Jump to content

Bambu Lab cease and desist against OrcaSlicer fork developer

From Consumer Rights Wiki

In April 2026, Bambu Lab sent a private cease-and-desist demand to Polish developer Paweł Jarczak, the maintainer of an OrcaSlicer community fork that had restored direct printer control capabilities removed by Bambu Lab's Authorization Control System. The project was wiped from public view the same day the threat was delivered, and the developer published a summary of Bambu Lab's allegations but not the letter itself, citing Bambu Lab's refusal to authorize publication.[1][citation needed] On May 7, 2026, Bambu Lab published a blog post recharacterizing the dispute as "impersonation" through "falsified identity metadata" rather than as a question about open-source rights.[2]

The full public-record account includes the parallel May 7, 2026 Bambu Lab blog post and three same-day public Reddit replies from the maintainer.

The Reddit communications between Bambu Lab and the developer have been saved on the wiki at File:Bambu communications with developer.pdf.

Background

[edit | edit source]

OrcaSlicer

[edit | edit source]

OrcaSlicer is a free, open-source slicer: a program that converts a 3D model file into the layer-by-layer instructions (G-code) a 3D printer needs to produce the physical object. It is maintained by the developer SoftFever and draws from Bambu Lab's Bambu Studio, which is itself a fork of Prusa Research's PrusaSlicer.[3] Bambu Studio in turn descends from Slic3r, the upstream project Prusa Research forked.[4][5] OrcaSlicer is widely used by owners of Bambu Lab printers as an alternative to Bambu Studio, and it ships under the AGPL-3.0 license.[3][6][7]

Restrictions introduced by the Authorization Control System

[edit | edit source]

The Bambu Lab Authorization Control System announced on January 16, 2025 gated print initiation, motion control, fan and hotend temperature control, AMS configuration, calibrations, remote video, and firmware upgrade behind a Bambu-issued authentication path. Owners who installed the new firmware could no longer send print jobs from third-party slicers directly over the local network; they had to route those jobs through a new closed-source middleware, Bambu Connect.[8] SoftFever was not given API keys for Bambu Connect and stated publicly that direct print sending from OrcaSlicer would not be supported going forward.[9]

OrcaSlicer-bambulab fork

[edit | edit source]

On April 23, 2026, the developer Paweł Jarczak (GitHub user jarczakpawel) made a public fork named OrcaSlicer-bambulab at github.com/jarczakpawel/OrcaSlicer-bambulab. The fork restored the ability to send print jobs from OrcaSlicer directly to Bambu Lab printers without routing through Bambu Connect.[7] According to Jarczak's own description, the fork worked by reaching the printer through a Linux-side workflow Bambu Lab had not yet disabled, and was built on publicly available Bambu Studio source code combined with the developer's own integration layer; it did not redistribute Bambu Lab's proprietary networking plugin binaries.[1][10] Jarczak also maintained a sibling fork at github.com/jarczakpawel/BambuStudio-BMCU that added support for a third-party multi-color unit (BMCU); that repository remained live as of May 9, 2026.[11]

Cease and desist

[edit | edit source]

Bambu Lab contacted Jarczak directly and demanded removal of the fork. According to Jarczak's own first-person account in his public archive README, Bambu Lab "referred to legal materials and stated that a cease and desist letter had been prepared," and alleged that the implementation:

impersonated Bambu Studio, bypassed their authorization controls, violated their Terms of Use, involved "reverse engineering", and could allow modified forks to send arbitrary commands to printers.

[1] Jarczak rejected the reverse-engineering characterization, stating that his work was based on publicly available Bambu Studio source code, which Bambu Lab releases under the AGPL-3.0 license.[1][10] Jarczak disputed the broader characterization and asked for specifics: the exact files or commits at issue, and the exact legal or contractual basis. He reports receiving "further broad accusations" instead of that specificity.[1] Bambu Lab refused consent for publication of the correspondence itself, and Jarczak elected to honor that refusal while retaining the letter.[1] The repository was wiped the same day the threat was delivered.[1][7] Jarczak removed the contents voluntarily and stated this was a practical decision, not an admission that the legal or technical allegations were correct; in his own words from the public archive notice:

I removed the repository voluntarily. That removal should not be interpreted as an admission that all legal or technical allegations made against the project were correct.

