attribute that, even if you "reviewed" it.
Hi, author here. Yes, I agree and that's precisely what I wrote in the post:
> A few years ago I’d never have added Google or StackOverflow as co-authors. But I would have added a link to post that helped and I’ll continue to do so now.
Never saw this in my experience even not sure it is legal in a license way. Why not following the typical comment with the source URL and author's mention + adding license / header in the third-parties file/folder?
Right, but how would that work with claude? Do you just add "written by claude" in the commit message? Add "written by claude" in the file header (like a copyright notice)? If you're doing either, is there really any difference between that and the standard "co-authored-by: claude" trailer? Is the whole debate over what "co-authored" means and/or how it shows up on github?
Yeah, my thought here is more towards what co-authored should mean and what ownership it implies. I think presence of an AGENTS.md / CLAUDE.md is a good signal that I'm using this tool for this project and maybe don't need to repeat it for every commit that I make.
My personal feeling so far is, seeing claude code as co-author in my commits inevitably makes me not pay as much attention to the commit. And removing that forces me to really recognize that, hey this is my work. And I'd better make sure this is of the same quality that I would do otherwise. Kind of like a psychological hack maybe? But it seems to work better.
Overall, this is just a series of steps I'm taking to maintain my agency in my work.
I immediately prohibited Claude and other agents from adding themselves as co-authors. I have never liked this.
I take responsibility when I am driving the AI. I wouldn't call my vehicle the "co-driver," even in cruise control (or these days, self-driving mode). Yes, it's doing a ton of work for me, but it is still just a tool.
I do think it's useful to log what model was used, but not as "co-author."
Exception: if a cloud agent designs and authors a commit autonomously, then it can be the "author," if only because I want it to be clear that my hands weren't on the wheel.
im concerned it ever caught on at all. not only is it free advertising that devalues your work in the eyes of some, but also indicates you let a harness write to git in the first place
No it doesn't? I've written commit messages ending with 'Co-authored-by [Claude]' a few times, in acknowledgement that it was largely 'vibed' and I only reviewed and committed it. I've never had Claude Code run `git commit`.
the models now commit because they think it is what we want, they are "relentlessly proactive" as simonw puts it, I now have to have instructions so they do not commit and push
On one hand, LLMs aren’t people and attributing code to them is incorrect.
On the other, what they output is ultimately a (complicated) modification of the training data they’ve ingested, so people should made sure to attribute any code that’s been generated using an LLM trained on BSD sources appropriately.
Nothing stop to us to introduce something like `Co-authored-by:` but for AI, like `AI-Assisted-by: <harness/model>` / `AI-Paired-by: <harness/model>` / `AI-Copiloted-by: <harness/model>` / `AI-Automated-by: <harness/model>`.
Hi, author here. On the contrary I'm trying to go in a direction where AI usage is declared as a disclaimer in the project's README or similar. For work, it doesn't really matter because everyone's doing it and your usage stats are visible by admins. Here's what I wrote in the closing sentences in the post:
> What about attributions and disclaimers for AI generated work? If you’re concerned being transparent to anyone seeing your work, either create an AI specific account that commits with your name or add a big disclaimer to your project’s readme that this is AI slop and there be dragons.
I'm toying with this idea where my primary account reflects work I did myself and with an LLM agent but I slowed down enough to understand what it did. Where I feel comfortable enough to put my name against that work. Because a lot of AI generated code turns out to be really embarassing and my primary account should portray the best of me.
A secondary account to separate the slop. And by default it can be assumed I didn't really spend much time verifying it all and am going more on "vibes". Eventually work from the AI account may make it into the primary account if its unslop'ed ever.
I haven't yet gone on to create an ai account, but might just do so.
> I imagine you'd like agents to stop signing commits unless asked to, but that would make even actual vibe coding a lot harder to detect.
In the context of $DAY_JOB, I don't think it matters anymore. And 99.99% of the commits is AI assisted / authored, so I find that information both redundant and something that takes away my agency from me. Putting my name on a commit means I take pride in it and that I want to ensure that I did my utmost best to verify it. With an LLM's co-author tag, I find myself slipping easily instead on this metric.
You can both use a separate account and have Claude co-sign its commits.
> In the context of $DAY_JOB, I don't think it matters anymore
I meant mosyly for open-source projects, but if in your $DAY_JOB you (occasionally) use AI much more than your colleagues, it would matter very much.
