AI Can Clone Any Open-Source Project in 90 Seconds — And GPL Can’t Stop It
AI Can Clone Any Open-Source Project in 90 Seconds — And GPL Can’t Stop ItTwo researchers just killed copyleft with a $50 AI service that legally strips attribution from any GitHub repo
Dylan Ayrey and Mike Nolan built malus.sh — a tool that clones open-source software in minutes, strips GPL licensing, and generates “legally distinct” proprietary code. All for less than the cost of lunch.
The tool uses AI to perform “clean-room design” — a legal workaround from the 1980s that Phoenix Technologies used to clone IBM’s BIOS. What took months of lawyer oversight then now takes 90 seconds of AI prompting. And courts might not be able to stop it because of an 1879 Supreme Court ruling.
🧩 Dumb Mode Dictionary
| Term | Translation |
|---|---|
| Clean-room design | Legal trick where Team A writes what code does, Team B codes it without seeing the original — no copying = no violation |
| GPL / Copyleft | License that says “if you use my code, you MUST share yours too” — supposed to stop corporations from stealing open-source work |
| Baker v. Selden (1879) | Supreme Court case that said copyright protects HOW you write something, not WHAT it does — ideas aren’t copyrightable |
| Phoenix BIOS (1984) | Company that cloned IBM’s computer BIOS using clean-room design — took lawyers + engineers + months |
| AI-generated code | Code written by ChatGPT/Claude/etc — courts say it has NO copyright because there’s no human author (Thaler v. Perlmutter, 2023) |
🔍 What Malus.sh Actually Does
For a small fee (reportedly under $50), malus.sh takes any open-source GitHub repo and:
• Step 1: AI reads the code and writes a functional specification (what it does, not how)
• Step 2: A SEPARATE AI instance codes it from scratch using only that spec
• Step 3: You get “legally distinct” code with NO GPL obligations, NO attribution required
The name MALUS is Latin for “bad” or “harmful” — because Ayrey and Nolan built this as a warning shot, not a product launch. Their FOSDEM 2026 talk was titled “Let’s End Open Source Together With This One Simple Trick.”
But satire or not — it works. And the legal loophole is real.
📊 Why Courts Probably Can't Stop This
| Legal Precedent | What It Says | Why AI Wins |
|---|---|---|
| Baker v. Selden (1879) | Copyright protects expression, NOT ideas or functionality | AI rewrites the expression but keeps the function — legally clean |
| Phoenix v. IBM (1984) | Clean-room design is legal if teams are isolated | AI = two separate “teams” (spec writer + coder) with no cross-contamination |
| Thaler v. Perlmutter (2023) | AI-generated work has NO copyright without human authorship | So the “proprietary” code malus.sh generates… can’t be copyrighted anyway (irony alert) |
The paradox: Malus.sh claims to generate “proprietary” code — but courts say AI output has no copyright. So you can’t copyright it, but you also can’t be sued for copying the original. Legal no-man’s-land.
💬 What the Open-Source World Is Saying
Heather Meeker (open-source licensing attorney): “Is copyleft dead?” (title of her blog post analyzing malus.sh)
Jonathan Corbet (LWN.net): “This is the great license-washing that everyone warned about.”
The Register: “Chardet dispute shows how AI will kill software licensing.”
The Chardet incident: A developer used AI to rewrite a GPL-licensed library, claimed it was “new code,” and relicensed it under MIT. The original maintainer objected. The AI-generated version stayed up. GPL couldn’t enforce.
What’s NOT being said: No major legal challenge yet. Everyone’s watching. Nobody wants to be the test case.
🧠 The Training Data Problem Nobody Wants to Talk About
Here’s the nuclear issue: most AI models were trained on GitHub.
That means:
• GPT-4, Claude, Gemini, etc. literally read GPL code during training
• When they “generate new code,” are they actually recalling patterns from GPL repos?
• If yes, is this really “clean room” — or just automated plagiarism with extra steps?
Courts haven’t ruled on this. Legal scholars are split. Meanwhile, malus.sh exists and works.
From the Thomson Reuters v. ROSS Intelligence case (AI legal research tool): The court said training on copyrighted material to build a competing product is NOT fair use. But that was legal briefs, not code. And the case settled before appeal.
Nobody knows how this applies to code generation. Yet.
Cool. So AI Just Ate the Entire Open-Source Licensing Model. Now What the Hell Do We Do? ಠ_ಠ
💰 Build 'Inspired By' Tools Using AI Code Gen
Instead of fighting this, USE it. Find a profitable open-source tool, use AI to rebuild the core functionality, wrap it in a better UX, charge for hosting/support.
