FOSS maintainer audits 102 F-Droid apps for signs of LLM-written code

A single update batch, checked by hand

A developer who maintains free and open-source Android apps has published an informal audit asking a blunt question: how much of F-Droid, the main community repository for FOSS Android software, is written by large language models? The post, published on tintotint.eu and surfaced on Hacker News's front page, was prompted by casual browsing. While scrolling the catalog, the author spotted an app with what they describe as an obviously machine-generated icon, and started wondering how common that is.

To get an answer, the author examined every app in the update batch F-Droid pushed on September 12, 2026, which came to 102 projects, and rated each for signs of LLM authorship.

A three-tier rubric, not a detector

The author is upfront that reliable detection is impossible: in their view, code and prose simply do not carry enough metadata to judge authorship accurately. Instead, the audit uses a loose rubric based on the overall look of each repository:

• Mostly AI: the expectation that more than half the code is LLM-authored. Any presence of agentic infrastructure, such as Claude Code or Codex set up to work on the repo, automatically puts an app in this tier, because the author does not believe AI can be used responsibly from inside a coding harness.
• Hard to say / Mostly human / other: occasional LLM commits from maintainers or contributors, but the project mostly reads as human work, possibly under a policy permitting limited AI use.
• No signs of AI: nothing suspicious found, or the project enforces a strict AI policy.

Judgments came from reading recent commits and checking project branding, not from any detection tool. The author concedes the ratings are superficial, that mistakes are likely, and that project history is deliberately ignored: an app that has existed since 2014 still lands in the top tier if its recent commits look machine-written.

The tells the audit relies on follow from a broader theory of how these projects are run. The appeal of LLMs is letting the developer do less, the author argues, and that attitude shows up everywhere: a generated README instead of a hand-written one, an LLM reviewing its own changes, an agent with repository access so nobody has to press the commit button. A project that cared about appearing legitimate could produce those artifacts manually, the author notes, but in practice the corners stay cut.

What the ratings show

The published list spreads across all three tiers. Flagged as mostly AI: Amber, a Nostr event signer for Android, where all recent commits were done with an LLM, pull requests from agents were accepted, and Claude Code and Codex infrastructure is present; BayesianBahn, which computes empirical arrival-time distributions for Deutsche Bahn trains, with every commit co-authored by Claude; Balance, an offline bank balance dashboard, and Baly Groceries Tracker, both cited for general telltale patterns in code and commits; and Bati: Fitness RPG, which discloses its AI use in the README, a gesture the auditor thanked it for making easy.

Rated clean: Aves Libre, a gallery and metadata explorer, and Binary Eye, a QR and barcode scanner, both with nothing suspicious; Atmo Engine, whose emoji-heavy README raised an eyebrow but nothing else; and Aria for Misskey, where commit naming and structure felt borderline but received the benefit of the doubt.

The author's stated position

The author discloses their stance before the findings. LLMs are genuinely capable, the post acknowledges, pointing to people one-shotting medium-scale games and software in half an hour and to AI finding and sometimes fixing code issues in Linux kernel development. At the same time, the author writes that they dislike what the technology has done to programming and to learning itself: side projects feel less rewarding when a model could produce them faster, human skills atrophy, plausibly delivered misinformation spreads, and environmental costs are largely ignored.

Why it matters

F-Droid's value proposition is human stewardship of free software, and this audit suggests that assumption now has to be checked app by app. Two consequences stand out. First, curation: with no reliable detector, quality control in FOSS repositories rests on heuristics such as commit patterns, co-author trailers and README disclosures, plus volunteers willing to read a hundred repositories by hand; Bati's disclosure shows the cheapest workable alternative to detection is honesty. Second, discovery: the browsing experience that motivated the audit degrades if a meaningful share of catalog entries are afternoon projects that look maintained but were largely generated, leaving users and fellow maintainers unable to tell the difference.