Chardet's AI Clean-Room Rewrite Didn't Just Change a License. It Broke How Copyleft Gets Enforced.

What actually happened with chardet 7.0

Chardet is a small, unglamorous Python library that guesses the character encoding of a block of text. It has been maintained for close to two decades, ships as a dependency inside requests and pip, and is pulled roughly 130 million times a month. For most of that history it carried an LGPL licence, which meant anyone who modified chardet itself had to release those modifications under the same terms.

In early 2026, maintainer Dan Blanchard released chardet 7.0 under the MIT licence instead. His justification: he used Claude to produce what he called an AI clean-room rewrite of the library, then ran an automated similarity check comparing the new code against every prior chardet release. The reported result was a maximum similarity of under 1.3%.

Mark Pilgrim, associated with the library's original codebase, disputed the relicense on the grounds that Blanchard had direct, ongoing knowledge of the LGPL-licensed source and that exposure of that kind disqualifies any clean-room claim by definition. Flask creator Armin Ronacher publicly defended the relicense as a reasonable reading of what AI-assisted rewriting makes possible. Bruce Perens, a co-author of the Open Source Definition, went further, framing the dispute as evidence that the economics underneath open source licensing are shifting faster than the licences themselves.

The choice of licence is not a technicality here — it is the entire practical stake of the dispute. LGPL lets a company link against chardet freely, but any change to chardet's own code has to be released under the LGPL too, which is a real constraint on a business that wants to bundle a modified version into a closed product. MIT drops that constraint completely: once chardet ships under MIT, a company can fork it, modify it, and embed it in a proprietary product without releasing anything back. That is the specific freedom the relicense creates, and it is worth exactly as much as the number of downstream users who were previously choosing not to modify chardet only because of the LGPL.

Why an AI clean-room rewrite is not the same thing as a clean-room reimplementation

The clean-room technique has a specific history, and it predates AI by four decades. Compatible BIOS vendors in the 1980s used it to build IBM PC-compatible systems without infringing IBM's copyright: one team documented the original BIOS's external behaviour, and a second team with no access to that source code, and no knowledge of its internals, wrote new code purely from the specification. The entire value of the process was that it produced an audit trail proving independent creation — two teams, a hard wall between them, and a paper record of the separation.

What happened with chardet does not fit that shape. Blanchard was the maintainer of the LGPL-licensed original, with full and ongoing access to its source. He used an AI model to generate new code, then released it, but there was no second team working blind from a specification. That is closer to asking a highly capable collaborator to paraphrase code you already know well than to the process clean-room reimplementation was built to prove.

The number that matters, and why it does not settle anything

A 1.3% similarity score is doing most of the persuasive work in this dispute, and it is worth being precise about what that number actually measures. A diffing tool comparing two codebases token by token reports literal overlap: identical variable names, identical control-flow sequences, identical strings. It says nothing about "substantial similarity" as courts apply the term, which weighs structure, sequence, and organisation, and separates protectable expression from unprotectable functional elements. A rewrite can score close to zero on a line-level diff and still be found to copy the protected parts of the original; a rewrite can also score higher and be found non-infringing, because the overlap is in functional necessity rather than creative choice.

No court has directly ruled on this specific scenario: an AI-assisted rewrite of a copyleft-licensed project by its own maintainer, followed by a relicense. The closest active precedent is Doe v. GitHub, which reached the Ninth Circuit with oral arguments on 11 February 2026. That case tests whether DMCA Section 1202(b) liability, covering the removal of copyright management information, requires identical copies of the original code or whether substantial similarity is enough. It concerns Copilot's training on and output of third-party code, not a maintainer relicensing their own project, but the underlying question — does near-identical count as identical for the purposes that matter — echoes directly into the chardet dispute.

Copyleft was never really enforced by the licence text

Here is the part of this story that gets skipped in most of the coverage. Copyleft licences like the GPL and LGPL work by attaching an obligation to any modification: share your changes under the same terms, or do not distribute the modified work. In principle that obligation is a matter of contract and copyright law, enforceable in court. In practice, for the two decades chardet has existed, almost nobody tested that enforcement mechanism, because it was cheaper to comply than to rebuild.

Chardet earned its reliability the slow way: two decades of edge cases, obscure encodings, and bug reports from people hitting real-world text that broke earlier heuristics. Reproducing that from scratch used to cost real engineering time, likely more than the cost of just complying with the LGPL. Copyleft's deterrent effect leaned on that asymmetry as much as on the threat of a lawsuit.

Perens has said he built a comparable SRE platform in roughly five days using AI tooling. Whatever the precise number, the direction is not in dispute: when the cost of producing a functionally equivalent, differently expressed version of a well-documented library drops from months to days, the practical deterrent that made most developers simply honour a copyleft licence weakens, independent of how any court eventually rules on the legal question.

What this means for maintainers who actually rely on copyleft

If you maintain a project under GPL, LGPL, or AGPL specifically to force downstream sharing, chardet is a preview of your enforcement problem, not a one-off drama about a character-encoding library.

A Contributor License Agreement or Developer Certificate of Origin gives a project clearer standing over who is allowed to relicense it, which protects against a rogue maintainer or a disputed internal contribution. It does not protect against a separate party building a functionally equivalent replacement from your public documentation, tests, and observed behaviour using an AI model, then releasing that replacement under different terms. That is not a licence violation in the way courts have historically understood one — it is closer to independent creation, however uncomfortable that independence looks when it took five days and a chat window.

It is worth naming the pressure on the other side too. Roughly 60% of open source maintainers do unpaid work, by Tidelift's own survey figures, on projects that a Harvard Business School study values at $8.8 trillion in aggregate commercial reliance. A maintainer who has spent years on a widely used, thankless dependency has an obvious incentive to use AI tooling to remove licence friction for companies willing to pay for support or a commercial fork — the same asymmetry that made copyleft a useful lever for unpaid maintainers is now available to those maintainers too, just pointed in the other direction.

For a maintainer worried about a repeat of this on their own project, three things are worth doing this week, before any dispute exists: keep a dated record of who has contributed and under what terms; if the project matters enough to defend, move copyright assignment to a foundation or a CLA rather than leaving it with one person; and treat any future relicense, by anyone, as something that needs a public similarity and provenance audit before it ships, not after someone objects.

The guardrails available today, and their limits

None of the three approaches above closes the actual gap, because the gap is not a clause problem. It is that the practical cost of independently reproducing a well-specified library, the cost copyleft always leaned on, is no longer high enough to make compliance the obviously cheaper option.

What happens next

The Ninth Circuit's eventual ruling in Doe v. GitHub will narrow the legal uncertainty around AI output and existing licences, but only for the training-and-output scenario it actually covers. The maintainer-relicenses-their-own-project scenario chardet just walked through has no comparable case moving through the courts yet, and the industry's working definition of "clean room" will keep drifting until one does.

For engineers who simply depend on chardet and are deciding whether to pull in 7.0, the licence dispute is mostly irrelevant to that decision on its own — the practical question is whether the AI-generated rewrite matches the behaviour of two decades of accumulated edge-case fixes, which is a testing question, not a legal one. Pin the version, run your own encoding-detection test suite against both releases before upgrading, and treat the licence change as a separate decision from the code change, because right now the two are getting argued as one.

The next dispute like this will not be about a character-encoding library most developers have never heard of by name. It will be about whichever popular, well-tested utility a maintainer or a competitor decides is faster to rewrite with an AI model than to keep explaining to a mailing list.