One. That is how many unverified copyright notices it takes to pull a free, open source game off the world’s largest Android app store. Not one lawsuit, not one court order, not one human reviewer who read the claim and agreed with it. One notice, filed against Luanti, the voxel game engine formerly known as Minetest, and described by the people who maintain it as baseless and apparently produced with AI assistance.
I want to set aside the outrage for a moment, because the outrage is easy and the architecture question is harder. What happened here is a textbook agent failure, and it is the kind that will keep happening until we stop treating enforcement pipelines as forms and start treating them as agents.
An agent with an actuator and no world model
In agent design we usually talk about three things: perception, reasoning, and action. A copyright notice pipeline has all three. It perceives a claim as input. It reasons, in the loosest possible sense, by pattern-matching the claim against policy categories. And it acts, by delisting software from a store that reaches billions of devices.
That last part is the piece people underrate. An actuator is any mechanism through which a system changes the state of the world. Delisting an app is an actuator with an enormous blast radius. Every serious agent architecture I have worked on treats the strength of an actuator as the thing that determines how much verification you owe before firing it. A system that can only draft text can be sloppy. A system that can remove software from millions of phones cannot.
What appears to be missing in cases like this is not intelligence. It is grounding. A generated claim reads as fluent, well-formatted, legally shaped prose. Fluency is exactly the signal these pipelines are tuned to accept, and exactly the signal that generative models produce for free. The pipeline has no representation of whether the asserted work exists, whether the claimant owns it, or whether the accused code has any relationship to it. It has a document that looks like a valid claim, and that turns out to be sufficient.
The cost asymmetry is the whole story
Think of it as a ledger. Producing a plausible infringement notice used to require a lawyer, or at least a person with a template and an afternoon. It now requires a prompt. The cost of generating a claim has collapsed by orders of magnitude. The cost of adjudicating a claim has not moved at all, because adjudication still ends with a human reading documents and making a judgment call.
When the cost of input collapses and the cost of evaluation stays fixed, any system that processes inputs on a first-come basis gets overwhelmed. Platforms respond the way you would expect: they lower the evaluation cost by automating approval rather than automating scrutiny. Approval is cheap to automate because the default action, removal, feels conservative from the platform’s legal position. It is not conservative from the developer’s position. It is a shutdown.
This is a misaligned objective function, plainly stated. The system optimizes for the platform’s exposure, and treats damage to the accused party as an externality it does not measure. No amount of better language modeling fixes an objective that never counted the harm in the first place.
What grounding would actually require
If I were reviewing this pipeline as an agent design, I would ask for four properties before allowing any automated action:
- Evidence binding. A claim must reference a specific, retrievable artifact, and the system must fetch and compare it. A claim that cannot be tied to an inspectable work is not a claim, it is a sentence.
- Calibrated confidence with thresholds per action. Weak evidence gets a notice to the developer. Strong evidence gets escalation. Only overwhelming evidence should reach the actuator that removes software.
- Cheap reversibility. Recovery should cost the accused party roughly what the claim cost the accuser. Right now it costs vastly more, which is what makes the attack viable.
- Claimant reputation as state. Agents that never remember outcomes cannot improve. A filer whose notices are repeatedly overturned should face rising evidentiary burden. This is basic feedback, and its absence is telling.
Open source is the canary
Luanti is a useful test case precisely because it is a poor target. The code is public, the history is public, the license is permissive, and the project has no revenue to extract. Any check with real grounding would have failed the claim in seconds. That the removal happened anyway tells us the check was not shallow, it was largely absent.
Projects like this have no legal department and no account manager to call. They are the first to fall and the last to be heard, which makes them a reasonable early indicator of how these systems behave under adversarial load. The failure mode on display is not a model hallucinating. It is an institution accepting machine-generated assertions as evidence, and wiring that acceptance directly to a lever that breaks things.
🕒 Published: