The U.S. Ninth Circuit Court of Appeals has issued the first major appellate ruling on how AI coding tools interact with open-source copyright law — and it landed on the side of GitHub, Microsoft, and OpenAI.
In Doe v. GitHub, Inc. (No. 24-7700, decided September 16, 2026), anonymous open-source programmers alleged that GitHub Copilot and OpenAI Codex violated the Digital Millennium Copyright Act by reproducing their code without including author names, copyright notices, or license terms. The court disagreed, drawing a critical distinction: generating new code that happens to lack copyright management information is not the same as "removing" or "altering" that information from existing works.
"One who creates a new work and fails to include CMI cannot be said to have 'removed' or 'altered' anything," Judge Eric Miller wrote for the court.
The ruling turns on the mechanics of how AI code generation works. The court noted that Copilot and Codex learn statistical patterns from training data and use a probabilistic process to generate code — they do not retrieve and display stored material the way a search engine would. That distinction matters: a tool operating more like a search engine could face a stronger case for DMCA liability.
But the decision is narrower than it might appear. The court explicitly declined to rule on whether copying open-source code for AI training constitutes copyright infringement or qualifies as fair use. It also did not determine whether generated output that substantially reproduces protected source code infringes copyright through traditional means. The case's training-stage claims — that defendants removed copyright information before using code as training data — were forfeited because the plaintiffs failed to properly assert them in district court.
For open-source developers, the practical takeaway is sobering but not catastrophic. The Ninth Circuit has closed one legal pathway (DMCA metadata-removal claims against AI-generated output), but traditional copyright claims remain viable when AI output substantially reproduces protected work. As Karen Sadler of the Software Freedom Conservancy noted, "It's very easy to overread this decision" — it addresses a narrow DMCA question, not the broader legitimacy of AI training on open-source code.
The ruling also introduced an important nuance about cosmetic changes: minor modifications do not necessarily defeat a DMCA claim if a defendant substantially reproduces a protected work and strips its copyright information. This means AI tools that produce near-copies of original code could still face liability — the output just needs to be traced back to an existing work rather than generated fresh.
For AI companies, the ruling reduces litigation risk on the output side but leaves significant legal exposure on the training side. As the Open Source Initiative's executive director Duane O'Brien emphasized, "Nearly every open source license is unambiguous about the obligation to keep the copyright notice and attribution intact. Anyone who builds on that work should honor those terms."
The broader open-source licensing question — whether AI companies must preserve license obligations when their tools generate code derived from GPL, MIT, or Apache-licensed sources — remains unresolved and will likely be the next frontier in AI copyright litigation.
