An audit rated 74 of 102 updated F-Droid apps as largely LLM-written: Reveneau

Why it mattersA FOSS app store that a privacy-focused user relies on to avoid unexpected additions now carries a majority of code the maintainer did not read line by line, and the audit shows the signs any reviewer or user can look for themselves.

A blog post published on 15 September 2026 by a FOSS maintainer who writes as tintotint audits every app in F-Droid's 12 September update batch and rates 74 of the 102 as largely written by a large language model. Nineteen show little to no sign of AI involvement, and nine sit in a category the author calls hard to say. The post reached 131 points on Hacker News.

What was counted

The batch was every app F-Droid pushed as an update on 12 September 2026: a real production week, not a sample. tintotint says up front that the method is superficial. An app is placed in one of three tiers by reading the repository: recent commits and their content, the README, whether the repo contains agent setup files such as a Claude Code configuration, and whether accepted pull requests come from agents. Any project with agent setup files is placed in "mostly AI"; the other bar for that tier is that more than half of the code looks LLM-authored on a repository walk.

The counts: 74 apps (72.5 percent) mostly AI, 19 apps (18.6 percent) with no signs of AI, and 9 apps (8.8 percent) hard to say. The author flags each app with a one-line justification, so a reader who disagrees with a specific call can check the repository against the same evidence.

The specific signs

tintotint's list of what put an app into the mostly-AI tier is worth reading, because it is what any reviewer or downstream user can look for. Explicit Claude co-authorship on commits appears in Amber, Braincup, DeltaSync and MainTask, and MainTask lists Claude Sonnet 5 by name. Agent setup files in the repository, such as a Claude Code folder, was enough on its own for a mostly-AI rating. Planning .md files pushed to a repo, README emoji patterns the author calls "LLM emoji vomit", and AI-generated app icons all count.

Two unusual cases stand out. One developer, brandonp2412, releases several apps in this cycle, all built mainly by prompting AI, under widely different namespaces including com.presley.* and com.codesail.*. The author suggests either an active vibe-coder or an agent given a GitHub account. Two others, DuressKeyboard and UnlicenseLauncher, have been developed for months entirely through GitHub's web file editor rather than a git client. Four of the five apps hosted on Codeberg, which forbids AI-generated code, are rated mostly AI.

What this measures

tintotint spells out the limits. The three-tier judgement is one person's read of one week's batch, no code quality analysis, no maintainability check. The author's opinion of LLMs is stated up front and is negative, which matters when reading a judgement that came down to a quick impression of a commit history. The 72.5 percent figure is a rough measure of how much code visibly involves an LLM, not for how much is broken.

The number is still the first anybody has published on F-Droid with this level of detail, and it changes what a privacy-focused Android user does when they open F-Droid to look for an alternative to a proprietary app. The default assumption is now that most of what was released this week was written by an agent, that the human whose account made the release may not have read every diff, and that Codeberg hosting is not a reliable signal on its own. The five-minute check the audit uses is the same one anyone can run: open the repo, read the last twenty commits, and search for a CLAUDE.md or .agents folder.

Source

How much of F-Droid is LLM generated?, tintotint, 15 September 2026. Hacker News discussion, 131 points.

This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.