This week the Linux Foundation's Open Source Security Foundation (OpenSSF) announced it would broaden its AI security resources, including a new guide to finding and fixing vulnerabilities using AI, "from preparing and sandboxing AI to validating, fixing, and preventing issues." The guide "stresses that AI-generated patches should never be trusted without automated tests and human review. An online course (LFD126) is planned for the coming months." OpenSSF also released the State of AI Impact on Software Security and Cybersecurity 2026 report (supported by OpenSSF, ActiveState and the Linux Foundation AI & Data Foundation). And it turns out the 2026 report "found a growing gap between the pace of AI-driven software development and organizations' ability to secure the code being produced." 58% of surveyed teams ship code faster than security reviews can keep up, while 60% say AI coding assistants have increased the number of external packages in their codebases. This data underscores the importance of trusted, reliable guidance as AI deployment continues to grow. Meanwhile the Linux Foundation announced at this week's Web Summit that it was releasing a new study on "how commercial open source companies generate revenue, convert users into customers and build their businesses," emphasizing the question's new relevance in the age of AI. "AI now writes code almost for free, and that raises a hard question for the whole software industry: if code costs next to nothing, where does the value of software lie?" Commercial open source [COSS] companies have been answering that question for more than 30 years. They have built large businesses on code they give away, which makes them a good guide to how software will make money in the age of AI... Seventy-two percent of respondents report a net positive impact from AI, against 8% negative. So far, the gains show up mostly inside companies. Internal productivity is the most cited benefit (73%), ahead of market expansion (46%) and new monetization opportunities (39%). AI roles are the only hiring category growing on net. COSS strategy is mostly unchanged by AI. But when companies do adapt, they are nearly twice as likely to open more of their core product rather than become more closed. When asked what sets them apart, 57% of companies name brand recognition and trust, well ahead of enterprise features, integrations and community size. They turn that trust into revenue through support and services (63%), managed cloud (49%) and open core (43%). Most combine these: 65% run two or more revenue models. Companies stack models as they grow, rather than switching between them: managed cloud rises from 35% of companies below $5 million ARR to 66% above $20 million. Venture-backed companies lean toward open core (53% vs. 38% for others). The report draws on a survey of 225 commercial open source founders and enterprise leaders (published by Linux Foundation Research in partnership with Serena, and with sponsorship from AWS, Red Hat, Futurewei and the Cloud Native Computing Foundation. And when it comes to open source, "over half of founders point to brand recognition and community trust as their greatest asset," said Chris Aniszczyk, CTO of the Cloud Native Computing Foundation. So "The findings from this year's report prove that AI isn't a threat to commercial open source software — it's an accelerating tailwind. With 72% of companies viewing AI as a net positive primarily driving internal productivity, the ecosystem is leaning further into collaboration." The Linux Foundation's announcement includes an interesting perspective from Matthieu Lavergne, partner at the venture capital company Serena. "Open source won the developer. Next, it will win the agent. The 225 founders we surveyed mostly see AI as a productivity gain today, but that's only the start: agents are set to become open source's largest users, and they choose what is open, proven and trusted. The founders who build and price for these new users will define the infrastructure of the AI era."

Read more of this story at Slashdot.