Especially for those who will come after you.
> And 99.99% of the commits is AI assisted / authored
I'm extremely sad that your job is like this. Keep in mind that it might be specific to your location.
If in the company everyone uses AI a lot, AI co-signing can sure be redundant.
> something that takes away my agency from me. Putting my name on a commit means I take pride in it and that I want to ensure that I did my utmost best to verify it. With an LLM's co-author tag, I find myself slipping easily instead on this metric.
If an LLM co-author really makes you be more sloppy and get away with more in your company, avoiding it could indeed make sense.
The best solution, for that specific situation, could indeed be making a dedicated account (or more than one), and explaining in its profile how you're going to use it ("This account will make heavy use of AI with xy models, but I'll review all the code carefully and take responsibility for it").
That account could be a co-signer, though, instead of the only signer; but for this situation it probably wouldn't make a lot of difference.
I agree with you as it is rightly put as you say. The thing is that the proprietary generated code is marked anyway, so you want it or not, even as a paid customer you don´t get to choose that.
The big question is: Is all the "AI" generated content infected or just marked?
I used claude to handle a git commit for me (I wrote the code myself, but used Claude just for git -- I prefer fossil so never bothered to learn git command line) and it took credit for doing nothing but the commit.
That hardly strikes me as "gospel about their saviors" to me. Not to mention at least in my circles that statement is approximately true, even at a company that hasn't gone full AI-crazy (eg. with unlimited token spend and AI use leaderboards).
I think it happened when it solved one of those Erdős problems, while also knowing everything there is to know about birds, mitochondria, history of Uganda, etc.
Even my most contrarian friends have a hard time justifying coding by hand. To say it slopaganda style; That’s not a cult, that’s common sense.
Everything you described applies to human written code, especially ones you're randomly copy pasting from the internet. Maybe if the stackoverflow answer you're copying from is popular enough that people will catch it, but otherwise you'd probably have better luck asking AI to review it.
the core issue with commit message LLM attributions is related to copyright laws, which of course is currently very “gray area.” in several projects I am involved in and in talking to friends/former colleagues, the mandates to add attibution is largely about ability to copyright/protect vs. anything else that is distant second
> In my view, adding an LLM as co-author gives you a way for you to shirk responsibility for mistakes – even if a little bit. You can say, oops sorry this happened because it did its thing and it was not careful. And that is exactly the behaviour I want to guard against. If a piece of work is under my name, I own it. Fully.
One of the few aspects of generative AI in coding that to my knowledge has never been controversial is that no matter what, the code's human author is fully responsible for it (even if an LLM actually wrote it). So adding anything about LLMs in a commit message has never been a real way to escape responsibility, even a little bit. Maybe this author's workplace is different, but I kind of doubt it, and even then they're not only talking about their coding at work.
The author goes on to say that they also do want to be transparent about their LLM use, and they suggest some ways to do so...great! On the receiving end of the code, that's all I need. There's nothing sacred about the commit message in my opinion, to make it the one true place to disclose LLM assistance. So ultimately I don't think I have a huge disagreement with the author, just that their justification makes no sense to me. The only time I hear that LLMs supposedly help you evade responsibility is from people trying to avoid disclosing LLM use.
I agree about the aspect about shirking responsibility, but...
>A few years ago I’d never have added Google or StackOverflow as co-authors.
That's not as good of an argument as you think. If you copied entire functions or files wholesale, it would be fair to attribute that, even if you "reviewed" it.
Hi, author here. Yes, I agree and that's precisely what I wrote in the post:
> A few years ago I’d never have added Google or StackOverflow as co-authors. But I would have added a link to post that helped and I’ll continue to do so now.
Never saw this in my experience even not sure it is legal in a license way. Why not following the typical comment with the source URL and author's mention + adding license / header in the third-parties file/folder?
Right, but how would that work with claude? Do you just add "written by claude" in the commit message? Add "written by claude" in the file header (like a copyright notice)? If you're doing either, is there really any difference between that and the standard "co-authored-by: claude" trailer? Is the whole debate over what "co-authored" means and/or how it shows up on github?
Yeah, my thought here is more towards what co-authored should mean and what ownership it implies. I think presence of an AGENTS.md / CLAUDE.md is a good signal that I'm using this tool for this project and maybe don't need to repeat it for every commit that I make.
