What 50 open source projects taught GitHub about security in the AI era

GitHub's security analysis of 50 major open source projects finds that AI-assisted development has expanded the attack surface faster than governance has adapted—hallucinated dependencies, subtle logic errors, and signature mismatches are the three recurring patterns.

In plain terms: GitHub's Secure Open Source Fund helped 50 projects improve their security posture using a combination of AI-assisted workflows, tooling, expert guidance, and funding. The findings show what it actually takes to close the AI-era security gap in open source.

The fact

The GitHub Blog documents the outcomes of Session 4 of its Secure Open Source Fund, which supported 50 major open source projects. The program combined AI-assisted development workflows, maintainer expertise, GitHub security tools, and dedicated expert guidance. The report synthesizes what worked, what didn't, and what the shift toward AI-assisted development means for security practices in open source.

Our read

The context matters: these projects received structured support to address AI-era security challenges—hallucinated dependencies, supply chain gaps, and the breakdown of the traditional "human writes, human reviews" code review model that AI-assisted commits introduce. Projects that combined AI tooling with explicit security governance showed the best outcomes. The broader signal: ad hoc maintainer judgment is increasingly insufficient when AI generates significant commit volume. Formal AI contribution policies—like Rust-lang's, the first major language project to codify one—are becoming a baseline expectation for security-critical projects, not an edge case.

Watch for

Which security-critical projects (Linux kernel, OpenSSL, Node.js core) adopt explicit AI governance policies next—and whether GitHub's SOSF program expands to cover them in a future session.