AI is adding to the review load on open-source projects, many of them thinly funded
ACM Technology Policy Council authors warn AI-generated code is overwhelming thinly funded open-source maintainers, raising software supply chain security risks.
Six authors including Simson Garfinkel and Josiah Dykstra, writing for the ACM Technology Policy Council, argue AI coding tools flood open-source projects with contributions that human maintainers must still review. They cite Google's CodeMender agent contributing 72 security fixes to open-source projects, some as large as 4.5 million lines of code, between April and October 2025. Funding is lopsided: the Linux Foundation raised $292,217,236 in 2024 versus $2,379,402 for the Apache Software Foundation. They also note most open-source applications still ship no SBOM despite US and EU mandates, and attackers increasingly plant malicious packages in popular repositories.
- AI makes submitting code easy, but human maintainers must vet the added volume
- Google's CodeMender delivered 72 open-source security fixes in roughly six months
- Apache Foundation's 2024 revenue was under 1% of the Linux Foundation's
- Vast majority of open-source apps lack SBOMs despite US and EU mandates
- Malicious packages planted in popular repositories are a growing attack vector
- Products
- CodeMender
- Countries
- United StatesEuropean Union
From the original article
2 min read at helpnetsecurity.com
AI coding tools are making open source software harder to maintain and secure, according to six authors writing for the Association for Computing Machinery’s Technology Policy Council, among them Simson Garfinkel and Josiah Dykstra. The tools write code and find security flaws quickly. The maintainers who decide what enters a project’s official release still have to judge that output themselves.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.