AI is adding to the review load on open-source projects, many of them thinly funded

AI coding tools are making open source software harder to maintain and secure, according to six authors writing for the Association for Computing Machinery’s Technology Policy Council, among them Simson Garfinkel and Josiah Dykstra. The tools write code and find security flaws quickly. The maintainers who decide what enters a project’s official release still have to judge that output themselves.

That burden reaches anyone who runs software. Open source code sits inside phones, cars, cloud systems and AI platforms, and a Harvard Business School paper the authors cite estimates that firms would spend 3.5 times more on software without it. Many projects lack reliable revenue, and deferred maintenance on those projects can leave security holes in the software built on them.

More code for humans to check

Most open source projects accept outside contributions, and they typically keep a vetted group of trusted contributors who decide what gets committed, meaning accepted into the official codebase. AI has made writing and submitting code easy, and some of what arrives is poor. The authors allow that quality may improve as models do, but a human still has to assess the added volume.

Faster fixes, faster attacks

So much of the world runs the same code that a flaw found in it can have outsized impact. A growing number of attackers plant malicious packages and code in popular repositories.

Between April and October 2025, Google’s CodeMender agent contributed “72 security fixes to open source projects, including some as large as 4.5 million lines of code,” according to Google. Models that find and patch flaws can also be used to build attacks. The authors doubt that restricting top security models to trusted users will help, since general-purpose models keep getting stronger.

AI-found flaws push organizations to patch sooner. That is hard for applications built from many open source components, because every one of those components needs its own patch and re-release, in sequence.

The money is lopsided

The Linux Foundation brought in $292,217,236 in 2024. The Apache Software Foundation, which the authors cite as an example of projects that run on volunteer labor and sponsorships, brought in $2,379,402, less than 1 percent of that. Across open source, most users never pay, a pattern known as the free-rider problem.

You may not know what you run

A software bill of materials, or SBOM, is a machine-readable list of the components inside an application. Despite US and EU mandates, the vast majority of open source applications do not generate or ship one. An SBOM would show what is present, not whether each piece is maintained, funded, secure or abandoned.

Open source is governed project by project, so ecosystem-wide numbers on AI’s effects are hard to collect. The authors want projects to put more resources into documentation, packaging, fundraising and gathering requirements, because deciding what a project needs and getting its community to agree still falls to people. Most institutions, the authors write, face perhaps their largest challenge in learning the governance, maintenance and security state of their software, so they can spot critical dependencies before something fails.