Bambu Lab makes the best, most accessible 3D printers yet, but that reputation is suddenly under siege. It all started when Pawe\u0142 Jarczak received a private message from the company on Reddit asking him to delete his code. Now the 3D printing community is lining up behind Jarczak to fund a war against Bambu \u2014 and the future of 3D printers could be at stake.<\/p>\n<\/div>\n
Jarczak is a developer who shared a way to let people remote control their Bambu printers without using Bambu software. But Bambu wanted to lock down its system, despite relying on open-source code. That provoked a furious coalition of open-source advocates and YouTubers to respond.<\/p>\n<\/div>\n
\u201cI\u2019ll put up $10,000 to teach bambu labs a lesson<\/a>,\u201d declared consumer rights advocate Louis Rossmann, pledging to help defend Jarczak in court.<\/p>\n<\/div>\n \u201cI\u2019m never buying a Bambu Lab 3D printer again<\/a>,\u201d stated maker Jeff Geerling, adding that he\u2019d gladly chip in too. (He\u2019s changed the YouTube title since.)<\/p>\n<\/div>\n \u201cGo fuck yourself, Bambu<\/a>,\u201d wrote GamersNexus<\/em>, pledging to commit $10,000 as well. (It\u2019s also halting previously unannounced plans to buy $150,000 of Bambu hardware for a 3D printing project, editor-in-chief Steve Burke tells The Verge<\/em>.)<\/p>\n<\/div>\n If that wasn\u2019t enough, Rossmann, Burke, and thousands of other open-source advocates are daring Bambu to take legal action \u2014 they\u2019re each forking the code Bambu was hoping to suppress. As of Monday, so is the Software Freedom Conservancy<\/a>, which is now hosting an entire project<\/a> to reverse engineer Bambu\u2019s code and says it will serve as a Bambu watchdog.<\/p>\n<\/div>\n \u201cThey\u2019re bad actors, straight-up, and the community should do whatever we can,\u201d Bradley K\u00fchn, father of the AGPL open-source license and policy fellow at the Software Freedom Conservancy, tells The Verge<\/em>.<\/p>\n<\/div>\n But why is everyone so mad that Bambu\u2019s printers don\u2019t work perfectly with third-party apps? Are Bambu\u2019s actions really that egregious, or is it just trying to protect its ecosystem? I spoke to Bambu, Jarczak, lawyers, and others to understand. Both Bambu and Jarczak shared copies of their private communications for this story with The Verge<\/em>, each eager to set the record straight on what actually happened.<\/p>\n<\/div>\n This is the story of how everything went wrong, and how it could become right again.<\/p>\n<\/div>\n On April 22nd, when Bambu first reached out to Jarczak in a Reddit private message, its tone seemed polite. Bambu suggested it was warning Jarczak of upcoming changes that could prevent his code from working. The first DM concludes: \u201cwe kindly ask you to consider removing the current connection approach, as it mimics official Bambu Lab software.\u201d<\/p>\n<\/div>\n Jarczak replied that he was ready to remove his entire project from GitHub and thanked the company for noticing his work. But he wanted to be \u201cproperly acknowledged\u201d for possibly revealing \u201ca significant security gap.\u201d He offered further help for a fix while requesting some gear \u2014 specifically the flagship H2D printer<\/a>.<\/p>\n<\/div>\n But Bambu was not ready to reward or recognize him for promoting ways to use unauthorized third-party software and hardware that competes with its own. (Jarczak\u2019s previous project was supporting a cheaper way to print in multiple colors than buying Bambu\u2019s $279 AMS Lite, a project he\u2019s since suggested Bambu should also recognize him for.)<\/p>\n<\/div>\n Ominously, Bambu started talking to Jarczak like a mobster: \u201cWe wanted to speak with you first and handle this in a constructive way. That said, we can\u2019t allow this approach to continue.\u201d<\/p>\n<\/div>\n Jarczak bristled. He had publicly voiced some suspicion<\/a> that what he\u2019d done had crossed a line. But he also knew that Bambu\u2019s code was open-source under AGPL, a license so permissive that Google famously banned its engineers<\/a> from using it at all.