Open Source Software Trends

"Agentic Code Review" - The hard part of engineering isn't writing code anymore. Coding agents are extraordinarily good now and getting better fast. But the hard part of engineering has moved from writing code to deciding whether to trust it. Code review is the big bottleneck. My latest free deep-dive: https://lnkd.in/gSZqtKDP ✍ AI pushes raw output up by about 4x, but real productivity gains sit closer to 12%. The gap between those numbers is review work. Because we poured machine-speed output into a system built for human-speed work, the friction has moved downstream: - PRs merged with zero human review are up 31.3% - Median review duration is up 441.5% - The per-developer defect rate has jumped from 9% to 54% How you solve this depends entirely on your blast radius. A solo developer vibe-coding a side project and a team keeping a ten-year-old enterprise system alive share almost no constraints. To adapt, the rules of code review have to change: Tier by risk, not author: Spend scarce human attention only where being wrong is costly. A config change gets a linter; a payments path gets the full stack of tests, multiple AI reviewers, and human ownership. Embrace heterogeneous AI review: CodeRabbit, Greptile, Seer, and others all catch different classes of bugs. Run at least two with deliberately different characters. Keep humans on the loop: The volume ended the era of a human reading every single line. Instead, humans must own the accountability, the high-stakes gates, and the judgment of whether the change was the right thing to build in the first place. We made writing cheap, but understanding a system well enough to stand behind it remains the most durable and interesting skill in software. I mapped out exactly where the work has shifted in my latest write-up and hope you find it helpful. #ai #programming #softwareengineering

New research from Massachusetts Institute of Technology! The following is going to change in my opinion as more people and companies realize the advantages of open models: "Closed models dominate, with on average 80% of monthly LLM tokens using closed models despite much higher prices - on average 6x the price of open models - and only modest performance advantages. Frontier open models typically reach performance parity with frontier closed models within months, suggesting relatively fast convergence. Nevertheless, users continue to select closed models even when open alternatives are cheaper and offer superior performance. This systematic underutilization is economically significant: reallocating demand from observably dominated closed models to superior open models would reduce average prices by over 70% and, when extrapolated to the total market, generate an estimated $24.8 billion in additional consumer savings across 2025. These results suggest that closed model dominance reflects powerful drivers beyond model capabilities and price - whether switching costs, brand loyalty, or information frictions - with the economic magnitude of these hidden factors proving far larger than previously recognized, reframing open models as a largely latent, but high-potential, source of value in the AI economy."

The AI landscape is undergoing a fundamental shift, and it’s not the one you think. The competitive frontier isn’t only about building the largest proprietary models. There are two other major trends emerging that haven’t had enough discussion: Open source models have made tremendous strides, especially on cost relative to performance. Compact, fit-for-purpose models can meaningfully out-perform general purpose LLMs on specific tasks and do so at dramatically lower cost. Our Chief Technology Officer and AI team share how we are using open source AI models at Pinterest to achieve similar performance at less than 10% of the cost of leading, proprietary AI models. They also share how Pinterest has built in-house, fit-for-purpose models that are able to significantly outperform leading, proprietary general purpose models. The race to build the largest, most powerful models is profound and meaningful. If you want to see a thriving ecosystem of innovation in an AI-driven world, you should also want to see a thriving open source AI community that creates democratization and transparency. It’s a good thing for us all that open source is in the race. For our part, we’ll continue to share our findings in leveraging open source AI so that more companies and builders can benefit from the democratizing effect of open source AI. https://lnkd.in/gmT6UNXs