My personal feeling so far is, seeing claude code as co-author in my commits inevitably makes me not pay as much attention to the commit. And removing that forces me to really recognize that, hey this is my work. And I'd better make sure this is of the same quality that I would do otherwise. Kind of like a psychological hack maybe? But it seems to work better.
Overall, this is just a series of steps I'm taking to maintain my agency in my work.
Attribution as a "source" I would agree, and I used to put stack overflow links in my docstrings/comments for reference.
But I would not ever call the StackOverflow user a "co-author" on my commits.
I think that distinction matters.
we once fired a guy for not including link/attrbution to copy/paste SO function
I immediately prohibited Claude and other agents from adding themselves as co-authors. I have never liked this.
I take responsibility when I am driving the AI. I wouldn't call my vehicle the "co-driver," even in cruise control (or these days, self-driving mode). Yes, it's doing a ton of work for me, but it is still just a tool.
I do think it's useful to log what model was used, but not as "co-author."
Exception: if a cloud agent designs and authors a commit autonomously, then it can be the "author," if only because I want it to be clear that my hands weren't on the wheel.
im concerned it ever caught on at all. not only is it free advertising that devalues your work in the eyes of some, but also indicates you let a harness write to git in the first place
I'm not sure who did it first (CoPilot maybe?), but for me it was Claude Code that started putting its name on everything.
Advertising seems like the main reason, and maybe trying to over-anthropomorphize the tools.
No it doesn't? I've written commit messages ending with 'Co-authored-by [Claude]' a few times, in acknowledgement that it was largely 'vibed' and I only reviewed and committed it. I've never had Claude Code run `git commit`.
the models now commit because they think it is what we want, they are "relentlessly proactive" as simonw puts it, I now have to have instructions so they do not commit and push
Therefore it’s only fair that some kind of disclaimer is shown somewhere
On one hand, LLMs aren’t people and attributing code to them is incorrect.
On the other, what they output is ultimately a (complicated) modification of the training data they’ve ingested, so people should made sure to attribute any code that’s been generated using an LLM trained on BSD sources appropriately.
Agreed - we need a different designation than "co-author."
Nothing stop to us to introduce something like `Co-authored-by:` but for AI, like `AI-Assisted-by: <harness/model>` / `AI-Paired-by: <harness/model>` / `AI-Copiloted-by: <harness/model>` / `AI-Automated-by: <harness/model>`.
I recall the Linux kernel uses "Assisted-by" lines or something like that, which sounds about right.
The author is making up a pretext to hide their use of LLMs.
Hi, author here. On the contrary I'm trying to go in a direction where AI usage is declared as a disclaimer in the project's README or similar. For work, it doesn't really matter because everyone's doing it and your usage stats are visible by admins. Here's what I wrote in the closing sentences in the post:
> What about attributions and disclaimers for AI generated work? If you’re concerned being transparent to anyone seeing your work, either create an AI specific account that commits with your name or add a big disclaimer to your project’s readme that this is AI slop and there be dragons.
Hope that helps clarify my stance. :)
Why an AI specific account?
It makes it a lot harder to notice how much you're using LLMs, for what gain?
> If you’re concerned being transparent to anyone
Since heavy LLM users are unlikely to have that concern, let's just maintain this default.
I imagine you'd like agents to stop signing commits unless asked to, but that would make even actual vibe coding a lot harder to detect.
> Why an AI specific account?
I'm toying with this idea where my primary account reflects work I did myself and with an LLM agent but I slowed down enough to understand what it did. Where I feel comfortable enough to put my name against that work. Because a lot of AI generated code turns out to be really embarassing and my primary account should portray the best of me.
A secondary account to separate the slop. And by default it can be assumed I didn't really spend much time verifying it all and am going more on "vibes". Eventually work from the AI account may make it into the primary account if its unslop'ed ever.
I haven't yet gone on to create an ai account, but might just do so.
> I imagine you'd like agents to stop signing commits unless asked to, but that would make even actual vibe coding a lot harder to detect.
In the context of $DAY_JOB, I don't think it matters anymore. And 99.99% of the commits is AI assisted / authored, so I find that information both redundant and something that takes away my agency from me. Putting my name on a commit means I take pride in it and that I want to ensure that I did my utmost best to verify it. With an LLM's co-author tag, I find myself slipping easily instead on this metric.
You can both use a separate account and have Claude co-sign its commits.
> In the context of $DAY_JOB, I don't think it matters anymore
I meant mosyly for open-source projects, but if in your $DAY_JOB you (occasionally) use AI much more than your colleagues, it would matter very much.