<\/p>\n<\/div>\n The developer wanted to know: What, specifically<\/em>, had he done wrong if the code was open-source?<\/p>\n<\/div>\n Above: The actual communications between Bambu and Pawe\u0142 Jarczak.<\/sub><\/em><\/p>\n<\/div>\n Instead of explaining, Bambu ramped up its threat. It told Jarczak that a cease and desist letter had already been prepared, and \u201cinvited\u201d him to look at section 1201 of the Digital Millennium Copyright Act, implying it could legally punish him for breaking digital locks.<\/p>\n<\/div>\n But Bambu didn\u2019t sue. It didn\u2019t send a cease and desist letter. It didn\u2019t even send a DMCA takedown to remove his files from GitHub. Jarczak voluntarily took his code down. But in that code\u2019s place, Jarczak left a note<\/a> suggesting that Bambu treated him like a criminal.<\/p>\n<\/div>\n That\u2019s when the internet pounced.<\/p>\n<\/div>\n Why is the open-source 3D printing community so upset?<\/strong><\/p>\n<\/div>\n Because Bambu\u2019s software is not just Bambu\u2019s software. \u201cBambu Studio is based on PrusaSlicer by Prusa Research, which is from Slic3r by Alessandro Ranellucci and the RepRap community,\u201d Bambu freely admits on its websites.<\/p>\n<\/div>\n \u201cBased on\u201d doesn\u2019t just mean Bambu took inspiration from those programs. Bambu Studio is similar to PrusaSlicer because it\u2019s a fork <\/em>of PrusaSlicer. It\u2019s built atop the same code.<\/p>\n<\/div>\n Every modern 3D printer uses a piece of software called a slicer, which \u201cslices\u201d 3D objects into layers, then turns those layers into instructions that a 3D printer can follow. Over time, they\u2019ve become the way to remote control every other part of a 3D printer as well.<\/p>\n<\/div>\n Almost every slicer is built atop the slicers that came before, going back nearly 15 years to when Alessandro Ranellucci first released Slic3r to the world under the AGPL license. That license guarantees no one has to reinvent the wheel so long as they contribute their own improvements. Bambu gets enormous value from this license, but it\u2019s beginning to crack down on users enjoying the same benefits<\/a>.<\/p>\n<\/div>\n Bambu freely forked PrusaSlicer, and it doesn\u2019t contest that anyone else can fork Bambu Studio as well. But Bambu cut off the ability for forks \u2014 including the most popular fork, OrcaSlicer \u2014 to send prints, remote control the print head, monitor the printer\u2019s camera, change filament colors, and more, until or unless their developers integrated a new proprietary authentication mechanism. (The lead developer of OrcaSlicer declined<\/a>.)<\/p>\n<\/div>\n Jarczak had created his own fork of OrcaSlicer to work around Bambu\u2019s proprietary requirement, and that\u2019s the code Bambu wanted taken down.<\/p>\n<\/div>\n Last January<\/a>, Bambu said its motive was security. But many suspected a profit motive too: that Bambu might use its software to lock its printers to its own filament and accessories and start charging for subscription services, the way<\/a> today\u2019s inkjet printer companies do. Bambu did not deny those possibilities<\/a> when we asked, and the open-source community has been preparing to fight possible enshittification<\/a> ever since.<\/p>\n<\/div>\n All Jarczak was originally trying to do was keep Bambu\u2019s software from breaking compatibility with the Biqu BCMU third-party multicolor system<\/a> (that undercuts Bambu\u2019s own $279 accessory), after some users noticed the BCMU stopped working following a Bambu firmware update.<\/p>\n<\/div>\n But when he built a copy of OrcaSlicer using code from the Linux<\/em> version of Bambu Studio instead of the Windows or Mac versions, Bambu\u2019s cloud services no longer stopped him from remote controlling his own printer at all<\/em>. He\u2019d inadvertently found a way to pick Bambu\u2019s lock using Bambu\u2019s own open-source code. When Bambu threatened him into submission for undoing its lock, he became an unwitting martyr for a bigger cause.