Why open source faces its biggest security threat in 2026

OpenSSF CTO Christopher Robinson warned that open source is entering a high-risk period as AI speeds up package attacks, credential theft, fake contributor schemes, and low-quality code submissions.

He said volunteer maintainers may struggle to keep pace as attackers use AI to scale package poisoning, sock puppet accounts, and hallucinated exploit claims across ecosystems like NPM and the Linux kernel.

The warning comes amid rising concern after incidents such as XZ Utils, with leaders like Greg Kroah-Hartman highlighting how trust in open source can be abused.

Robinson also pointed to pressure from regulations like the EU Cyber Resilience Act, arguing that security expectations on maintainers are rising just as threats become harder to defend against.