[1]

XDA Developers reported that Bambu Lab had not responded to its request for comment as of publication.[7] 3Druck independently confirmed the same set of allegations, citing Jarczak's GitHub statement.[10] Tom's Hardware also covered the takedown on April 29, 2026.[12] The trade outlet Manufactur3D added context on May 1, 2026, including that the dispute had become a flashpoint in the wider 3D-printing community.[13]

The publicly documented allegations track Bambu Lab's Terms of Service and an "authorization bypass" framing.[14][1] Because the letter itself was not made public, no primary source confirms which specific statute, if any, Bambu Lab invoked; neither Jarczak's account nor the secondary reporting names a specific statute, including the DMCA §1201 anti-circumvention provision, as part of Bambu Lab's claim. The upstream OrcaSlicer maintainer SoftFever was not named in the cease-and-desist, has issued no public statement on the fork or the letter, and the upstream repository remains active.[3]

Public timeline

[edit | edit source]
  • January 16, 2025. Bambu Lab announced "Firmware Update: Introducing the New Authorization Control System," describing the firmware-gated authorization model.[8]
  • Spring 2026. Paweł Jarczak published OrcaSlicer-bambulab and a sibling repository BambuStudio-BMCU on GitHub.[1][11]
  • Late April 2026. Bambu Lab contacted Jarczak privately on Reddit and demanded removal of the OrcaSlicer fork. Per Jarczak's public README, Bambu Lab's allegations were impersonation of Bambu Studio, bypass of authorization controls, ToS violation, reverse engineering, and the potential for modified forks to send arbitrary commands to printers.[1]
  • Around April 23, 2026. Jarczak removed the OrcaSlicer-bambulab repository voluntarily, and replaced its contents with a public archive notice; jarczakpawel/BambuStudio-BMCU remained live as of May 9, 2026.[1][11]
  • May 7, 2026. Bambu Lab published "Setting the record straight on Cloud Access and Community" on its blog and posted a parallel announcement on r/BambuLab the same day.[2][15]
  • May 7, 2026 (same day). A Reddit user posting as Low-Anything6975 replied publicly under three top-level comments on the r/BambuLab thread. The first reply pinpointed the file path and code line in Bambu's own AGPL source where the User-Agent string is generated.[16] The second reply addressed the cloud Terms of Service and AGPL rights to use, modify, and redistribute.[17] The third reply articulated the plugin-severability symmetry argument.[18]
  • May 9, 2026. Jarczak's public archive README was last updated; BambuStudio-BMCU remained live.[1][11]
  • May 9, 2026. Right-to-repair advocate Louis Rossmann publicly pledged $10,000 toward Jarczak's legal defense if Bambu Lab proceeded with the threatened lawsuit in a YouTube video titled "I'll put up $10,000 to teach bambu labs a lesson."[19]
  • May 10, 2026. Tom's Hardware reported Rossmann's pledge and accompanying public statement directed at Bambu Lab.[20]

Bambu Lab's public response

[edit | edit source]

Bambu Lab's May 7, 2026 blog post conceded that AGPL forks of Bambu Studio are permitted, recast the dispute as one about cloud access and "impersonation" rather than open source, and declined any responsibility under AGPL for the cloud back-end. Bambu Lab characterized the AGPL question:

Bambu Studio is an open-source project under the AGPL-3.0 license. Anyone can take its code, modify it, and distribute it. This is not a matter of our "permission" - it is simply how the license and open source work.

[2]

The same post bifurcated AGPL code from cloud infrastructure:

Our cloud is a private service. Access to it is governed by a user agreement, not the AGPL license.

[2]

Bambu Lab's only concrete technical allegation against the OrcaSlicer-bambulab fork in the post was that the modification "worked by injecting falsified identity metadata into network communication." The post identified the metadata as the HTTP User-Agent string the fork emitted to Bambu Cloud:

When this particular OrcaSlicer fork communicates with our cloud services, it quietly introduces itself as official Bambu Studio - with a hardcoded version number and all... that's precisely the point where code modification crosses into impersonation.