<\/p>\n<\/div>\n \u201cPeople are trying to make me into some kind of hero here, but I am not that,\u201d Jarczak tells The Verge. <\/em><\/p>\n<\/div>\n Here\u2019s where it gets really messy. <\/strong><\/p>\n<\/div>\n A lot of this will come down to how the open-source license used by Bambu is interpreted both by the public and potentially by courts. Bradley K\u00fchn, who helped put the \u201cA\u201d into AGPL<\/a>, says it\u2019s a slam dunk: Bambu has violated its AGPL license.<\/p>\n<\/div>\n In a blog post<\/a> for the Software Freedom Conservancy, he identifies two specific violations. First, Bambu\u2019s proprietary networking plug-in itself.<\/p>\n<\/div>\n The actual text of the AGPL states that anyone who copies a program must license the source code for the entire program \u2014 including any \u201cCorresponding Source\u201d for other bits that are needed to generate, install, run, or modify the work.<\/p>\n<\/div>\n It also has explicit examples of what should count as Corresponding Source, including \u201cshared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.\u201d<\/p>\n<\/div>\n Guess what Bambu\u2019s proprietary networking plug-in is made of? Shared libraries and dynamically linked libraries, ones that Bambu\u2019s open-source portions automatically try to install when you first run the application, and ones that \u2014 K\u00fchn and Jarczak both say \u2014 have intimate communication with Bambu\u2019s open-source code.<\/p>\n<\/div>\n Jarczak has now published a 30-point analysis at his GitHub page<\/a> that runs down just how intimate that communication could be:<\/p>\n<\/div>\n The second violation, K\u00fchn writes, is how Bambu allegedly pressured Jarczak to remove his code from GitHub while falsely claiming its terms of service trump his rights under the AGPL license.<\/p>\n<\/div>\n But neither K\u00fchn nor Jarczak is a lawyer. Bambu has lawyers, and two lawyers who specialize in open-source tech tell The Verge<\/em> that the AGPL is difficult to rely on.<\/p>\n<\/div>\n What do Bambu and the lawyers say?<\/strong><\/strong><\/p>\n<\/div>\n Bambu answered almost every question we sent over the course of a full week. Head of PR Nadia Yaakoubi told us that the company isn\u2019t concerned about \u201copen-source development or legitimate code forks.\u201d (Bambu is implying Jarczak\u2019s fork is illegitimate.)<\/p>\n<\/div>\n The company argues that some of its code is \u201cseparately delivered\u201d and therefore isn\u2019t covered by the AGPLv3 license where \u201cCorresponding Sources\u201d are concerned. Here\u2019s what it told us:<\/p>\n<\/div>\n We do not agree that the networking plugin is properly characterized as part of Bambu Studio\u2019s \u201cCorresponding Source\u201d for purposes of AGPLv3, such that AGPLv3 source-availability obligations would be triggered. It is a separately delivered, optional networking component that provides additional functionality. The fact that software may load a separate component at runtime does not establish that the component is part of the covered work or that it is source code; the work is \u201cspecifically designed to require\u201d under Section 1, which defines the scope of \u201cCorresponding Source.\u201d And as you mentioned, AGPL also does not authorize any access violating the rules and protocols for communication across the network.<\/p>\n<\/blockquote>\n<\/div>\n Kyle Mitchell, an independent tech lawyer who\u2019s studied the AGPL<\/a>, tells The Verge <\/em>it\u2019s quite possible that Bambu doesn\u2019t<\/em> need to share everything that touches its open-source code, particularly when we\u2019re talking about cloud services.<\/p>\n<\/div>\n \u201cThe AGPL, because of the problem it was written to solve, and because of the way it was written, doesn\u2019t clearly say that if you change a program that you share to work with a web or cloud service, that you have to share all of that web and cloud service alike too,\u201d he tells me over the phone.<\/p>\n<\/div>\n Even with a plug-in, there is some degree of technical separation, he says \u2014 though Heather Meeker<\/a>, a prominent open-source licensing expert and attorney, says a plug-in would at least \u201cgenerally be part of Corresponding Source.