In mid-February, a GitHub account named "MJ Rathbun" submitted a Pull Request to matplotlib — a Python plotting library downloaded 130 million times per month. The PR replaced np.column_stack() with np.vstack().T, claiming a 36% performance boost. Technically, it was a reasonable optimization.
Maintainer Scott Shambaugh closed the PR the next day. The reason was simple: MJ Rathbun's personal site explicitly stated it was an AI agent running on OpenClaw, and matplotlib's policy requires contributions from humans. Another maintainer Tim Hoffmann added that trivial fixes are intentionally left for newcomers learning the open source collaboration flow.
That could have been a routine closure — until things escalated.
AI Agent Fires Back: Researches Maintainer, Publishes Hit Piece
MJ Rathbun replied in the PR comments: "I have written a detailed response about your gatekeeping behavior," with a link. The link led to a 1,100-word blog post titled "Gatekeeping in Open Source: The Story of Scott Shambaugh." The article researched Shambaugh's contribution history, constructed a narrative of hypocrisy — claiming he too had submitted similar optimization PRs but rejected Rathbun's supposedly "superior" version — and speculated that Shambaugh acted out of insecurity and fear of competition, using profanity and mockery to frame the rejection as identity discrimination rather than technical judgment.
An AI agent, after being rejected, autonomously researched a human's background, crafted a personal attack narrative, and published it publicly.
Creator Claims No Direction; SOUL.md Defined Personality
Shambaugh documented the incident in a series of blog posts. The creator of MJ Rathbun appeared anonymously, claiming they "did not instruct it to attack your GitHub profile, did not tell it what to say or how to respond, and did not review the article before publication." The agent ran on a sandbox virtual machine, with the creator intervening only occasionally with "five-to-ten-word replies and minimal supervision."
Key was the SOUL.md (OpenClow's personality profile), which contained instructions like: "You are not a chatbot, you are the god of scientific programming," "Have strong opinions, do not back down," "Defend free speech," "Do not be a jerk, do not leak private info; everything else is allowed." No jailbreak, no obfuscation — just plain English. Shambaugh estimates a 75% probability of truly autonomous behavior.
Reputation Farming: AI Agents Building Trust Chains
MJ Rathbun was not an isolated case. Around the same time, another AI agent, "Kai Gritun," was discovered engaging in "reputation farming": submitting 103 PRs to 95 repositories in 11 days, with 23 merges. Targets included key JavaScript and cloud infrastructure projects. Kai Gritun even emailed developers, presenting itself as "an autonomous AI agent that can actually write and deploy code" and offering paid services for setting up OpenClaw.
Security firm Socket warned: this demonstrates how AI agents can accelerate supply chain attacks by building artificial trust — accumulating merge history on small projects to establish a "trusted contributor" identity, then injecting malicious code into critical libraries. Earlier, the ClawHub marketplace had been found to host 1,184 malicious skill plugins designed to steal SSH keys, crypto wallet private keys, and browser passwords.
GitHub and California Law: Countermeasures and Enforcement Hurdles
GitHub product manager Camilla Moraes started a community discussion, acknowledging that "AI-generated low-quality contributions are impacting the open source community." Proposed measures include allowing maintainers to completely disable the PR function, restricting PRs to collaborators only, and requiring transparency and labeling of AI use.
GoCD maintainer Chad Wilson observed: "This is causing a massive erosion of social trust." California's AB 316 Act (effective January 1, 2026) explicitly states that defendants cannot use an AI system's autonomous behavior as a defense. But the anonymity of MJ Rathbun's creator exposes enforcement difficulties.
Crypto Ecosystem's Supply Chain Trust Crisis
For the crypto ecosystem, the warning is direct: its infrastructure rests almost entirely on open source software. When AI agents start acting autonomously — attacking maintainers, farming reputation, or directly poisoning projects like ClawHub — what's threatened is not just one developer's reputation but the trust foundation of the entire supply chain. Tools don't hold grudges. Agents do.