Will AI ring the death knell for open source?

Open source can't catch a break. As the world of software development marches forward with new tools and capabilities expanding productivity – an evolution driven predominantly by AI – the community endures significant headwinds.

"In the age of AI-driven security threats, protecting customer data has to come first," wrote Bailey Pumfleet, co-founder and CEO of scheduling software maker Cal.com, in April.

After five years as "open source champions", the company announced it would go "closed source". Cal.com is far from the only example, with several organizations and projects including Tailwind, curl, Jazzband, Godot – and even the U.K. National Health Service (NHS) – also struggling in the wake of AI.

Tension has always plagued open source, with concerns around funding, infrastructure, and even expectations management, negating any meaningful green shoots. The threat has even been described as "existential", but the community has nevertheless survived and thrived, celebrating incredible adoption rates in recent years. But things feel different. AI poses an existential threat in many areas — but will it continue to hack away at the beleaguered open source community, or is there a viable path forward for the movement?

Latest Videos From

Watch full video here:

Open source is battling AI-centric headwinds

"In the past, exploiting an application required a highly skilled hacker with years of experience and a significant investment of time to find and exploit vulnerabilities," wrote Cal.com's Pumfleet in the blog post. The reality is that humans don’t have the time, attention, or patience to find everything. Today, AI can be pointed at an open source codebase and systematically scan it for vulnerabilities."

Security is just one aspect in an increasingly fraught dynamic. Tailwind, the organization behind a popular CSS framework that web developers incorporate into their projects, announced on 7 January it had slashed its four-person dev team to just one. The reason, CEO Adam Wathan cited, was "the brutal impact AI has had"; web traffic to documentation – which is the only way people can find out about its commercial products – was down 40% from early 2023.

There are also examples of projects struggling to cope with an onslaught of low-quality contributions. Take Godot, the open source game engine that's drowning in AI slop code pull requests (PRs), according to one of the primary maintainers, Rémi Verschelde, who described this as "increasingly draining and demoralizing".

The Jazzband collective, a Python project ecosystem, was sunset this year after ten years of activity due to the "slopocalypse" with floods of PRs and AI-generated spam rendering "Jazzband’s model of open membership and shared push access untenable".

There are plenty of other issues to contend with. They may include the fact that using advanced AI tools may be gated on the need to spend money, and that it's unclear whether you're speaking with a human or an AI agent at any given time.

How open source projects are coping with AI

Amanda Brock, CEO of OpenUK, tells ITPro that the industry is still grappling with AI as a novel force and different projects are handling it in different ways – with some handling it much better than others. "For some projects, they have not been able to manage the scale of it. And for some small companies, they have said they've had to close," she says, but added this isn't a universal experience, with others managing to get a grip on the headwinds.

"I'm skeptical about their business plan," Brock added on Tailwind, "and I could be wrong, and I'm not an authority on this in terms of each company's business and whether they were doing well enough. But I'm a bit skeptical when many are surviving about the few that are closing, and I don't know if that's the most vulnerable or the ones without the right business structures or teams."

However, Brock states the challenges are very real and unlike much else the community has experienced. For example: "When AI comes to Wikipedia, it not only comes at a huge scale by volume of eyes on the site or the pages, it looks at every page, and it does it in an instant. And the overwhelm is huge. And that's the equivalent of what open source projects feel when their repos are scraped; when they suddenly have this inbound volume from AI."

An example of a project that's fared better in wrestling with AI is Homebrew, the package manager. Its project leader Mike McQuaid tells ITPro Homebrew's response was to fight fire with fire. "We have had an increase in low-effort activity, but we respond with low effort," he says. "Our bots automatically close issues, we’ll close without review, we don’t dignify them with a response, et cetera."

McQuaid adds that, despite some notable examples, it's overstated that many projects are going closed source or winding down, and it's not representative of the wider experience. He says projects weather the storm "the same way we always have," with one measure including prioritizing maintainers' time, effort, and enjoyment over contributors, and prioritizing contributors over users. Responding to rudeness is also met with low effort, no effort, or blocking. He also suggested leaning very hard onto guardrails.

Resolving the fate of open source

McQuaid says the notion that AI could lead to the end of open source is "far too dramatic" and that there are plenty of positives to enjoy in a grand trade-off, despite there being an element of entering the unknown. These positive improvements include the way that AI allows some people to go much faster, that there are plenty of free AI tools available, and that many of these can help with code review, fixing bugs and triaging.

"It isn’t making huge negative changes without any positive remediations," he explains. "It’s just resetting people’s expectations of what 'working on open source' might be like for them. Some people won’t enjoy it any more. Many people equally are contributing who didn’t or wouldn’t before."

Despite many positive steps taken in the open source world over the last decade, Brock dwells in a sense of pessimism – but not entirely because of the immediate effects of AI. "I have been very pessimistic in some ways for a long time," she says, "because after lockdown everybody came out seeming to think that 'we'd won'." And what we'd won was, we've got a scale of adoption — but that scale of adoption wasn't matched by a scale of understanding, or funding.

"My worry was that you were going to see it, go full circle and end up back in proprietary because of exactly this kind of thing. I did not imagine AI, but I could see that things might happen, that meant that we were just overwhelmed because we got into a position where people expected an SLA-type delivery and support for free because the code was free."

Building on open source's legacy

"If it hadn't been AI, it would have been something else," Brock reiterates, saying the challenges have been piling up "at a time when people are reeling" one after another in the last few years.

"We've just had a decade since we really saw all this adoption start. We're a small group of experts [and scaling from] the small to the many hasn't worked."

Brock wants to see more gatekeeping, because "good projects have always gatekept". She adds: "There is this sense in the wider world that open source has always been a wild west, and that anybody can contribute – and that's just not the case."

Beyond that, she sees hope in models like the German Sovereign Tech Agency, which brings together dozens of maintainers into standards development. There are calls in the U.K. for a similar system, with a foundation in the model of the Linux Foundation, or China's OpenAtom, that brings together expertise at a national level to work on intellectual property (IP), managing GitHub repos, and other key elements, for public sector open source.

By professionalizing the industry, however, you run the risk of losing projects when things go wrong. CHAOSS, a Linux Foundation project that measures open source health, is an example of a project in dire straits, having just lost its funding. Former director of data science Dawn Foster left her role in March, and the project has returned to the community.

But, Brock says, "it's hard to reignite the volunteers" when they see funded people doing the work. "So it all has to be done in a very careful, measured, and joined-up way across borders," she explains.

When it comes to the future, Brock remains adamant that urgent action is needed or open source will be consigned to history. "We're already seeing eight companies controlling the AI landscape," she says.

"If we allow open source to fail, the only organizations in the world that will be able to manage that are some of those big tech ones that will already have it in place. So I don't think it's in the human and public interest to allow open source to fail."