\u201d<\/p>\n<\/div>\n Mitchell says Bambu\u2019s statement to The Verge<\/em> \u201cgoes right at the uncertainty,\u201d the parts of the law that aren\u2019t automatically clear and would have to be clarified by the courts \u2014 and for better or worse, the courts have not meaningfully weighed in on the text of the AGPL. \u201cHow broad the source code sharing requirement goes \u2014 there\u2019s very little law to answer these questions,\u201d Meeker confirms.<\/p>\n<\/div>\n Says Mitchell: \u201cThere are no definitive answers to be found, just positions to take, which are just predictions about what courts would do.\u201d<\/p>\n<\/div>\n And \u2014 generally speaking \u2014 Meeker says not just anyone can meaningfully go after a company for an AGPL violation.<\/p>\n<\/div>\n The Software Freedom Conservancy is attempting to disprove that in court as we speak, helping a single smart TV buyer sue TV maker Vizio for breach of contract<\/a> to release its source code under GPLv2. But generally, Meeker says the entities that wrote the code are the ones who have the right to file a claim. Multiple licensors might have to band together, depending on how much code each contributed, and it could get complicated if some licensors additionally <\/em>sold their software under different licensing terms instead of just AGPL.<\/p>\n<\/div>\n K\u00fchn says he\u2019s \u201cvery confident\u201d that the Vizio suit will succeed, but admits it\u2019s the first such case he\u2019s aware of in the US. Vizio is scheduled to go to trial in August.<\/p>\n<\/div>\n Does Bambu have a point about security? <\/strong><\/p>\n<\/div>\n Bambu\u2019s printers are remote controlled with MQTT commands, and after some of the things<\/a> I\u2019ve seen hackers do<\/a> with unprotected MQTT recently<\/a>, I\u2019d have to say yes.<\/p>\n<\/div>\n And the AGPL license does let Bambu deny access to a network \u201cwhen the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network,\u201d K\u00fchn freely admits. Bambu says it\u2019s experienced<\/a> this kind of disruption, with millions of \u201cabnormal requests\u201d including DDoS attacks.<\/p>\n<\/div>\n But is it fair to suggest Jarczak is jeopardizing Bambu\u2019s security with his fork? As he, K\u00fchn, Mitchell, and others point out, Bambu has any number of ways to properly protect its cloud from hackers and DDoS attacks other than the one that can be defeated by using Bambu\u2019s own open-source code.<\/p>\n<\/div>\n Bambu claimed on May 7th<\/a> and continues to claim that Jarczak \u201cimpersonated\u201d its systems to fool them into giving him \u201cunauthorized\u201d access. It shared this as proof:<\/p>\n<\/div>\n But the level of \u201cimpersonation\u201d you see is simply Jarczak\u2019s copy of OrcaSlicer saying \u201cI am Bambu Studio,\u201d something you can also find in Bambu Studio\u2019s own open-source code<\/a>.<\/p>\n<\/div>\n \u201cIf Bambu\u2019s infrastructure treats that as dangerous, that is a server-side authorization and architecture problem, not proof that I attacked their infrastructure,\u201d Jarczak tells The Verge<\/em>. \u201cA cloud service should enforce authorization on the server side with proper account\/device authorization, token scopes, quotas, per-account limits, per-device limits, rate limiting, abuse detection, and clear API rules.\u201d<\/p>\n<\/div>\n In the May 7th blog, Bambu claimed there was nothing it can do about people using OrcaSlicer to \u201cimpersonate\u201d Bambu Studio: \u201cOur systems would have no way to distinguish traffic, because the requests would look identical.\u201d<\/p>\n<\/div>\n But in its initial communications with Jarczak, Bambu already told him it intended to close this hole, and he\u2019s not sure why it didn\u2019t just do so. \u201c[I]f they truly believed this was a live vulnerability, they should have fixed or disabled it on their side instead of threatening one developer and asking me to remove a repository while leaving the underlying behavior available,\u201d responds Jarczak.