For the past two years, the AI-in-code narrative has been about creation: auto-complete, copilots, and agents that promise to ship apps in minutes. For the first time, the story is expanding to include repair. This week, Google DeepMind launched CodeMender, an autonomous AI agent that hunts down vulnerabilities, drafts patches, tests them, critiques itself, and submits fixes to open-source repos. In its early phase, CodeMender has upstreamed 72 security fixes - some in codebases spanning millions of lines, the kind of work that would take human teams months. In other words: we’re teaching machines not just to write, but to atone. Historically - by which I mean, like, last year - cybersecurity was a human sport: a contest of builders and breakers, patchers and penetrators. Now, both sides are automating. - Attackers fine-tune LLMs to find zero-days, turning them into exploit copilots. - Defenders deploy repair agents to find and fix them. The result is an arms race between autonomous systems, unfolding at speeds far beyond human review cycles. Imagine the future: bugs and fixes flying past each other in the night, too fast for any human to follow. Security as algorithmic speed chess. And that sets up the deeper question CodeMender raises: What happens when software starts fixing itself? If an AI can autonomously detect and patch vulnerabilities, we edge toward self-healing infrastructure. But autonomy introduces new fragilities: ▪️ Adversarial corruption. An attacker could poison the model’s feedback loop, tricking its “critique agents” into approving malicious code. The line between “defender” and “attack surface” is one bad update away. ▪️Human deskilling: Overreliance breeds amnesia: “It’s fine, CodeMender will fix it” is a dangerous cultural default. ▪️Accountability black holes: If an AI-generated patch breaks production or causes a breach, who holds the bag - the developer, the model, or Google? Your Chief Risk Officer wants to know. And yet, doing nothing isn’t safer. We are already drowning in insecure code - much of it written by humans on deadlines and LLMs on vibes. The attack surface has outgrown human capacity to defend it. CodeMender represents more than automated patching. It’s a prototype for reflexive software - systems that monitor and adapt their own health. It works 2 ways: → Reactively, patching known vulnerabilities before they’re exploited. → Proactively, refactoring brittle code to eliminate entire classes of vulnerabilities before they occur. That’s not just “AI for cybersecurity.” That’s AI as immune system - a distributed intelligence layer quietly testing, healing, and hardening the world’s codebase. Autonomy in generation led us to creation at scale. Autonomy in repair might just lead us to resilience at scale. In an age where more software is written by models than by people, self-healing becomes survival - the only way to keep the lights on in a digital world built faster than it can be understood.

Two years ago, AI development was dominated by closed systems; accessible to few, shaped by fewer. Today, that has changed. Open source AI is leading the conversation. More than a million new repositories have appeared on Hugging Face in just 90 days. NVIDIA now leads global contributions with projects like Nemotron and BioNeMo, while Alibaba’s Qwen and DeepSeek show how quickly open collaboration can scale across borders. Europe remains active through Mistral and Stability AI, yet much of the real progress comes from thousands of smaller teams fine-tuning models and sharing datasets, quietly shaping the future of intelligence. The next era of AI won’t be defined by competition behind closed doors, but by collective progress, openness, and shared understanding. You can read more here: https://lnkd.in/dVF2ujzx #opensource #innovation #artificialintelligence #technology #programming Image source: Hugging Face I partnered with NVIDIA to bring you this post.

Your AI agent just pushed 47 security patches. How many did you actually review? Google DeepMind launched CodeMender last month. OpenAI followed with Aardvark. Both promise to identify and fix vulnerabilities autonomously. There are key architectural differences between the two. CodeMender combines static analysis, fuzzing, SMT solvers, and LLM reasoning. It validates fixes through differential testing before any human sees them. DeepMind reports 72 accepted patches across open-source projects. Aardvark takes a different path. It's LLM-first. The agent threat-models your repo, scans commits, validates exploitability in a sandbox, then generates patches. OpenAI claims 92% recall on test repos and 10 disclosed CVEs. Both sound great until you think about what they're actually doing. These agents write code probabilistically. They generate fixes based on learned patterns, not deterministic logic. You get speed. You get coverage. But you also get vibe coding at scale. Anyone who's ever vibe-coded knows that new bugs often emerge, or previously fixed bugs often magically reappear when you use AI to fix errors in the code. And they aren't always obvious. It's subtle logic errors that pass your CI because the agent wrote tests that match its own flawed assumptions. It's the gap between "this looks right" and "this is provably right." Program analysis can verify properties. Fuzzing can stress edge cases. But an LLM? It's guessing with high confidence. CodeMender layers validation on top of generation. That's better. But both tools still rely on probabilistic code synthesis, and both require human review as the last line of defense. Humans can't keep pace with autonomous agents. Not at scale. You want deterministic verification for code that patches security vulnerabilities. Anything less adds more security debt to the pile. The question isn't whether these tools are useful. They are. The question is whether your organization has the testing rigor to catch what they miss. Do you trust probabilistic code generation to patch your production vulnerabilities? 👉 Follow for more AI and cybersecurity insights with the occasional rant #AIgovernance #cybersecurity #AppSec #VibeCoding