[2]

Bambu Lab restated the bifurcation in summary form:

Modifying and distributing AGPL code - absolutely. But impersonating official clients in communication with our cloud infrastructure is not allowed.

[2]

The trade outlet 3Druck published an analysis of the post on May 7, 2026, headlined that the dispute was about cloud access rather than open-source customization.[21]

Consumer-rights significance

[edit | edit source]

Bambu Lab printer owners had paid for hardware that, at the time of purchase, allowed third-party slicers to send print jobs directly over their own local network. The January 2025 firmware update removed that capability for owners who installed the update.[8] When an independent developer rebuilt the lost capability on top of source code Bambu Lab itself publishes, Bambu Lab contacted him privately on Reddit and stated that a cease and desist letter had been prepared.[1] The developer took the project down and stated he had "no interest in maintaining a prolonged dispute."[1]

Open-source licensing dispute

[edit | edit source]

Since Bambu Studio is licensed under the AGPL-3.0 license, the attempts by Bambu Lab to exert control over the software's editing and use have been described as being in conflict with the license.[citation needed]

Bambu Studio AGPL-3.0 licensing

[edit | edit source]

Bambu Lab elected to release Bambu Studio under the GNU Affero General Public License version 3 (AGPL-3.0). The LICENSE file in the upstream Bambu Studio repository is the verbatim AGPL-3.0 text.[22][23] The AGPL is a copyleft license: anyone who receives the code can use, modify and redistribute it, on the condition that they pass the same rights to everyone they distribute to, and that they make their modifications available as source code.[23] The final paragraph of Section 10 (titled "Automatic Licensing of Downstream Recipients") begins:

You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License.

[24] The paragraph continues with examples of prohibited restrictions, including imposing license fees or royalties for exercise of the granted rights and initiating patent litigation against users of the program.[24]

Section 7, paragraph 4, lists the only kinds of additional terms a licensor may attach to AGPL-licensed code and states that downstream recipients may strip out anything outside that list:

All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term.

[25]

Bambu Lab's May 7, 2026 blog post acknowledges the licensing posture.[2]

Terms of Use conflict with AGPL

[edit | edit source]

Bambu Lab's Terms of Use § 3.4, preserving a typo in the source text:

Except as otherwise expressly permitted, you shall not, nor allow any other person to misappropriate, intrude or make other inappropriate use of the Product, including, but not limited to modify, discoder, copy, reverse engineer, publish, publicly disseminate, decompile, export codes, disassemble or create derivatives of the Product in any way.

[14]

Two further clauses in § 3.5 reinforce the same prohibitions. § 3.5(2) states:

(2) provide to third parties, or allow third parties to use the whole or part of the Software without obtaining Bambu Lab's written consent (including but not limited to apps, services, code, and source code)

[14]

§ 3.5(5) states:

(5) attempt to destroy, bypass, change, invalidate or escape from the Product and/or any digital rights management system that is part of the organic composition of the Product

[14]

Bambu Lab's Terms define "Product" to include Bambu Lab devices and the software contained therein.[14] Bambu Lab's own May 7, 2026 blog post confirms that Bambu Studio is "the software" in question.[2]

Commentators have noted[citation needed] that AGPL § 7 ¶ 4 & § 10 forbid the licensor from imposing additional restrictions on AGPL-granted rights, and TOS § 3.4 / § 3.5 forbid the modification, copying, reverse engineering, decompilation, and redistribution that AGPL-3.0 explicitly grants, resulting in conflict between the AGPL license and Bambu Lab's terms. Both documents exist on Bambu Lab's servers; the FSF's published GPL FAQ classifies a network of dynamically linked components and function calls as "a single combined program" for license-obligation purposes,[26].

The same Reddit user addressed this directly on May 7, 2026:

Cloud ToS also cannot erase AGPL rights to use, modify and redistribute that code.

