Bambu Lab AGPL Violation — SFC Raises $275K for Legal Fight

The Software Freedom Conservancy has confirmed that Bambu Lab — the multi-billion-dollar consumer 3D printer manufacturer — has been violating the AGPLv3 license for years. In response, the non-profit launched a full-spectrum counteroffensive: a reverse-engineering project, a maintained fork of OrcaSlicer for Bambu printers, and a fundraiser that has blown past its $250,007 goal. Litigation counsel is being hired.

The Two Violations

On May 18, 2026, the Software Freedom Conservancy (SFC) published a comprehensive assessment of Bambu Lab's compliance with the GNU Affero General Public License version 3 (AGPLv3) — the strongest copyleft license in the open-source world. Their investigation, which covered both userspace software and device firmware, confirmed two distinct violations.

1. The Proprietary Networking Library

Bambu Studio — the company's official slicing software — is a modified version of PrusaSlicer, which is itself a derivative of Slic3r. Both predecessor projects are licensed under the AGPLv3. Under AGPLv3 §6, anyone distributing a covered work in object code form must also provide the complete Corresponding Source — including source code for shared libraries and dynamically linked subprograms "that the work is specifically designed to require."

Bambu Lab has never released source code for libbambu_networking.so (Linux), bambu_networking.dll (Windows), or libbambu_networking.dylib (macOS). This proprietary library handles all communication between the slicer and Bambu's cloud infrastructure. The SFC found that Bambu's own README on GitHub has, in effect, admitted this gap for over four years — the repository tells users the networking components are not provided and must be retrieved through an interactive UI prompt at runtime.

"This is not a gray area," SFC stated bluntly. "Bambu's failure to provide CCS and Installation Information for these libraries constitutes an egregious and ongoing violation of AGPLv3."

2. The Chilling-Effect Cease-and-Desist

The second violation arose from Bambu Lab's response to Paweł Jarczak, a Polish software developer and Bambu printer owner. After Bambu's January 2025 firmware update restricted third-party access to cloud printing features, Jarczak created a fork of OrcaSlicer — itself an AGPLv3-licensed slicer — that restored direct cloud communication with Bambu printers without touching the proprietary libbambu_networking library. His fork simply studied the incomplete but available Bambu Studio source code and replicated the network interface through intimate data communication with Bambu's server-side components.

Bambu Lab responded with cease-and-desist threats. In a May 7 blog post titled "Setting the Record Straight on Cloud Access and Community," the company accused the fork of "injecting falsified identity metadata" and "impersonating the official Bambu Studio client" — characterizations Jarczak publicly rejected, noting the fork used Bambu Studio's upstream AGPL-licensed code verbatim.

Under AGPLv3 §10¶3, licensees "may not impose any further restrictions on the exercise of the rights granted or affirmed under this License." The SFC concluded that Bambu's legal threats against Jarczak — who was exercising his rights under the license — constituted a separate violation. Jarczak removed the fork under protest. "Paweł did what all software developers are allowed to do under AGPLv3: change the source code to do something interesting," the SFC wrote. "Paweł did not deserve Bambu Lab's bad treatment."

The Baltobu Project: Reverse-Engineering as Remedy

Rather than pursue litigation alone — a process the SFC describes as a "last resort" — the organization launched a three-pronged technical response under the project name baltobu ("Bringing Affero Licensed Things (On)to Bambu Users"). Hosted on SFC's own Forgejo instance, baltobu contains three active repositories:

reverse-networking: A clean-room effort to reverse-engineer the proprietary libbambu_networking binaries and produce a drop-in open-source replacement. The SFC's legal position is unambiguous: because the binary object code was combined with AGPLv3-licensed software, it is itself governed by the AGPLv3. Anyone holding a copy has the right to examine and reverse-engineer it.
orca-slicer-for-bambu: A maintained fork of OrcaSlicer built on Jarczak's original work, explicitly designed for Bambu printer owners who want full functionality without routing every print through Bambu's cloud. The SFC provides some personal liability protection to volunteer contributors working on its behalf.
viscose: A fork of Bambu Studio itself. The immediate goal is to preserve a complete, auditable copy of everything Bambu publishes. The longer-term goal is a version of Bambu Studio that respects user freedom — incorporating the reverse-engineered networking replacement and stripping out the cloud-compulsion architecture.

The project has attracted substantial community involvement. Volunteers have joined from the SFC's "Use the Source" community, and additional complementary reverse-engineering work has appeared in independent repositories tracking the baltobu effort.

