AI Is reshaping open source software and straining the systems that sustain it - EurekAlert!

Open source software underpins much of the modern digital world, from mobile phones and automobiles to cloud computing and artificial intelligence. Now, the rapid adoption of AI is creating new opportunities to improve that software while placing growing pressure on the people responsible for maintaining and securing it, according to a new TechBrief from the Association for Computing Machinery’s Technology Policy Council (TPC).

“TechBrief: Artificial Intelligence’s Effects on Open Source TechBrief,” examines how increasingly capable AI systems are changing the open source software (OSS) ecosystem. The authors note that AI can help identify vulnerabilities, develop patches, and accelerate software development. At the same time, those same capabilities can be used by attackers while the growing volume of AI-generated code is rapidly increasing the demands placed on project maintainers.

The economic stakes are enormous. Research cited in the TechBrief estimates that firms would spend 3.5x more on software if OSS did not exist, and puts the demand-side value of open source software to firms worldwide at $8.8 trillion.

“Open source has always depended on more than the ability to write code,” said Simson Garfinkel, Chief Scientist at BasisTech and Chair of the ACM TechBriefs Committee. “Successful projects require people to set priorities, evaluate contributions, make governance decisions, and build consensus around the needs of their communities. AI can dramatically accelerate technical work, but those decisions still require human judgment—at least for now.”

The TechBrief highlights several challenges facing the open source ecosystem as AI capabilities advance:

- Cybersecurity: AI creates new opportunities to identify and patch vulnerabilities, while also providing malicious actors with increasingly powerful tools to develop their attacks. OSS is widely used, so hidden vulnerabilities that are suddenly discovered can have a disproportionate impact.

- Software maintenance: AI coding tools are rapidly increasing the volume of contributions to open source projects, leaving maintainers responsible for determining which proposed changes should become part of trusted releases.

- Long-term sustainability: Many open source projects that generate significant value lack reliable revenue streams for continued development and support. Sustaining production-ready software also requires resources for work beyond coding, including project management, documentation, usability, recruitment, and community building.

- The open source knowledge gap: Organizations often lack operational awareness about the governance, maintenance, and cybersecurity properties of the OSS they use, making it difficult to identify critical dependencies before failures occur.

The TechBrief also identifies areas that warrant greater attention as organizations respond to these challenges, including:

- Expanding the use of software bills of materials (SBOMs) to help organizations identify the open source components and dependencies within their software

- Mapping and actively governing organizational use of OSS to improve cybersecurity and ongoing maintenance

- Devoting greater resources to project management activities that AI cannot replace, including documentation, packaging, usability, fundraising, recruitment, and onboarding

- Addressing the long-term sustainability and financial support of open source projects that organizations and governments depend on

Read the full TechBrief here.

ACM’s TechBriefs are designed to complement ACM’s activities in the policy arena and to inform policymakers, the public, and others about the nature and implications of information technologies. Earlier ACM TechBriefs have covered topics such as vibe coding, buying vs building LLMs, automated speech recognition, governmental digital transformation, accessibility, and generative artificial intelligence, among others.

About the ACM Technology Policy Council

ACM’s global Technology Policy Council sets the agenda for global initiatives to address evolving technology policy issues and coordinates the activities of ACM’s regional technology policy committees in the US and Europe. It serves as the central convening point for ACM’s interactions with government organizations, the computing community, and the public in all matters of public policy related to computing and information technology. The Council’s members are drawn from ACM’s global membership.

About ACM

ACM, the Association for Computing Machinery, is the world’s largest educational and scientific computing society, uniting computing educators, researchers, and professionals to inspire dialogue, share resources, and address the field’s challenges. ACM strengthens the computing profession’s collective voice through strong leadership, promotion of the highest standards, and recognition of technical excellence. ACM supports the professional growth of its members by providing opportunities for life-long learning, career development, and professional networking.