[17]

User-Agent identity metadata

[edit | edit source]

The "falsified identity metadata" Bambu Lab describes as "impersonation" is the HTTP User-Agent string the fork emits when contacting Bambu Cloud. That string is generated by Bambu Lab's own AGPL-licensed source code. The User-Agent setter is in src/slic3r/Utils/Http.cpp, and assembles its value from constants defined in version.inc. The relevant line in Http.cpp reads:

::curl_easy_setopt(curl, CURLOPT_USERAGENT, SLIC3R_APP_NAME "/" SLIC3R_VERSION);

[27]

The constants in version.inc set the application name and version directly:

set(SLIC3R_APP_NAME "BambuStudio") set(SLIC3R_VERSION "02.06.01.55")

[28]

Both files are governed by the BambuStudio LICENSE, which is AGPL-3.0.[22] A clean compile of unmodified upstream Bambu Studio emits a User-Agent: BambuStudio/02.06.01.55 header on every HTTP request by default, because that is the value Bambu Lab itself wrote into its own published source. The same Reddit user made this point:

User-Agent is not authentication. It is just self-declared client metadata. Any program can set any User-Agent. And the most important part: this comes directly from your own AGPL code.

[16]

Whichever branch of the severability dilemma Bambu Lab takes in the previous subsection, the impersonation framing relies on Bambu Lab's own AGPL-licensed code generating the very header Bambu Lab calls falsified.

Consequences for FOSS forks of corporate-sponsored AGPL projects

[edit | edit source]

Louis Rossmann publicly pledged $10,000 toward Jarczak's legal defense if Bambu Lab proceeded with a lawsuit in a May 9, 2026 YouTube video,[19] and directed an explicit public statement at the company's leadership; Tom's Hardware reported the pledge on May 10, 2026.[20] The 3D-printing trade press (3Druck, XDA, Tom's Hardware, Manufactur3D) covered the dispute as the immediate flashpoint. Enforcement organizations including the Free Software Foundation, Software Freedom Conservancy, FSFE, and Electronic Frontier Foundation have jurisdiction to bring AGPL claims, but no enforcement action involving Bambu Lab had been announced as of publication. The same question reaches every IoT-device vendor who ships AGPL or GPLv3 components with companion mobile apps and cloud back-ends, and every consumer-electronics company publishing open-source slicers, control panels, or firmware while routing user functionality through proprietary remote services.

See also

[edit | edit source]

