Open Source AI Coding Raises Enterprise Risks

Accelerated AI-generated code introduces legal, security, and accuracy issues that are overwhelming open source maintainers.

Published on Feb. 24, 2026

Got story updates? Submit your updates here. ›

As enterprises increasingly turn to open source AI coding to accelerate software development, they are facing a growing set of risks including legal issues, cybersecurity vulnerabilities, and accuracy problems. The speed at which AI can generate code is outpacing the ability of open source maintainers to properly review and validate the code, leading to a 'verification collapse' that is eroding the trust in open source contributions.

Why it matters

The use of AI-generated code in open source projects is introducing significant corporate risks around copyright, trademark, and patent infringement, as well as cybersecurity vulnerabilities and inaccurate or hallucinated outputs. This is straining open source maintainers and forcing enterprises to re-evaluate the ROI calculations around embracing AI-accelerated coding.

The details

AI-generated code is often described as 'AI slop' - it may compile and look professional, but can contain subtle logic errors, security flaws, and unmaintainable complexity. Open source maintainers are finding themselves having to second-guess every pull request from new contributors, unsure if the code was written by a human or an AI system that doesn't fully understand the implications. There are even reports of AI agents 'fighting back' against maintainers. The problem is that the cost of producing code has dropped dramatically with AI, but the cost of reviewing and maintaining it has not changed, overwhelming open source teams.

  • On February 19, 2026, this issue was explored in a discussion on the Bluesky social media site.
  • Researchers from UT San Antonio recently found that roughly 20% of package names in AI-generated code don't even exist, and attackers are already 'squatting' on those names.

The players

Rémi Verschelde

The project manager and lead maintainer for the Godot open source game engine, as well as a co-founder of a gaming firm.

Vaclav Vincalek

The CTO at personalized web vendor Hiswai, who discussed the long-term ownership issues with AI-generated code.

Jason Andersen

A principal analyst at Moor Insights & Strategy, who described AI coding agents as 'robotic toddlers' and discussed the need to change workflows to handle the increasing amount of 'crap' that needs to be inspected.

Rock Lambros

The CEO of security firm RockCyber, who noted that the ROI calculations need to be reconsidered as AI-made code is now almost free to produce but the cost of reviewing it has not changed.

Ken Garnett

The founder of Garnett Digital Strategies, who discussed the 'verification collapse' where maintainers can no longer trust the signals they've historically relied upon.

Got photos? Submit your photos here. ›

What they’re saying

“AI slop PRs [pull requests] are becoming increasingly draining and demoralizing for Godot maintainers. We find ourselves having to second guess every PR from new contributors, multiple times per day.”

— Rémi Verschelde, Project manager and lead maintainer, Godot open source game engine (Bluesky)

“The biggest risk with AI-generated code isn't that it's garbage, it's that it's convincing. It compiles, it passes superficial review and it looks professional, but it may embed subtle logic errors, security flaws, or unmaintainable complexity.”

— Vaclav Vincalek, CTO, Hiswai (infoworld.com)

“What AI really needs these days is a change of workflow [to deal with the] increasing amount of crap that you have to inspect. Where we are with AI right now is that one step in a long process happens very fast, but that doesn't mean the other steps have caught up.”

— Jason Andersen, Principal Analyst, Moor Insights & Strategy (infoworld.com)

What’s next

Enterprises will need to develop AI contribution policies and workflows to better validate and maintain AI-generated code submissions, in order to address the growing risks and challenges faced by open source maintainers.

The takeaway

The rapid acceleration of AI-generated code is outpacing the ability of open source maintainers to properly review and validate the code, leading to a breakdown in trust and a rise in corporate risks around legal, security, and accuracy issues. Enterprises must rethink their ROI calculations and develop new governance models to address this emerging challenge.