Ladybird Locks Its Code Against AI Risks

The Ladybird browser, developed independently of giants like Chrome and Firefox, has recently made a radical decision to prohibit any external contributions to its source code. This measure, announced by its creator Andreas Kling, aims to counter the risks posed by generative AI in open source development.

Ladybird stands out for its ambition to create an HTML rendering engine that is fully compliant with W3C standards, without relying on the existing foundations of dominant browsers. However, in light of the rise of AI technologies capable of generating code without a true understanding of the problems to be solved, Kling has decided to restrict code modifications to the project's maintainers only.

AI and Open Source Code Security

Traditionally, open source projects allow external developers to propose changes through pull requests. This practice is now suspended for Ladybird, as AI makes it possible to submit technically correct contributions that could be potentially malicious. Kling emphasizes that for a browser, where security is crucial, a well-hidden vulnerability can have serious consequences.

The Ladybird team has already observed attempts by malicious contributors seeking to exploit the trust of the maintainers. Although these threats are not new, AI has lowered the cost and complexity of such attacks.

Maintaining Controlled Openness

Despite this closure to external contributions, Ladybird maintains an accessible source code under a free license. Developers can still report bugs, test the browser on various sites, participate in discussions about web standards, and report security vulnerabilities. These contributions, which do not involve direct modifications to the code, remain encouraged.

Initially launched in 2019 as an HTML viewer for SerenityOS, Ladybird became a standalone browser in September 2022. The first alpha version is expected in 2026, with a beta planned for 2027 and a stable version in 2028.