How Will AI Affect Open Source Development? (linuxfoundation.org) 8
This week the Linux Foundation's Open Source Security Foundation (OpenSSF) announced it would broaden its AI security resources, including a new guide to finding and fixing vulnerabilities using AI, "from preparing and sandboxing AI to validating, fixing, and preventing issues." The guide "stresses that AI-generated patches should never be trusted without automated tests and human review. An online course (LFD126) is planned for the coming months."
OpenSSF also released the State of AI Impact on Software Security and Cybersecurity 2026 report (supported by OpenSSF, ActiveState and the Linux Foundation AI & Data Foundation). And it turns out the 2026 report "found a growing gap between the pace of AI-driven software development and organizations' ability to secure the code being produced." 58% of surveyed teams ship code faster than security reviews can keep up, while 60% say AI coding assistants have increased the number of external packages in their codebases. This data underscores the importance of trusted, reliable guidance as AI deployment continues to grow.
Meanwhile the Linux Foundation announced at this week's Web Summit that it was releasing a new study on "how commercial open source companies generate revenue, convert users into customers and build their businesses," emphasizing the question's new relevance in the age of AI. "AI now writes code almost for free, and that raises a hard question for the whole software industry: if code costs next to nothing, where does the value of software lie?" Commercial open source [COSS] companies have been answering that question for more than 30 years. They have built large businesses on code they give away, which makes them a good guide to how software will make money in the age of AI... Seventy-two percent of respondents report a net positive impact from AI, against 8% negative. So far, the gains show up mostly inside companies. Internal productivity is the most cited benefit (73%), ahead of market expansion (46%) and new monetization opportunities (39%). AI roles are the only hiring category growing on net.
COSS strategy is mostly unchanged by AI. But when companies do adapt, they are nearly twice as likely to open more of their core product rather than become more closed. When asked what sets them apart, 57% of companies name brand recognition and trust, well ahead of enterprise features, integrations and community size. They turn that trust into revenue through support and services (63%), managed cloud (49%) and open core (43%). Most combine these: 65% run two or more revenue models.
Companies stack models as they grow, rather than switching between them: managed cloud rises from 35% of companies below $5 million ARR to 66% above $20 million. Venture-backed companies lean toward open core (53% vs. 38% for others).
The report draws on a survey of 225 commercial open source founders and enterprise leaders (published by Linux Foundation Research in partnership with Serena, and with sponsorship from AWS, Red Hat, Futurewei and the Cloud Native Computing Foundation. And when it comes to open source, "over half of founders point to brand recognition and community trust as their greatest asset," said Chris Aniszczyk, CTO of the Cloud Native Computing Foundation. So "The findings from this year's report prove that AI isn't a threat to commercial open source software — it's an accelerating tailwind. With 72% of companies viewing AI as a net positive primarily driving internal productivity, the ecosystem is leaning further into collaboration."
The Linux Foundation's announcement includes an interesting perspective from Matthieu Lavergne, partner at the venture capital company Serena. "Open source won the developer. Next, it will win the agent. The 225 founders we surveyed mostly see AI as a productivity gain today, but that's only the start: agents are set to become open source's largest users, and they choose what is open, proven and trusted. The founders who build and price for these new users will define the infrastructure of the AI era."
OpenSSF also released the State of AI Impact on Software Security and Cybersecurity 2026 report (supported by OpenSSF, ActiveState and the Linux Foundation AI & Data Foundation). And it turns out the 2026 report "found a growing gap between the pace of AI-driven software development and organizations' ability to secure the code being produced." 58% of surveyed teams ship code faster than security reviews can keep up, while 60% say AI coding assistants have increased the number of external packages in their codebases. This data underscores the importance of trusted, reliable guidance as AI deployment continues to grow.