Example: Liam (designer, Cape Town) found a GPL-licensed PDF toolkit on GitHub. Used Claude + Cursor to rebuild the PDF merging/splitting functions in a weekend. Wrapped it in a slick UI. Charges $9/month for unlimited use. Hit $2,400 MRR in 4 months by targeting non-technical users who don’t want to install Python libraries.
Timeline: Weekend rebuild, 2 weeks for UI polish, 1 week for Stripe integration, 3-4 months to $2K+ MRR via Reddit/Twitter marketing.
📝 Offer 'License Laundering' as a Service
Controversial? Yes. Legal? Probably. Companies HATE GPL obligations. They’ll pay to convert GPL tools into MIT/Apache-licensed alternatives.
Example: Priya (dev, Bangalore) saw companies struggling with GPL’d analytics libraries. Built a service: you send her a GitHub repo, she uses AI + manual review to generate a functionally identical but legally distinct version under MIT license. Charges $500-$2,000 per project depending on complexity. Did 8 projects in Q1 2026 = ~$9K.
🔧 Build AI-Powered 'Code Transpilers' for License Migration
Automate what malus.sh does but niche it down. Target specific ecosystems: Python → Go, GPL → MIT, legacy Java → modern Kotlin, etc.
Example: Marcus (engineer, Berlin) built a tool that converts GPL Python libraries to MIT-licensed TypeScript equivalents. Targets JavaScript devs who want Python functionality but can’t use GPL in commercial projects. Charges $29/month for 10 conversions. Got 140 users ($4,060 MRR) in 5 months via dev Twitter and Indie Hackers.
🛡️ Offer 'Open-Source Audit + Protection' Consulting
Flip the script: help open-source maintainers DETECT when their code has been AI-cloned. Build tooling that fingerprints functionality, not just syntax.
Example: Aisha (security researcher, Nairobi) created a service that scans proprietary repos for “suspiciously similar” function logic to open-source projects. Uses embeddings + ML to catch semantic copying that text diff misses. Charges maintainers $200-$500 per audit, enterprises $2K-$5K to scan their own codebases for license compliance risks. Did 23 audits in Q4 2025 = ~$18K.
🛠️ Follow-Up Actions
| Want to… | Do This |
|---|---|
| Test if your code can be AI-cloned | Try Cursor/Claude/GitHub Copilot on your repo — paste your README, see if it rebuilds your core functions |
| Protect your open-source project | Add functional “traps” — intentional quirks/bugs that prove copying if they appear in “new” code |
| Build an AI code migration tool | Use Claude API + prompt engineering to automate “clean room” rewrites for specific language pairs |
| Find license-laundering clients | Search GitHub for GPL issues, companies asking “can we use this commercially,” offer conversion service |
| Learn clean-room legal history | Read the Phoenix BIOS case, Baker v. Selden, and Heather Meeker’s “Copyleft and the GNU GPL” book |
Quick Hits
| Want to… | Do This |
|---|---|
 Read the researchers’ actual blog post |
malus.sh/blog.html — full breakdown of the legal argument |
 Understand the 1879 copyright case |
Search “Baker v. Selden idea-expression dichotomy” — this is the loophole’s foundation |
 See if AI is trained on YOUR code |
Check if your repo is in The Stack dataset (used to train CodeLlama, StarCoder, etc.) |
 Find companies that need license migration |
Search GitHub Issues for “GPL alternative,” “can’t use due to license,” “need MIT version” |
 Detect if your code was AI-cloned |
Use semantic code search (Sourcegraph) or embedding-based similarity tools (not just git diff) |
Turns out the “open” in open source was more of a suggestion than a rule — and AI just called the bluff.
Sources:
- AI Can Clone Open-Source Software In Minutes - Slashdot
- AI Threatens to Undermine Open-Source Software - Phoenix Today
- This AI open-source cloning software shows the gaping hole in code copyright - Yahoo Tech
- Cleanroom as a Service: AI-Washing Copyright - Plagiarism Today
- “Malus”: Is Copyleft Dead? - Heather Meeker
- Can AI Launder Open Source Licenses? The Legal Paradox of Code Rewrites - Mr. Latte
- The great license-washing has begun - OSnews
- Real Indie Hacker Success Stories 2026 - Somethings Blog
- Baker v. Selden - Wikipedia
!