Josef Prusa Weighs In: The "Black Box" Warning

The controversy drew sharp commentary from Josef Průša, founder of Prusa Research and the original author of PrusaSlicer — the upstream ancestor of both Bambu Studio and OrcaSlicer. In a statement widely covered by Tom's Hardware, Průša warned that Bambu Lab's closed networking plugin represents an "un-auditable network black box" inside 3D printing software, one that poses "massive security risks" to users.

The concern is not hypothetical. Bambu Connect — the company's mandated cloud intermediary introduced with the January 2025 firmware update — routes every print file through Bambu's servers by default. For users who want local control, the options are increasingly narrow: lock the printer into Developer Mode on old firmware, block it from the internet at the firewall level, and use third-party slicers that dance around Bambu's proprietary networking layer. As Jeff Geerling, a prominent hardware reviewer, put it: "I had to do that to keep it under my control, instead of Bambu's."

Průša's intervention carries weight because of the irony embedded in the situation. Bambu Lab's entire software ecosystem depends on code originally licensed under the AGPLv3 by Prusa Research and, before that, by Alessandro Ranellucci's Slic3r project. The license terms that enabled Bambu Studio to exist are the same terms Bambu is now accused of violating.

The Fundraiser: Community Response Overwhelms Expectations

Alongside the baltobu project, the SFC launched a fundraiser on May 18 with an ambitious target of $250,007. The goal was explicit: if reached, the funds would go toward hiring dedicated staff — including, specifically, a litigation attorney — to lead the long-term effort on 3D printer software right-to-repair.

On July 16, 2026 — two days before the fundraiser's scheduled close — the SFC announced it had not only reached but exceeded its goal. As of July 27, the total stands at $275,653 ($250,007 goal plus $25,646 in additional contributions). The organization has already posted a job listing for a staff attorney "to help us prepare and litigate future lawsuits we may need to bring."

"Sometimes, impact litigation is the best vehicle for substantive change to protect consumers' software right to repair," the SFC wrote in its announcement. "Companies increasingly refuse to follow the pro-user terms of copyleft licenses and contracts, despite repeated requests and demands for better behavior. This leaves lawsuits as our only option."

The SFC has also established a traditional FOSS mailing list for the baltobu project and announced a standing committee on software freedom in the 3D printer space, bringing together manufacturers, users, licensing experts, and activists for monthly meetings.

Bambu Lab's Position

Bambu Lab has not retreated from its public stance. In its May 7 blog post and subsequent forum responses, the company argued that open-source licensing "governs the code, but it does not grant unlimited or deceptive access to Bambu's private cloud infrastructure." The company maintains that cloud access is governed by a user agreement, not the AGPL.

This argument faces two immediate legal difficulties. First, the AGPLv3's explicit prohibition on "further restrictions" (AGPLv3 §10¶3) means a separate terms-of-service agreement cannot override rights granted by the license. Second — and arguably more damaging — the proprietary networking library issue is entirely separate from the cloud-access question. The failure to release source code for libbambu_networking is a straightforward compliance failure: dynamically linked libraries distributed with an AGPLv3 work must themselves be released under AGPLv3.

Industry observers have noted this distinction. As one community member on Bambu's own forum put it: "The code used by that specific fork to access the server was published in Bambu Studio, so the use of that specific code is governed by the AGPL, not your ToS." Another pointed out that even Bambu's "official way" of accessing the cloud — loading the closed-source network plugin into Bambu Studio at runtime via dlopen — may itself constitute a violation, since the plugin runs fully within the slicer's memory space.

What Comes Next

The trajectory is now set on several parallel tracks. The reverse-engineering effort continues with community volunteers. The orca-slicer-for-bambu fork provides an immediate practical alternative for users who want to escape Bambu's cloud mandate. And with the fundraiser's success, the SFC now has the resources to escalate to litigation if Bambu Lab does not come into compliance.

For Bambu printer owners, the stakes are concrete. A printer that depends on proprietary, un-auditable software to function is a printer that can be remote-bricked, data-harvested, or feature-degraded at the manufacturer's discretion. The January 2025 firmware lockdown demonstrated that this is not a theoretical concern — owners were told to choose between firmware improvements and preserving control over their own hardware.

The 3D printing community's embrace of copyleft licenses in its early history was deliberate: it ensured that users, not manufacturers, would control the tools they depend on. The baltobu project and its $275,000 war chest represent an institutional commitment to enforcing that bargain — in court if necessary.

This article is based on primary-source reporting from the Software Freedom Conservancy's official announcements (May 18 and July 16, 2026), Bambu Lab's public statements, Paweł Jarczak's published developer responses, and contemporaneous coverage by Tom's Hardware, It's FOSS, LWN, and Jeff Geerling. All legal claims attributed to the SFC reflect the organization's stated positions as of July 2026.

Bambu Lab's AGPL Violation Sparks $275K SFC Lawsuit Fund