A developer preparing to release an open-source software library asked the Hacker News community whether any software licenses exist that would prevent large language models from ingesting the code into their training data. The question, posted with a modest three points and a single comment, points at a problem that is growing more urgent as AI companies continue to scrape public code repositories at scale.
Open-Source Licenses Were Not Built for This
Traditional open-source licenses govern how humans can use, modify, and redistribute software. The MIT license grants broad permission with minimal restrictions. Apache 2.0 adds patent grants and attribution requirements. The GPL requires derivative works to use the same license. None of these frameworks anticipated a scenario where a third party would read the code not to use it as software, but to train a statistical model that reproduces patterns from it.
When a developer releases code under an open-source license, they grant broad rights to anyone who encounters the code. AI companies that scrape GitHub repositories are exercising those rights in a way the license authors never contemplated. The code is being used, in a sense, but not in the way the license was designed to regulate.
The Enforcement Gap
The developer who posted the question acknowledged the core difficulty: even if a license existed that prohibited AI training, enforcement would be nearly impossible. A model trained on millions of repositories does not retain copies of the code in a form that can be audited. The training process transforms source code into statistical weights, making it difficult to prove that any specific repository was ingested.
Some AI companies have published policies stating that they respect certain license restrictions. Others have not. The developer asked whether any labs have made public commitments about which licenses they honor during training. The single comment on the post did not provide a direct answer, which itself is revealing. The information either does not exist in a reliable, centralized form, or the commitments that do exist are not specific enough to answer the question.
Emerging Approaches
The broader ecosystem is experimenting with several approaches. The Data Provenance Initiative has cataloged training datasets and their licensing compositions, creating a layer of transparency that did not exist a few years ago. Some model providers now offer opt-out mechanisms for repository owners, though these typically require active participation and do not retroactively remove data from models already trained.
Technical approaches include data poisoning tools that inject imperceptible changes into code, making it less useful for training without affecting its functionality. These tools are still experimental and raise their own questions about collateral damage to legitimate downstream users. The WebAI initiative has proposed machine-readable opt-out tags that training pipelines could theoretically respect, but adoption remains limited.
A few projects have attempted to create AI-specific licenses. The Galactic Public License and similar efforts add explicit restrictions on AI training while preserving traditional open-source rights for human users. These licenses have not gained widespread adoption, in part because their legal enforceability is untested and in part because the open-source community has historically resisted licenses that add restrictions beyond the core four freedoms.
The Practical Reality
For the developer asking the question, the practical options narrow quickly. Publishing code under a permissive license like MIT or Apache 2.0 means accepting that AI companies may use it for training, with no reliable mechanism to prevent or verify this. Publishing under a restrictive license like AGPL preserves copyleft protections for derivative software but does not specifically address training. Publishing under an AI-restrictive license that has not been tested in court introduces legal uncertainty for human users who want to adopt the library.
The most concrete action a developer can take today is to use platforms that offer opt-out mechanisms for training data and to monitor the policies of major model providers. GitHub offers an opt-out for Copilot training, though this covers only one company's practices. The Data Provenance Initiative's documentation provides visibility into which datasets include which repositories, which can help developers understand the scope of the problem after the fact.
An Unresolved Tension
The question exposes a fundamental gap in the open-source framework. The existing social contract assumes that anyone who reads code will use it as code. AI training breaks that assumption. Code becomes input to a process that produces something that looks like code but is not derived from any specific file in a legally meaningful way.
No license currently solves this cleanly. The legal, technical, and social pieces are all still moving. For developers releasing new libraries, the decision about licensing now includes a question that did not exist five years ago: how do you feel about your code being used to train models that may compete with or replace the work you are releasing? The answer depends on values, not just legal mechanics, and different developers will reach different conclusions.
The Hacker News post received little engagement, but the question it raises will only become more common as AI training continues to scale. The open-source community will need to develop answers that balance the values of openness with the new reality of how code is consumed.