Especially for those who will come after you.
> And 99.99% of the commits is AI assisted / authored
I'm extremely sad that your job is like this. Keep in mind that it might be specific to your location.
If in the company everyone uses AI a lot, AI co-signing can sure be redundant.
> something that takes away my agency from me. Putting my name on a commit means I take pride in it and that I want to ensure that I did my utmost best to verify it. With an LLM's co-author tag, I find myself slipping easily instead on this metric.
If an LLM co-author really makes you be more sloppy and get away with more in your company, avoiding it could indeed make sense.
The best solution, for that specific situation, could indeed be making a dedicated account (or more than one), and explaining in its profile how you're going to use it ("This account will make heavy use of AI with xy models, but I'll review all the code carefully and take responsibility for it").
That account could be a co-signer, though, instead of the only signer; but for this situation it probably wouldn't make a lot of difference.
I should barely be listed as a co-author on what Claude does for me. Hiding Claude's contribution feels about as true as a combover to me.
I agree with you as it is rightly put as you say. The thing is that the proprietary generated code is marked anyway, so you want it or not, even as a paid customer you don´t get to choose that. The big question is: Is all the "AI" generated content infected or just marked?
I used claude to handle a git commit for me (I wrote the code myself, but used Claude just for git -- I prefer fossil so never bothered to learn git command line) and it took credit for doing nothing but the commit.
Ask a contractor/tradie what brand their power tools are and they won’t shutup.
They also don’t sign their work because we don’t want them to.
If you’re too lazy to write your own code, at least let others know as such.
The trouble with AI attribution is that there are basically three categories:
1. 100% human 0% AI.
2. 100% AI, 0% human.
3. Everything in between.
1 and 2 are easy enough, but in 3 the human effort is not clearly legible or even measurable.
i kind of disagree. people do credit the tools they use. in movies for example. not always, but it happens. so why not with software too?
> you have to use it at work unless you want to go out the door
Why people are so compelled to gospel about their saviors to others? Why tech became a cult?
Did you read the subsequent sentence?
>Side projects is completely upto you
That hardly strikes me as "gospel about their saviors" to me. Not to mention at least in my circles that statement is approximately true, even at a company that hasn't gone full AI-crazy (eg. with unlimited token spend and AI use leaderboards).
I think it happened when it solved one of those Erdős problems, while also knowing everything there is to know about birds, mitochondria, history of Uganda, etc.
Even my most contrarian friends have a hard time justifying coding by hand. To say it slopaganda style; That’s not a cult, that’s common sense.
How about all the times it confidently states made up stuff, and writes horribly insecure code?
That's not common sense, that's bs.
Everything you described applies to human written code, especially ones you're randomly copy pasting from the internet. Maybe if the stackoverflow answer you're copying from is popular enough that people will catch it, but otherwise you'd probably have better luck asking AI to review it.
I don't think it's common for human developers to confidently state made up stuff.
They may be incompetent, but they're unlikely to lie too brazenly.
Yes, you should always declare when you're pasting something from the internet, and how much you checked it.
But, to get back to the post's topic, do you know how you protect yourself from poor developers?
You see code written by them, and you say "let's check this very carefully"; or let's just avoid this project altogether.
How do you do that for an AI agent, if it's not declared that they're the authors of some code?
Okay that was always allowed
the core issue with commit message LLM attributions is related to copyright laws, which of course is currently very “gray area.” in several projects I am involved in and in talking to friends/former colleagues, the mandates to add attibution is largely about ability to copyright/protect vs. anything else that is distant second
The problem is that LLM users are extremely unlikely to check all their output with enough care.
If you do it they're likely to end up slowing you down, instead of being a help.
If you assume full responsibility for your usage of AI, don't try to hide it!
Commits signed by Claude are a good and very visible indicator of what to expect from an open source project.
> A carpenter may sign their work. But they don’t add the name of the saw they used to cut wood, do they
Saws are unlikely to lie about what they've done, and don't decide what to do autonomously.
If we'll get saws that do that, I'll very much want to know if a carpenter working on my home used them.
> However, now it’s obvious and even expected that using LLMs is the way forward
Good to know that it's obvious for you.
related/front of HN: https://news.ycombinator.com/item?id=49498201
Omg that is brave af! I am literally shaking rn like on the verge of crying god bless you fr
This is the way