Background: Bambu Lab's Rise on Open-Source Foundations
Bambu Lab was founded in 2020 in Shenzhen by a team drawn entirely from DJI, with CEO Tao Ye formerly heading DJI's consumer drone division. The company has become the dominant force in consumer 3D printing:
- 2022: X1 series Kickstarter campaign raises over $7 million
- 2024: A1 mini launched at $299, reshaping the consumer market
- 2025: Revenue exceeds 10 billion RMB; overseas revenue above 70%
- 2025 Hurun China 500 valuation: $40 billion, the only 3D printing company on the list
- Slic3r (AGPLv3): Original slicer by Alessandro Ranellucci
- PrusaSlicer (AGPLv3): Prusa Research fork, industry standard
- Bambu Studio (AGPLv3): Bambu's fork with cloud integration and printer control
- OrcaSlicer (AGPLv3): Community fork by SoftFever (2022) with additional features
- No decompilation of any file
- No encryption cracking
- No distribution of closed-source components
- All work based on Bambu's own publicly available AGPLv3 code
- Derivative works must also be released under AGPLv3
- Critically: software running as a network service must also provide complete source code to interacting users
- May and October 2025: Two demand letters requesting removal of infringing content
- Late February 2026: Lawsuit filed in Shanghai Pudong New Area Court
- March 16, 2026: Settlement reached; LABUBU and related character models fully removed
- GamersNexus published "Get fucked, Bambu" and cancelled a $150,000 hardware purchase
- Louis Rossmann (FULU Foundation founder) pledged $10,000 as legal fund and mirrored Jarczak's repo to FULU Foundation's GitHub
- Jeff Geerling published "Bambu Lab 3D printers: never again," hitting Hacker News #1
- Software Freedom Conservancy (SFC) on May 18 confirmed two AGPLv3 violations and launched baltobu with three sub-projects:
reverse-networking: reverse-engineer libbambu_networking.so/.dll/.dyliborca-slicer-for-bambu: maintain Jarczak's forkviscose: maintain an alternative Bambu Studio fork- SFC launched a $250,007 fundraising campaign; over $60,000 had been raised at the time of reporting
- Jarczak original repo: https://github.com/jarczakpawel/OrcaSlicer-bambulab
- FULU Foundation mirror: https://github.com/FULU-Foundation/OrcaSlicer-bambulab
- Bambu official BambuStudio: https://github.com/bambulab/BambuStudio
- OrcaSlicer official: https://github.com/SoftFever/OrcaSlicer
- SFC baltobu announcement: https://sfconservancy.org/news/2026/may/18/bambu-studio-3d-printer-agpl-violation-response/
- Josef Prusa X post: https://x.com/josefprusa/status/1923026183472071119
- Jarczak technical audit: https://github.com/jarczakpawel/OrcaSlicer-bambulab/issues/1
The X1 Carbon at $1,199 matched the precision and speed of industrial machines previously priced above $10,000; the competing Prusa XL was nearly $2,000 with limited capacity. Bambu's strategy is "hardware-as-acquisition, ecosystem-as-profit": printers are the entry point, while cloud services, the Membership program, proprietary filament, and the MakerWorld model community drive recurring revenue.
The foundation of this ecosystem, however, rests on decades of unpaid open-source work.
The Open-Source Lineage
AGPLv3 is among the strictest copyleft licenses. Josef Prusa summarized the social contract: "You take from the community, you give back to the community." Bambu took that license; once its commercial empire was established, it turned legal force on users seeking to reclaim control of their own machines.
January 2025: The First Lock
A firmware update introduced a new authentication system that routed LAN print requests through Bambu Connect, a closed-source middleware. Officially, Bambu cited 30 million daily unauthorized access attempts as the security justification. The maker community was skeptical: LAN printing had long been a basic capability, and many users refuse to upload design files to vendor servers.
A telling detail: Bambu's entire product line depended heavily on cloud connectivity for remote monitoring and AMS (Automatic Material System) consumable tracking. Offline USB file transfer was not added until March 2025; before that, X1, P1, and A1 models supported only microSD cards.
After the update, OrcaSlicer users could view printer and AMS parameters but not modify them. Adjusting print speed, nozzle temperature, or switching AMS filament colors required manual operation on the printer body.
April 2026: The Cease-and-Desist
Polish developer Pawel Jarczak, a former active contributor to Bambu Studio, created OrcaSlicer-bambulab, restoring full BambuNetwork protocol support. His technical approach was unusually clean:
He discovered that while Windows and macOS network communication paths had been restricted, the Linux version's code paths left related network interfaces open. He used these public code paths to route requests through Bambu's cloud verification, restoring the weakened remote cloud-printing function.
In late April 2026, Bambu Lab's law firm issued a cease-and-desist alleging:
1. Reverse engineering of Bambu's own software to imitate Bambu Studio 2. Identity spoofing through forged metadata in server communication 3. Circumvention of authorization controls 4. Terms of service violation, potentially including DMCA anti-circumvention provisions
Jarczak took the project down voluntarily but issued a point-by-point rebuttal:
> "I did not decompile any files, did not crack any encryption, and did not distribute any closed-source components. All work is based on the AGPL code Bambu has itself made public."
> "If using a vendor's own public source code to implement functionality can be called 'identity forgery,' what meaning does an open-source license still have?"
The legal contradiction is sharp: Bambu Studio is published under AGPL-3.0, and forking and modifying it is precisely the right the license grants.
