What Happened to Open Source Software?

Open Source Software (OSS) traces its roots back to the early days of computing in the 1950s and 60s, when software was freely shared among academics and researchers, often bundled with hardware purchases. This collaborative spirit began to wane in the 1970s as software became commercialized and proprietary models emerged, with legal decisions granting copyright protection to software code.

The modern open source movement was formally ignited in 1983 when Richard Stallman launched the GNU Project, aiming to create a free operating system and advocating for software freedom. This led to the establishment of the Free Software Foundation (FSF) in 1985 and the development of the GNU General Public License (GPL), which ensured software could be freely used, modified, and distributed. A pivotal moment arrived in 1991 with Linus Torvalds' creation of the Linux kernel, which, combined with GNU tools, demonstrated the immense power of community-driven development. The term "open source" itself was coined in 1998, leading to the formation of the Open Source Initiative (OSI) to promote its pragmatic benefits.

By the late 1990s and early 2000s, open source entered a phase of professionalization and commercialization, with companies like Red Hat demonstrating viable business models around Linux distributions. Major tech companies, including Google, Microsoft, and IBM, increasingly adopted and contributed to open source projects, solidifying its mainstream presence. Platforms like GitHub and GitLab further democratized collaboration, making OSS ubiquitous across internet infrastructure, programming languages, and even hardware projects like Arduino.

As of 2026, open source software is an indispensable component of the global digital infrastructure. An estimated 96% of commercial codebases incorporate open source components, with 70-90% of the code in an average software project being open source. The open source software market is experiencing rapid growth, valued at $56.57 billion in 2026 and projected to reach $95.38 billion by 2030. The open source services market alone is projected to grow from $48.53 billion in 2026 to $182.41 billion by 2034. Key drivers for this continued adoption include cost reduction, avoiding vendor lock-in, and leveraging open standards and community support.

However, this widespread adoption has brought significant challenges, particularly in security and governance. The 2026 "Open Source Security and Risk Analysis" (OSSRA) report revealed a staggering 107% increase in the mean number of vulnerabilities per codebase year-over-year, largely attributed to the increased use of AI coding assistants. AI, while accelerating development and vulnerability discovery, has also led to an "explosion" of AI-generated vulnerability reports, overwhelming maintainers and creating a new bottleneck in triage and remediation. Supply chain security has become a paramount concern, with incidents in 2025 exploiting trust and compromised maintainer accounts.

Regulatory pressures are also intensifying. The EU's Cyber Resilience Act (CRA), effective in 2026, mandates explicit proof of security and patch management for open source components, requiring companies to disclose licenses and systematically rectify vulnerabilities. This has shifted the focus from mere visibility to "agentic governance" in software supply chain security, where AI agents are primary actors. In response, the open source community is adapting by developing AI policies, promoting "ethically trained" AI models, and maturing attribution and disclosure standards for AI-generated code. Initiatives like the Apache Software Foundation's Responsible AI Initiative, launched in FY2026, aim to strengthen open source technologies and governance practices for AI and machine learning. The industry is also seeing a reinvestment in open source infrastructure and sustainability initiatives to manage aging projects and ensure long-term viability.