What happens when a contributor does not own the copyright of the code?

I recently got a PR with a minor contribution to one of my (MIT-licensed) Julia packages. The author honestly disclosed that it was made using an AI tool.

I checked the licensing of said tool (Claude) and it actually says

we assign to you all of our right, title, and interest—if any—in Outputs

The important part is highlighted, it is an escape clause for the possibility that the tool did not actually have the rights.

Regardless of code generating AI tools, I am wondering what happens if code is contributed to an MIT-licensed project that the contributor did not have rights to (either because of a mistake, ignorance, malicious intent, or using an LLM to write it).

6 Likes

Initially, nothing at all, apart from the copyright violation. For something to actually happen, the original rights holder would approach a law firm to try to sue you (and possibly the contributor) about that, to recoup any potential damages arising from this. The exact details in how or even whether the original author can sue depend on your jurisdiction, and especially in regards to AI are not at all set in stone. It’s a messy situation.

If your concern is reducing legal liability, I’d thank the person who opened the PR, but state that you can’t accept it due to the unknown legal risk you may open yourself up to.

2 Likes

Worst case, the actual copyright holder can sue you for damages, no?

1 Like

If they can sue¹ the the repository owner, then this may be a way to entangle FOSS projects in legal battles with a malicious PR. Imagine someone contributing to Julia, and then someone else showing up claiming it is their code. Would the Julia project be liable?

I imagine that they can sue¹ the person who submitted the PR, as they would be liable for the action. But I am not a lawyer.

¹: can sue in this context means “with a reasonable likelihood of success”. Of course anyone can sue anyone else about anything.

1 Like

I definitely remember people raising this concern theoretically before, but in practice I’ve only ever personally heard of cases where copyright holders merely request that their work be excised from FOSS projects.

I’ve spent the last 20 minutes searching for any reasonably authoritative discussion of this, or example cases, and I can’t find anything. (It doesn’t help that internet search is buried in nonsense and copycat sites these days, but most of the results are about enforcement of FOSS licenses, lawsuits against LLM companies, and DMCA safe-harbor protections for platforms like Github rather than for individual projects. In desperation, I also tried ChatGPT and a couple of other plagiarism machines LLMs, and of course they give confident, authoritative-sounding answers, but when asked for citations to sources that back up their assertions I get only broken links, nonsense, and irrelevant links.)

For what it’s worth, it seems that the legal counsel of large projects (e.g. Apache, Google, GNU) are worried enough about this kind of possibility that they require a Contributor License Agreement (CLA) wherein individual contributors are required to attest that their contributions are legal. But it doesn’t seem practical for smaller projects (lacking legal staff and needing a low barrier to entry) to deal with this kind of thing. And lawyers always seem to err on the side of caution.

5 Likes

Microsoft has been employing Copilot to write code for their .NET runtime recently. Despite repeated requests (by yet another bot) to sign a CLA, the bot keeps ignoring it:

I am waiting for a third bot to come with a copyright claim.

11 Likes