A Free App Goes In, A Paid Clone Comes Out — This AI Copies Any Open-Source Tool In Minutes
A Free App Goes In, A Paid Clone Comes Out — This AI Copies Any Open-Source Tool In MinutesTwo guys built a robot that photocopies free software, rips off the “you must credit us” sticker, and hands you back a legally-different twin you can sell. They demoed it at the biggest open-source conference on Earth. On purpose.
Months of work → gone in minutes. The tool’s called Malus.sh. It strips the free-software rules off a project and spits out a “clean” version with your own price tag — and the wild part is it might be 100% legal.
Built by Dylan Ayrey (the Truffle Security guy) and Mike Nolan (a software architect who literally works for the UN), shown off at FOSDEM 2026. They call it “clean room as a service.” The community is losing its mind. (Full story on TechSpot →)
🧩 Dumb Mode Dictionary (read this first, takes 20 seconds)
| Fancy word | What it actually means |
|---|---|
| Open-source | Software where anyone can see the recipe (the code) and use it for free |
| License | The rulebook attached to free code — usually “cool, use it, BUT give us credit / keep it free too” |
| Copyleft | The strictest rule: “if you use our free code, YOUR thing has to be free too.” It’s a trap that keeps stuff open |
| Clean room | Building a copy of something without ever looking at the original code — so legally it’s “your own work” |
| Malus.sh | The new AI tool that does the clean-room copying for you, automatically, in minutes |
| Proprietary | The opposite of free — “you can’t see the recipe and you gotta pay me” |
🧠 Wait — what actually happened here?
Okay so for decades, a HUGE chunk of the internet has run on free code that regular people and companies wrote and gave away. The deal was simple: use our stuff, just follow our rules (credit us, or keep your version free too).
Two researchers just built an AI that quietly deletes those rules.
You point Malus.sh at a free tool. It studies it, rebuilds a fresh copy from scratch, and hands you back something that works the same but has none of the “you owe us” strings attached. You slap your own name and price on it.
Nolan calls it a “provocation” — basically a piece of functional satire built to force a conversation the open-source world keeps dodging. Their motto? “If we don’t do it, someone else will.” Chilling. Honest. Both.
🏭 How the copy machine works (it's sneakier than you'd think)
The trick is it uses two separate AIs that never talk to each other about the actual code:
- AI #1 (the Spy): looks at the original free tool and writes a plain-English instruction sheet — “here’s what this thing does, step by step.” It never copies a single line.
- AI #2 (the Builder): never sees the original. It only gets that instruction sheet, and builds a brand-new version from zero.
Because Builder-AI never touched the original recipe, the new code is technically “independently created.” That’s the whole clean-room design trick — and it’s the same legal move that let companies legally clone the IBM PC back in the '80s.
The difference? That used to take teams of engineers months. Now it’s minutes. (I ran the idea past a dev friend and he just went quiet for a bit.)
⚖️ Why this might actually be legal (the 150-year-old loophole)
This all hangs on a dusty old court case: Baker v. Selden (1879, yes really).
The rule it set: copyright protects the way you wrote something, not the idea itself. You can’t copyright “a to-do list app” — only your specific code for it. So if a fresh AI writes brand-new code that does the same job… there’s no copied “expression” to sue over.
That loophole was fine when cloning took a year of sweat. Nobody worried. But when a robot does it over a coffee break? The whole copyleft system that protects free software starts looking like a screen door on a submarine.
📊 The receipts (numbers that matter)
| Thing | Number |
|---|---|
| Time to clone a whole project (old way) | Months (teams of engineers) |
| Time to clone with Malus.sh | Minutes |
| AIs involved | 2 (Spy + Builder, kept apart) |
| Legal precedent it leans on | Baker v. Selden, 1879 |
| Where it debuted | FOSDEM 2026 (biggest open-source dev conference) |
| Rules it strips | Attribution + copyleft |
| Creators’ vibe | “If we don’t do it, someone else will” |
🗣️ What the timeline's saying
- Maintainers: straight-up furious — “we gave this away for free and now a bot resells it stripped of our name?”
- Startup bros: already DMing each other “bro… the ideas
” - Lawyers: popcorn emoji. Nobody knows how a court rules on AI-speed clean rooms yet.