Meanwhile the Linux Foundation announced at this week's Web Summit that it was releasing a new study on "how commercial open source companies generate revenue, convert users into customers and build their businesses," emphasizing the question's new relevance in the age of AI. "AI now writes code almost for free, and that raises a hard question for the whole software industry: if code costs next to nothing, where does the value of software lie?" Commercial open source [COSS] companies have been answering that question for more than 30 years. They have built large businesses on code they give away, which makes them a good guide to how software will make money in the age of AI... Seventy-two percent of respondents report a net positive impact from AI, against 8% negative. So far, the gains show up mostly inside companies. Internal productivity is the most cited benefit (73%), ahead of market expansion (46%) and new monetization opportunities (39%). AI roles are the only hiring category growing on net.
COSS strategy is mostly unchanged by AI. But when companies do adapt, they are nearly twice as likely to open more of their core product rather than become more closed. When asked what sets them apart, 57% of companies name brand recognition and trust, well ahead of enterprise features, integrations and community size. They turn that trust into revenue through support and services (63%), managed cloud (49%) and open core (43%). Most combine these: 65% run two or more revenue models.
Companies stack models as they grow, rather than switching between them: managed cloud rises from 35% of companies below $5 million ARR to 66% above $20 million. Venture-backed companies lean toward open core (53% vs. 38% for others).
The report draws on a survey of 225 commercial open source founders and enterprise leaders (published by Linux Foundation Research in partnership with Serena, and with sponsorship from AWS, Red Hat, Futurewei and the Cloud Native Computing Foundation. And when it comes to open source, "over half of founders point to brand recognition and community trust as their greatest asset," said Chris Aniszczyk, CTO of the Cloud Native Computing Foundation. So "The findings from this year's report prove that AI isn't a threat to commercial open source software — it's an accelerating tailwind. With 72% of companies viewing AI as a net positive primarily driving internal productivity, the ecosystem is leaning further into collaboration."
The Linux Foundation's announcement includes an interesting perspective from Matthieu Lavergne, partner at the venture capital company Serena. "Open source won the developer. Next, it will win the agent. The 225 founders we surveyed mostly see AI as a productivity gain today, but that's only the start: agents are set to become open source's largest users, and they choose what is open, proven and trusted. The founders who build and price for these new users will define the infrastructure of the AI era."
Using AI bug discovery and AI patches is great... (Score:2)
... but if you don't incorporate AI into your project manage system, you're going to get swamped by it all. AI needs to also handle the first-tier of bug reports, patch submissions, and feature requests - reviewing them, evaluating them within the project goals, filtering out or improving submissions with issues, seeking and taking into account user feedback on controversial issues, etc. The limited human hours that most OSS projects have need to be insulated from the deluge, leaving them to focus on the
Re: (Score:2)
Unless there is a big increase in funding across the board, how do you expect "most OSS projects" will pay for the bottomless bucket of tokens necessary to have "AI" handle project management, bug reports, patch review, etc etc?
What I expect to actually happen here is that the folks that have been maintaining the non-corporate F/OSS stuff will just walk away altogether and find something more personally rewarding to do with their limited time than subsidise commercial exploitation of their work.
Huh? (Score:2)
For the service the software provides???
I mean, you don't pay a guy for the sole act of swinging a hammer, you're paying him because he's building you a house to live in
AI or die (Score:2)
Basically, open source projects that want to retain their relevance will alow and even encourage the use of AI, or they will die or be forked off.
Refusing to use AI will be akin to refusing to write in C and sticking to assembler.
I'm not sure you understand what open source means (Score:2)
I just don't see people doing open source work as much anymore. Doing anything publicly on the internet right now means you get overflowed with AI agents spamming every stage of the cycle.
Re: (Score:2)
and a lot of people, especially juniors, were contributing to open source because if you look for a job, recruiters want to "see your work". But obviously since when you work for a company it's always proprietary and NDA, none of your work is "available to see". The only way to do this was to contribute to open source. A green activity grid on Github made it somehow look good.
Nowadays, open source contributions mean absolutely nothing because AI is doing all the work. So you have two types: idiots who keep
open prompt? (Score:2)
Based on that litle experience, I'd say it is good for open source code. I am not sure if the source code is that valueable anymore. The prompt may be more worth...