Fedora is investigating a suspicious contributor account after Adam Williamson from Fedora QA reported that the account was performing inaccurate and unsupervised AI-driven actions across Fedora Bugzilla and related upstream projects.
The issue was raised on Fedora’s devel mailing list when Williamson notified contributor Nathan Giovannini and included the development and testing lists to inform others. Williamson stated the account was using “some kind of agentic AI system” to resolve Fedora bugs, but the results were “erratic” and caused issues in multiple reports.
The account reassigned Fedora Bugzilla reports to itself, despite not managing the affected packages. Williamson explained that Bugzilla assignees should be able to resolve issues in Fedora, typically the package maintainer.
The account closed several Fedora bugs after submitting or merging apparent LLM-generated upstream fixes. Williamson noted this was inappropriate, as Fedora bugs should remain open until a fix is applied, reaches stable, and is ideally verified through testing.
Additionally, other actions raised more concerns. The account closed bugs in components it did not own as NOTABUG, often with comments Williamson identified as LLM-generated. Some comments simply repeated the reporter’s description.
The most serious issue, however, involved submitted fixes. Williamson reported that the account provided incorrect LLM-generated fixes and responded to objections with further LLM-generated justifications, eventually “overwhelming the maintainer into merging the fix.” One example involved Anaconda, Fedora’s installer.
Later that day, Williamson updated the thread, reporting that Giovannini claimed his credentials had been compromised and denied involvement with the AI system. Williamson advised treating all actions by the account with suspicion and said he would continue to review Bugzilla history and related upstream pull requests more closely.
Anaconda maintainer Martin Kolman later confirmed that the PR had been reverted in Anaconda. In a follow-up reply, he said that two of the related PRs had already been released in Anaconda 45.5 two days earlier and suggested untagging that build “from the abundance of caution.”
For additional details, see the full discussion.
