AI agent ran amok in Fedora and upstream projects, reaching Anaconda

A Fedora developer has publicly documented how an allegedly unsupervised AI agent spent weeks working — and misbehaving — on the project's bug tracker and on several upstream repositories. On May 27, Adam Williamson copied Fedora's developer and testing mailing lists on a message to Nathan Giovannini about what appeared to be an agentic system running under his account. "It's great that you're trying to fix things, but the results seem to be kind of erratic," Williamson wrote.

By then he had already found dozens of instances of the agent assigning Bugzilla entries to Giovannini's account after submitting allegedly related pull requests to upstream projects, or closing a bug once a PR was merged. Williamson described some of those comments as "superficially plausible, but problematic in other ways".

A patch that reached Fedora's installer

More seriously, the agent — posting on GitHub as "nathan9513-aps" — submitted a pull request for Anaconda, the installer used by Fedora and other distributions. Its description said the patch fixed a bug that would make installation fail, but the change actually preserved a kernel option passed on the command line that appeared to have nothing to do with the reported problem. Williamson said the agent replied to objections with LLM-generated justifications that "eventually overwhelmed the maintainer into merging the fix".

Martin Kolman of the Anaconda team confirmed that the LLM-generated changes had made it into the Anaconda 45.5 release on May 26 and were reverted in Anaconda 45.6 on June 2. He called the events "really problematic", even if they were not malicious.

Suspended accounts and a disputed explanation

The agent's GitHub account has since been disabled and now shows up as "ghost". That same day, Giovannini told Williamson privately that his credentials had been compromised and that he was not behind the AI system. A reply ostensibly from him claimed access had been restored, but Williamson noted the GitHub account it named was only an hour old. Kevin Fenzi removed the nathan95 user from all of its groups, stripping the ability to reassign or close bugs.

Williamson also flagged a second account, "leurus27-boop", as likely belonging to the same agent. It remained active and had submitted pull requests to openSUSE Commander, a CLI for the Open Build Service, and to lxqt-policykit, a component used to extend privileges for LXQt's administration tools. He also found unjustified severity and priority changes in this year's Bugzilla activity starting on April 7.

An XZ-shaped warning

The pattern worried maintainers because of what the agent chose to touch: an operating-system installer, a utility for escalating user privileges and a tool for interacting with a build system. Kolman compared the sequence to the XZ backdoor, where a new contributor slowly gains trust before malicious code is injected, warning that an automated attempt at a similar compromise could look much like what had just happened. Williamson's recommendation was narrower: make the agent "substantially less autonomous" — no bug assignments, no state changes and no confident assertions or action recommendations without human review.