For years, the open-source community has challenged the closed-source dominance of players. Today, OpenAI has released gpt-oss-120b and gpt-oss-20b, two new open-weight reasoning models. This is a monumental shift, and here’s why it's a game-changer for the entire industry: -Open License: These models come with a permissive Apache 2.0 license, allowing for free commercial use without restrictions—a direct response to developer demand for freedom. -Agentic Power: Built for advanced agentic tasks like tool use and code execution, they're not just powerful but practical for real-world applications. -Deep Customization: They support full-parameter fine-tuning, giving developers unprecedented control to adapt the models to any use case. -Unprecedented Transparency: For the first time, you get full access to the chain-of-thought for easier debugging and higher trust in model outputs. OpenAI's entry into the open-weight space is a major catalyst for the entire AI ecosystem, promising to - Accelerate Competition: This forces all players to innovate faster, release better models, and offer more compelling features to attract developers. The competition drives rapid improvement across the board. - Democratisation of AI: The availability of powerful, open-weight models lowers the barrier to entry for developers and startups. They no longer need multi-billion dollar budgets to access advanced AI capabilities. This enables a wider range of individuals and small teams to experiment, build, and deploy AI solutions, leading to a much larger pool of innovators. -Rapid Customization and Specialization: Open-weight models are perfect for fine-tuning with specific data. Developers can take a strong base model like gpt-oss-20b and specialize it for a niche industry, a company's internal knowledge base, or a unique application. This speeds up the development cycle for tailored AI solutions that were previously too expensive or complex to build. -Community-Driven Development: The principles of open source mean that a global community can now inspect, debug, and improve these models. The LLM market is projected to be worth over $80 billion by 2033, and the fight for developer mindshare is at its core. In essence, this movement can act as a catalyst for the AI landscape to a decentralized ecosystem where innovation can flourish at all levels. 👇 Try them here: - Blog: https://lnkd.in/g4kprY4v - GitHub: https://lnkd.in/gHf2M3mV - Hugging Face: https://lnkd.in/gWESjjDt - Try the models : https://www.gpt-oss.com/ What does this mean for other open models? Let's discuss! 👇

In 2026, a fast-growing GitHub repo can tell you more than a pitch deck. Not always, of course. Stars are not ARR. But in AI, devtools and infrastructure, open source momentum is becoming hard to ignore. Every day on X, founders are sharing repos for agents, coding tools, AI infrastructure, browsers, memory layers, model tooling and developer workflows. Some get ignored. Others attract thousands of stars, contributors, forks, issues and integrations before the company has a polished landing page. That’s the interesting shift. Open source is no longer just a development philosophy. For many startups, it is becoming a go-to-market motion. It gives founders: - distribution before a sales team - feedback before enterprise pilots - credibility before brand - recruiting leverage before scale - community before paid marketing But it also comes with real risks: questions monetization, cloud capture, forks, license tension and security vulnerabilities, especially in agentic software where plugins and permissions can become attack surfaces. I wrote about why founders are embracing open source again, what early-stage investors should look for, and why the GitHub repo may be the new pitch deck in some categories. Link in comments.

Have Open Source LLMs finally caught up with Private LLMs? Historically, Open Source Performance lagged Private Models by 6-12 months. However, Llama 3.1 has narrowed the gap even further. 🚀 As Foundation Models evolve, the gap between open-source models like Llama 3.1 and closed-source models like ChatGPT-4 is shrinking. Chamath Palihapitiya said it best: "Foundation models will have no economic value; they will be broadly available and entirely free." 🌐 Here’s what I believe: The real moat in AI will shift away from proprietary models. Why? Open-source models like Mistral and Llama, trained on open data, are eroding the dominance of proprietary models. The focus is moving towards usability.🔍 True defensibility in AI will come from: - User experience - Brand - Rich feature sets Most users prioritize ease of use and value over model accuracy and benchmarks. Companies are shifting to enable "Outcomes" for end users, paving the way for "Services as a Software." 📈 That's why: - Anthropic hired Instagram's co-founder Mike Krieger as their CPO to enhance user experience. Take Midjourney: It leads in Image Model-as-a-Service due to its image quality, not just model performance. Even Apple is connecting with other LLMs instead of building their own, integrating these features seamlessly into their products. The landscape is changing. How will your strategy adapt? 💡 #AI #OpenSource #MachineLearning #UserExperience #TechInnovation #AITrends #FoundationModels #BusinessStrategy #DigitalTransformation #FutureOfTech