References

[edit | edit source]
  1. ↑ 1.00 1.01 1.02 1.03 1.04 1.05 1.06 1.07 1.08 1.09 1.10 1.11 1.12 1.13 1.14 Jarczak, Pawel. "OrcaSlicer-bambulab — This is the end…". GitHub. Archived from the original on 2026-04-30. Retrieved 2026-05-04.
  2. ↑ 2.0 2.1 2.2 2.3 2.4 2.5 2.6 2.7 "Setting the record straight on Cloud Access and Community". Bambu Lab Blog. Bambu Lab. 2026-05-07. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  3. ↑ 3.0 3.1 3.2 SoftFever. "OrcaSlicer". GitHub. Retrieved 2026-05-04.{{cite web}}: CS1 maint: url-status (link)
  4. ↑ "Slic3r". GitHub. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  5. ↑ "PrusaSlicer LICENSE (AGPL-3.0)". GitHub. Prusa Research. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  6. ↑ "OrcaSlicer LICENSE.txt (AGPL-3.0)". GitHub. SoftFever. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  7. ↑ 7.0 7.1 7.2 7.3 Batt, Simon (2026-04-23). "A developer restored OrcaSlicer's features that Bambu Lab killed — then the legal threats arrived". XDA Developers. Archived from the original on 2026-04-27. Retrieved 2026-05-04.
  8. ↑ 8.0 8.1 8.2 Bambu Kidd (2025-01-16). "Firmware Update Introducing New Authorization Control System". Bambu Lab Blog. Archived from the original on 2026-03-07.
  9. ↑ @fever_soft (2025-01-18). "This is definitely a bummer. I was negotiating for an authorization key to allow OrcaSlicer to communicate with their device like BambuStudio does, but today I was told they won't support this. Only their slicer can send prints directly; others must use their Bambu Connect application". X. Archived from the original on 2025-10-04. Retrieved 2025-05-01.
  10. ↑ 10.0 10.1 10.2 "Developer ends OrcaSlicer fork after Bambu Lab threatens legal action". 3Druck.com. 2026-04-30. Retrieved 2026-05-04.{{cite web}}: CS1 maint: url-status (link)
  11. ↑ 11.0 11.1 11.2 11.3 Jarczak, Pawel. "BambuStudio-BMCU". GitHub. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  12. ↑ "Developer re-enables 3D printer features that Bambu Lab disabled, firm promptly threatens legal action — OrcaSlicer-BambuLab project now shuttered". Tom's Hardware. 2026-04-29. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  13. ↑ "Bambu Lab OrcaSlicer Controversy Ignites After Legal Threats". Manufactur3D. 2026-05-01. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  14. ↑ 14.0 14.1 14.2 14.3 14.4 "Terms of Use". Bambu Lab. 2024-04-24. Archived from the original on 2026-03-09. Retrieved 2025-05-01.
  15. ↑ BambuLab (2026-05-07). "Setting the record straight on Cloud Access and Community". Reddit. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  16. ↑ 16.0 16.1 Low-Anything6975 (2026-05-07). "Reply on User-Agent attribution in Bambu Studio AGPL source code". Reddit. Retrieved 2026-05-10.{{cite web}}: CS1 maint: numeric names: authors list (link) CS1 maint: url-status (link)
  17. ↑ 17.0 17.1 Low-Anything6975 (2026-05-07). "Reply on cloud Terms of Service and AGPL rights to use, modify and redistribute". Reddit. Retrieved 2026-05-10.{{cite web}}: CS1 maint: numeric names: authors list (link) CS1 maint: url-status (link)
  18. ↑ Low-Anything6975 (2026-05-07). "Reply on plugin severability symmetry between AGPL forks and Bambu Lab cloud". Reddit. Retrieved 2026-05-10.{{cite web}}: CS1 maint: numeric names: authors list (link) CS1 maint: url-status (link)
  19. ↑ 19.0 19.1 Rossmann, Louis (2026-05-09). "I'll put up $10,000 to teach bambu labs a lesson". YouTube. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  20. ↑ 20.0 20.1 "Louis Rossmann tells 3D printer maker Bambu Lab to 'Go (Bleep) yourself' over its threatened lawsuit against enthusiast — Right to Repair advocate offers to pay the legal fees for a threatened OrcaSlicer developer". Tom's Hardware. 2026-05-10. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  21. ↑ "Dispute over OrcaSlicer fork: Bambu Lab is about cloud access, not open-source customization". 3Druck.com. 2026-05-07. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  22. ↑ 22.0 22.1 "BambuStudio LICENSE (AGPL-3.0 verbatim)". GitHub. Bambu Lab. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  23. ↑ 23.0 23.1 "GNU Affero General Public License Version 3". GNU Project. Free Software Foundation. 2007-11-19. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  24. ↑ 24.0 24.1 "GNU Affero General Public License Version 3, Section 10 (Automatic Licensing of Downstream Recipients)". GNU Project. Free Software Foundation. 2007-11-19. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  25. ↑ "GNU Affero General Public License Version 3, Section 7 (Additional Terms)". GNU Project. Free Software Foundation. 2007-11-19. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  26. ↑ "Frequently Asked Questions about the GNU Licenses (GPLPlugins anchor)". GNU Project. Free Software Foundation. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
  27. ↑ "Http.cpp source file (User-Agent setter at line 175)". GitHub. Bambu Lab. Retrieved 2026-05-11.{{cite web}}: CS1 maint: url-status (link)
  28. ↑ "version.inc (SLIC3R_APP_NAME and SLIC3R_VERSION constants)". GitHub. Bambu Lab. Retrieved 2026-05-10.{{cite web}}: CS1 maint: url-status (link)
Retrieved from "https://consumerrights.wiki/index.php?title=Bambu_Lab_cease_and_desist_against_OrcaSlicer_fork_developer&oldid=53610"