AGPLv3: A Delayed Legal Detonation
AGPLv3 (Affero General Public License, version 3) carries the most contagious copyleft provisions:
The violation point: Bambu Studio's network plugin (bambu_networking) is a closed black box, dynamically downloaded via CDN. This plugin enables printers to relay device data and connect to Bambu's official cloud servers, and is a core functional component of Bambu Studio, yet its code is entirely unauditable.
Josef Prusa's May 17, 2026 statement drew the line clearly:
> "Bambu Studio cannot do its primary job without the plugin. The plugin cannot do anything without Bambu Studio. They are not two products that happen to talk to each other, they are one product split across two files for PR license-laundering convenience."
> "Under AGPL, that's still a violation."
Jarczak's technical audit went further, showing Bambu Studio was specifically designed to load and use this closed runtime component through a strict ABI. Under AGPLv3's definition, such components in close data communication or control flow with the program fall within the scope of "Corresponding Source." Distributing Bambu Studio under AGPL together with closed bambu_networking without providing complete Corresponding Source under AGPL-compatible terms violates the license.
The Pop Mart Labubu Case: Catalyst for Lockdown
In 2025, MakerWorld saw an explosion of user-uploaded LABUBU character 3D models. Pop Mart's response was legal:
At first glance this looks like a parallel issue (IP infringement vs. open-source licensing), but the underlying logic is the same: platform content uncontrollability. UGC on MakerWorld carries legal risk that pure hardware sales do not. Rather than整改 platform review mechanisms, Bambu accelerated control across the entire stack: content layer (MakerWorld), software layer (Bambu Studio/Connect), and firmware layer (printer authentication).
The result is a negative feedback loop:
> Platform content risk → accelerated ecosystem closure → third-party tools restricted → community resistance → more legal conflict → more defensive closure
Prusa's Three Accusations
On May 17, 2026, Josef Prusa published a public statement via Tom's Hardware:
Accusation 1: License Violation
Bambu Studio, forked from PrusaSlicer (AGPLv3), ships with a closed, unauditable networking black box whose code can be remotely swapped. Software Freedom Conservancy confirmed two violations: years of distributing closed networking library without source code, and the legal threat against Jarczak itself violating AGPLv3 §10¶3 ("no further restrictions on rights granted by the license").Severity: 5/5. This is a foundational violation with clear legal text and code evidence. SFC involvement elevates the matter from community dispute to organized legal action.
Accusation 2: Geopolitical and Data Security Risk
An opaque closed-source network plugin means significant security risk. Slicer software routinely handles sensitive 3D design files from research labs, universities, and defense projects. What exactly is a non-auditable network black box doing in the background?Severity: 4/5. Prusa's motivation as a direct competitor requires independent evaluation, but the technical risk is real: a closed, remotely swappable communication component is a potential supply-chain attack vector.
Accusation 3: Remote Backdoor Potential
Prusa claimed 3D printers concentrate in places where new IP is created: R&D departments, prototype workshops, defense suppliers, university labs, hardware startups. The slicer software sits on the user's computer with the same data and access rights.Severity: 3/5. Speculative without concrete evidence, but the methodological argument is sound: in the security community, unauditable means untrustworthy.
Community Counterattack
On May 12, 2026 the situation exploded:
Bambu's Response
> "The AGPL, the DMCA, and Bambu Lab's terms do not permit reverse engineering that violates applicable protocols, rules, or circumvents technical protection measures protecting our cloud services."
> "We nonetheless regret that our reference to Terms of Service, legal context and a potential C&D understandably came across as a legal threat. That was not the outcome we wanted."
The response has three problems:
1. False premise — Jarczak performed no reverse engineering; he used Bambu's own public AGPL code 2. Logical contradiction — if not a legal threat, what was the cease-and-desist letter? 3. Core evasion — no mention of AGPLv3 compliance
Three Paths Forward
Path A: Compliance. Open-source the bambu_networking code. Accept AGPLv3 constraints and honor the community contract. Cost: cloud lock-in strategy fails, core business model disrupted.
Path B: Confrontation. Continue legal defense on the "network plugin is a separate product" argument. Cost: total collapse of global open-source community trust; GamersNexus-style boycotts translate into market share loss.
Path C: Technical Replacement (already underway). SFC's baltobu, Rossmann's FULU Foundation, and Jarczak's shift toward Klipper firmware together build a complete alternative stack that does not depend on Bambu's cloud. This is not protest; it is reconstruction.
Key Timeline
| Date | Event | |------|-------| | 2020 | Bambu Lab founded; founders from DJI | | 2022 | X1 Kickstarter raises $7M+; SoftFever releases OrcaSlicer | | 2024 | A1 mini at $299 reshapes consumer market | | Jan 2025 | Firmware update restricts LAN printing, introduces Bambu Connect | | Mar 2025 | USB offline transfer added | | May/Oct 2025 | Pop Mart sends two demand letters over LABUBU models | | Late Feb 2026 | Pop Mart files lawsuit; Jarczak's Linux code path still open | | Mar 16, 2026 | Bambu and Pop Mart settle; MakerWorld removes models | | Late Apr 2026 | Bambu law firm issues cease-and-desist to Jarczak | | May 12, 2026 | GamersNexus publishes "Get fucked, Bambu"; Rossmann mirrors repo | | May 17, 2026 | Josef Prusa publishes three accusations via Tom's Hardware | | May 18, 2026 | SFC confirms two AGPLv3 violations, launches baltobu |