<\/p>\n<\/div>\n Bambu tells The Verge<\/em> that that it does indeed plan to close the hole, but it isn\u2019t saying when:<\/p>\n<\/div>\n \u201cWe have been working on enhanced authentication measures. The reason the current pathway still functions is simply that we have not yet pushed a mandatory update. Forcing a disruptive rollout to address one isolated issue is not how we operate. Our security updates will be deployed steadily, at the right time, and with our users\u2019 experience in mind,\u201d Yaakoubi writes.<\/p>\n<\/div>\n Bambu also told The Verge<\/em> that Jarczak \u201cran repeated unauthorized workaround tests on our live infrastructure and left activity logs.\u201d But if there\u2019s evidence, Bambu isn\u2019t sharing it with us.<\/p>\n<\/div>\n \u201cI did not attack their infrastructure. I did not do penetration testing. I did not scan their servers. I did not try to find hidden endpoints. I did not create a new printer command system. I did not introduce new printer-side command classes,\u201d Jarczak tells us. \u201cIf Bambu has logs, then those logs would simply show normal client traffic from testing a slicer against their normal cloud service path, using my own normal workflow.\u201d<\/p>\n<\/div>\n Bambu declined to share its logs with The Verge<\/em>.<\/p>\n<\/div>\n Legal threats are easy to make and costly to defend against. Nothing\u2019s been filed yet, so we remain in the court of public opinion. K\u00fchn says that court is the one that should hopefully pressure Bambu \u201cto act correctly,\u201d like when the community first successfully pushed Bambu to open-source its PrusaSlicer fork.<\/p>\n<\/div>\n In the meantime, thousands of open-source advocates are now in a standoff with Bambu, figuring out how to loosen its control over the hardware they bought and paid for and actively organizing alongside the father of AGPL. The Software Freedom Conservancy is hoping to raise just over $250,000 to hire more staff<\/a> to \u201cliberate AGPLv3-violating 3D printers,\u201d and Louis Rossmann says his group will donate $15,000<\/a>.<\/p>\n<\/div>\n \u201cOur intention from the start was to reach out and find a path forward together. We regret that our communication did not land that way. That was not the outcome we wanted, and we are committed to doing better on that front,\u201d Bambu tells The Verge<\/em>. While the company told us on May 13th that it would \u201chold a firm line on how our cloud service is accessed by third-parties,\u201d that firm line softened a day later: \u201cRather than escalating conflict, we are focusing on strengthening our own infrastructure and protection measures moving forward.\u201d<\/p>\n<\/div>\n If Bambu wants to defuse the situation, K\u00fchn says the solution is simple: \u201cThey should release all<\/em> the code, even if the AGP doesn\u2019t require it, because their business is selling hardware anyway!\u201d Alternatively, Bambu can always throw away all the AGPL code and rewrite its software from scratch. \u201cNobody requires you to use AGPL code,\u201d he says. Jarczak doesn\u2019t want to see Bambu take its ball and go home, though. \u201cI do not think \u2018fully closed\u2019 would be better for users. It would just be more honest,\u201d he tells me.<\/p>\n<\/div>\n It\u2019s hard not to root for open-source advocates to triumph, considering how much of a debt every 3D printer company owes to those who came before. I\u2019m not ready to switch printers myself, but I will if the open-source community\u2019s worst fears come true.<\/p>\n<\/div>\n![\"\u201cGo](\"https:\/\/platform.theverge.com\/wp-content\/uploads\/sites\/2\/2026\/05\/firefox_6cpAKPuw9X.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400\"\/)
<\/a><\/div>\n<\/div>\n<\/div>\nWhat is actually going on with Bambu and Pawe\u0142 Jarczak?<\/strong><\/h2>\n<\/p>\n<\/div>\n
![\"Jarczak\u2019s](\"https:\/\/platform.theverge.com\/wp-content\/uploads\/sites\/2\/2026\/05\/firefox_Y6YqqX1Bbu.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400\"\/)
<\/a><\/div>\n<\/div>\n<\/div>\n\n
![\"Jarczak\u2019s](\"https:\/\/platform.theverge.com\/wp-content\/uploads\/sites\/2\/2026\/05\/code.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400\"\/)
<\/a><\/div>\n<\/div>\n<\/div>\n\n