Maybe the policy should be: no AI PRs except from established contributors who have been vetted?

So basically you're saying you reject drive-by PRs.