Checking AI-Written Code for Open Source It Reproduced

AI coding assistants write a lot of code now, and most of it is new: glue between your own functions and small helpers built for the problem in front of them. Now and then, though, an assistant writes something it has seen many times before. A well-known function from a popular library comes out nearly word for word, sometimes with the names changed to fit your code.

That copy can carry the licence of the code it came from. If the original was MIT, you owe its authors a copyright line in your notices. If it was GPL, the copy may not belong in a closed product at all. The assistant doesn’t tell you which happened, and code review rarely catches it, because the code looks fine and does what it should.

A helper in the sample shop next to the Remixware finding for it: the function matches tinyjson 1.2.0 with every name changed, MIT licence, attribution missing.

What to Compare With

An assistant reproduces what it saw often, and what it saw often is popular open source. Two sources cover most of that:

The libraries in your own stack. An assistant writing Go has most likely seen the popular Go packages, and the ones your project uses are already on your disk. Index them: remixware index ~/go/pkg/mod node_modules --out deps.rmx.
Everything else, through SCANOSS. The free SCANOSS service compares your files with a large knowledge base of public open source. Add --scanoss to the check, and Remixware asks it with fingerprints of your files.

What Renaming Doesn’t Hide

Assistants often change names to fit the code around them. Remixware drops comments and layout and replaces every name with a number before it compares, so a renamed copy still matches. Here’s one from the test project that comes with Remixware, where a pretty-printer was copied from a small MIT library with every variable renamed:

ATTRIBUTION MISSING  tools/prettyjson.py:1-32
                     tinyjson 1.2.0, __init__.py:1-32 (MIT), copied with names changed, 100% match
                     Keep its copyright line and the MIT licence text with your copy, for example
                     in a third-party notices file.

In the benchmark, Remixware found 95% or more of renamed copies of 100 tokens or more, and about half of renamed copies between 50 and 99 tokens. Short renamed code is hard to tell apart from code that’s merely similar, so Remixware asks for more evidence before it reports one.

Where It Fits

The cheapest time to catch a copy is before it merges. Add remixware check to the pull request build, so a GPL copy fails the build with the file, the lines and the source in the log, and a missing notice can be fixed with remixware notice. The CI post has a ready step for GitHub Actions.

None of this means AI-written code is suspect as a rule. A project with nothing copied gets a clean report, as the sample clean project shows. The check is there for the function that did come from somewhere, so you find it before a customer or a buyer does.