- The creators themselves: insist it’s a warning shot, not a business. But it’s open. It exists. The genie’s out. (more legal breakdown here)
Cool. So a Robot Can Xerox the Whole Internet Now… Now What the Hell Do We Do? ( ͡° ͜ʖ ͡°)
🕳️ The Graveyard Reviver
There are THOUSANDS of free tools people loved that died — the creator got bored, moved on, stopped updating. But the users? Still stuck. Still begging in the comments “please someone bring this back.”
Find one of those dead-but-loved tools. Clean-room clone it, polish the ugly parts, and host it as a simple “just log in and use it” paid version for the folks who can’t set it up themselves.
Example: Amara, 26, in Lagos, digs through GitHub for popular tools marked “no longer maintained” with hundreds of sad comments. She rebuilds one dead invoicing tool, hosts it on Vercel, and charges $8/mo to people who just want it to work without the tech headache. 40 subscribers in two months.
Timeline: First paying user in ~2 weeks. Good run for 6–12 months until the original author notices or someone bigger clones the same thing.
📋 The Spec Broker (sell the map, not the treasure)
Here’s the sneaky-smart bit: the real gold isn’t the cloned app — it’s the plain-English instruction sheet the first AI writes. That “here’s exactly how this works” document is worth money to any builder who wants to make a competitor without legal risk.
So don’t sell clones. Sell specs. Become the guy who hands developers a clean, ready-to-build blueprint of popular tools.
Example: Ravi, 29, in Pune, generates detailed clean-room blueprints of trending open-source apps and sells them as $49 “build-your-own-X kits” in a Gumroad store. Buyers get the map; they do the building; he never touches a line of anyone’s code.
🪟 The Patch Window Sprint
Right now the free-software world is scrambling to change their rulebooks to block this AI trick. That means there’s a short window — a few weeks, maybe a couple months — before licenses tighten and the loophole narrows.
Move fast. Grab the 3 most-requested “ugh I wish this was a proper hosted service” tools and be first to market before everyone wakes up.
Example: Tomás, 23, in Buenos Aires, camps in subreddits like r/selfhosted hunting the phrase “wish this was hosted for me.” He clones the top-requested one, launches a dead-simple paid version, and grabs the search traffic before ten copycats show up.
🎣 The Niche Reskin
A free tool built for “everybody” is boring and nobody pays for it. But the exact same tool dressed up for ONE type of person? That’s a business.
Clone a general free tool, then reskin it hard for a specific crowd — dentists, wedding DJs, small churches, dog groomers. Same engine, niche paint job, niche prices (niches pay WAY more).
Example: Lena, 31, in Kraków, clones a plain open-source booking tool and rewraps it as “the booking system built just for tattoo studios” — their words, their look, their needs. Charges $25/mo when the free original made $0. 15 studios signed in month one.
🧾 The Clone Detective (the white-hat flip — sell the shovels)
Flip the whole thing around. This AI panic means everyone’s now scared: maintainers scared of being copied, companies scared they bought a sketchy clone. Fear = a market.
Be the detective. Offer maintainers a “we watch for clones of your project” alert service. OR sell companies an audit: “is that pricey tool you bought secretly a stripped clone of free software you could’ve had for nothing?”
Example: Deepak, 34, in Bangalore, uses free code-comparison tools like Semgrep to spot-check whether a client’s expensive software smells like a clone of a known free project. Sells $300 “license risk reports” to nervous startups. Fully legal, fully white-hat, sleeps great.
🛠️ Follow-Up Actions (bookmark these)
| Wanna… | Go here |
|---|---|
| See the actual thing | TechSpot writeup |
| Understand the legal loophole | Clean room design (Wikipedia) |
| Learn why copyleft matters | Copyleft explained |
| Find dead tools to revive | GitHub “archived” repos |
| Host your version free | Vercel |
| Sell blueprints/kits | Gumroad |
Quick Hits
| You want… | Do this |
|---|---|
| To see the copy-machine yourself |
Read the FOSDEM 2026 coverage on TechSpot |
 A dead tool to bring back |
Search “no longer maintained” on GitHub |
 To not get sued |
Read up on Baker v. Selden — ideas aren’t copyrightable |
 To protect YOUR project |
Watch for clones with Semgrep |
 To make money off the panic |
Sell “clone-risk audits” to nervous companies |
The free-software crowd spent 30 years building an honor system. A robot just walked in, read the rules, and photocopied the honor.
!