In March 2026 a site called malus.sh started making the rounds. The pitch is "Clean Room as a Service": proprietary AI robots read only the public documentation of any open source project, a second set of robots that never saw the original recreates it from scratch, and you receive functionally equivalent code under the MalusCorp-0 license. Zero attribution requirements. Zero copyleft. Zero obligations. The tagline says it plainly: "Finally, liberation from open source license obligations."
It reads like a parody of every SaaS landing page you've ever scrolled past, complete with redacted testimonials and full legal indemnification, asterisk, "through our offshore subsidiary in a jurisdiction that doesn't recognize software copyright." The name is Latin for bad. It grew out of a FOSDEM 2026 talk in Brussels titled "Let's end open source together with this one simple trick," which GIGAZINE traced when the story broke. This is satire, and nobody involved is hiding that.
The problem is that it also works. 404 Media reported that Malus is a real LLC, taking real money, producing real clean-room clones. Futurism talked to co-founder Mike Nolan, a researcher on the political economy of open source, who pushed back on anyone dismissing it as just a joke. Simon Willison called it brutal satire and admitted he had to check whether it was satire at all. The Hacker News threads landed on the same nervous note: I almost went crazy until I realized it was satire, followed by, in six months it might not be so far from reality. Open source licensing attorney Heather Meeker was asking within days whether copyleft is dead.
The clean room used to be expensive, and that was the point
Clean-room engineering is old and legitimate. It's how Compaq and others cloned the IBM PC BIOS in the 1980s: one team studies the original and writes a specification, a second team that has never seen the original implements from the spec. Courts have blessed the technique because copyright protects expression, not function. Ideas, interfaces, and behavior are free to reimplement; the particular code that expresses them is not.
What kept the clean room from swallowing the software industry was cost. You needed two teams, lawyers supervising the wall between them, and months of work. It was reserved for prizes worth the trouble, like a BIOS that unlocked an entire compatible-PC market. Nobody was going to clean-room a logging library.
AI collapses that cost to nearly nothing. One agent reads the docs and writes the spec, another agent implements it, and the wall between them is a system prompt. The chardet maintainer Dan Blanchard watched an AI rewrite of his own Python library spark exactly this debate, and his reaction to Malus was resignation: someone will build this for real eventually, and there's no putting the genie back in the bottle. What was a rare, expensive legal safeguard is now a vending machine.
So, let the fraudsters begin
That's the invitation the site is satirizing, and it deserves to be said out loud. If a clean-room clone from documentation is legal, and the marginal cost is a few API calls, then every obligation that open source licensing imposes becomes optional for anyone willing to launder. Don't want to reproduce the Apache NOTICE file? Launder it. AGPL making your SaaS lawyers nervous? Launder it. The maintainers, as the Malus copy sneers, worked for free, so why should they get credit?
The uncomfortable truth is that the fraud here mostly isn't fraud in the legal sense. Reimplementing published functionality without copying expression has been lawful for forty years. The satire lands because the scheme is plausible, and the FOSDEM crowd built it precisely to force the question: if the only thing protecting the open source social contract was that violating it used to be expensive, what happens when it's a penny transaction? Their own in-character blog post says it with a straight face: "The social contract was already broken; we are merely providing a commercial alternative to pretending it wasn't."
What the pitch conveniently forgets
This is where the story connects to the rest of this series: the overview, the Supreme Court's cert denial, and the monkey selfie. Malus promises "legally distinct code that you own outright." Read that promise next to settled U.S. law and it falls apart.
The whole sales pitch is 100% robot-written code. Zero human exposure to the original is the feature. But under Thaler v. Perlmutter, which the Supreme Court left standing on March 2, 2026, a work generated entirely by AI has no human author, and with no human author there is no copyright. The clone doesn't arrive as your proprietary asset. It arrives as nobody's asset. The MalusCorp-0 license grants you nothing for the same reason a license on the monkey selfie grants you nothing: there is no copyright behind it to grant.
The license-washing machine doesn't transfer ownership to you. It launders the code straight into the public domain.
Notice the symmetry. The original maintainers lose their attribution and their copyleft leverage. The buyer, who paid specifically to own the result, receives code they cannot copyright and cannot meaningfully license. Try representing it as proprietary IP in a funding round or an acquisition, and that claim gets tested against the vendor's own marketing, which proudly states that no human wrote it. Everyone's exclusivity is destroyed. The fraudsters, if we're calling them that, aren't stealing ownership. They're eliminating it, and charging a fee to do it.
What to actually do
If you maintain open source: your license was never the only thing protecting your project, and this is the year that becomes visible. Attribution norms, community, funding, and trademark are the parts a clean room can't clone. A robot can reimplement your code; it can't reimplement your judgment about what to build next, and it can't launder your name.
If you're tempted by the buying side: know what you're actually purchasing. A functionally equivalent clone with no license obligations is also a clone with no owner, no warranty of title you can rely on, and a paper trail that says so. If the goal was avoiding an attribution file, you will have traded a NOTICE file for an unownable codebase. That's a bad trade, and your diligence counsel will say so less politely.
And for everyone building with AI, the advice from this series hasn't moved: keep a human doing the expressive work on anything you intend to own, keep the record of who did what, and treat purely AI-generated code as the public-domain material it is. If you want to know where you stand today, start with the risk assessment at https://whoownsthecode.com or the FAQ.
Malus set out to end open source with one simple trick. What it actually demonstrated is the thesis of this whole series: when nobody human writes the code, nobody owns the code. Let the fraudsters begin. At the end of the laundering cycle they'll find code that belongs to everyone. That's where open source started.
This post is provided for educational purposes and does not constitute legal advice. Talk to a qualified IP attorney about your specific situation.