Open Source in the age of AI

Who's talking

Bradley Leonard
/ Technickel

Senior Full Stack Developer, Triplelift
AI Wrangler
3D Printing Enthusiast

10+years of
Open Source

Agenda

Today's plan

~/open-source-ai

$ ls agenda/
01_the_what.md     # what is Open Source, and its licenses
02_my_origin.md    # how Hacktoberfest inspired me
03_the_now.md      # why it matters more than ever
04_the_how.md      # making your first contribution
05_the_ai.md       # contributing in the age of AI
06_show/           # real contributions
07_and_tell/       # live walkthrough

The basics

What is Open Source?

Software whose source code is public, shared under a license that lets anyone use it.

Read it

The code is public

Anyone can see how it works, learn from it and check what it does.

Change it

Anyone can improve it

Fix a bug, add a feature or improve the docs, then send it back to the project.

Share it

The license says you can

Use it, fork it and build on it, within the terms of its license.

The basics

Open Source runs on licenses

A few examples

MITBSDApache 2.0LGPLGPLAGPLBSLSSPLElastic

PermissiveCopyleftSource-available · not open source

MITApache 2.0GPLAGPL

Use it in a product✓✓✓✓

Change it✓✓✓✓

Ship your changes closed✓✓✕✕

Run it as a web service, keep changes private✓✓✓✕

🔒

No license

Looks open, isn't

Check the license before you use or contribute to any project.

Quick tour, not legal advice. The bar runs from permissive licenses (MIT, BSD, Apache 2.0), which let you do almost anything with a notice, to copyleft licenses (LGPL, GPL, AGPL), which require derived work you distribute to stay open under the same terms. The grid shows what each lets you do: all four allow commercial use and changes; MIT and Apache let you ship changes closed; GPL and AGPL do not; only the AGPL also counts offering it as a network service as distribution. Apache 2.0 also grants patent rights. The red end of the bar is the copyleft licenses; past it, the dark end holds source-available licenses (BSL, SSPL, Elastic), where you can read the code but the license restricts what you do with it, so they are not open source by the usual definition. Code with no license is not open source either: the author keeps all rights. For anything at work, check with Legal.

Where this started

Hacktoberfest brought
Open Source to the masses

2014
Four PRs, one t-shirt

DigitalOcean launches Hacktoberfest: open four pull requests in October and earn a shirt.
2015–25
The on-ramp, then the flood

Thousands make a first contribution. Then maintainers drown in low-effort PRs, now easier than ever to generate with AI.
2026
The scoreboard goes away

MLH and DEV take over, and pull requests no longer count toward rewards.

Beyond Hacktoberfest

Two versions of the same year

What it looked like

Open Source happens in October

What it really is

Open Source happens all year

The now

Nothing has changed,
everything is different

Thriving as ever, but with new pressures.

A few examples

Linux

Runs everything

The cloud, Android phones and your broken CI/CD pipeline.

Your daily tools

Built on Open Source

Git, Python, React, Node.js, PostgreSQL and curl.

The AI stack

Open Source underneath

PyTorch, Hugging Face Transformers and open-weight models.

It all leans on a complex ecosystem of projects and a few underappreciated maintainers.

xkcd.com/2347 · Randall Munroe · CC BY-NC 2.5 · animated

The now

Why do Open Source?

It builds character.

Dungeons & Devs

ContributorCharacter name

Open Source Dev 12Class & level

SageBackground

Chaotic GoodAlignment

Strength

+2

Dexterity

+2

Constitution

+1

Intelligence

+4

Wisdom

+3

Charisma

+3

+3Proficiency bonus

Skills

Reading code
Reading docs
Code review
Debugging
Writing tests
Git
Communication
Teamwork
Patience
Naming things

15Armor class

+2Initiative

30 ftSpeed

∞Hit points

Features & Traits

LearnRead the Source. Study real production code and get reviewed by the people who built it.
GrowProof of Work. Every merged PR is public, so anyone can see what you can actually do.
ShapeFix It Yourself. Annoyed by a tool you rely on? Change it, for yourself and everyone else.
BelongJoin the Party. Mentors, collaborators and a community that wants your contribution.

Git searching

Where to look for repos?

Ask AI

"Find beginner-friendly issues in tools I already use."

Look around

Pull inspiration from your work, your stack, your browser tabs.

Making a change

Six steps to your first PR

01Find an issue + communicateRead the rules. CONTRIBUTING.md, and the project's AI policy if it has one.
Talk first. Comment on the issue before you open a PR.
02Fork the repoYour own copy to experiment in.
03Clone it with Gitgit clone https://github.com/<you>/<repo>.git
04Make the changesTest it. Run the project's tests and try your change.
Keep it focused. Split unrelated changes into separate PRs, or stack them if one builds on another.
05Stage, commit + pushGit basics in 10 minutes (freeCodeCamp)
06Open the pull request!Say what changed. Link the issue it closes.
Quality over quantity. One thoughtful PR beats ten drive-bys. Disclose AI help when asked.

~/low-poly

$ git checkout -b better-readme
$ git add README.md
$ git commit -m "More descriptive README"
$ git push origin better-readme

Contributing in the age of AI

Own your AI output

If you don't know what it's doing, don't contribute the change. Don't be a MEAT proxy. 🥩

It looks bad on you

A PR you can't explain costs you trust.

It makes the maintainer's life harder

They review, debug and fix what you couldn't.

Prompts that help you understand

>"Walk me through this diff line by line, like I'm new to this codebase."
>"What could this change break? List the edge cases and risks."
>"What would a maintainer push back on, given CONTRIBUTING.md and the code style?"
>"Explain how X works and why you did it that way instead of the alternatives."

Contributing in the age of AI

Prove it works

What reviewers like to see · and let AI automate the proof

Tests
Show it passes
Screenshots
Show the result
Short recordings
Show it moving
Before / after
Show what changed

Proof helps the review. It never replaces understanding the change.

A pull request form with a one-line description — Without proof

A pull request form with a structured description and a screenshot — With proof

The AI

AI is at the gates

🤖🤖🤖 → 🏰CODE CASTLE · open to contribution → closed

Projects raising walls

GodotBANNED

AI agents out; code must be human-written

tldrawPRs CLOSED

Stopped taking outside pull requests

curlBOUNTY ENDED

Dropped its bug bounty; about 1 in 5 reports was AI slop

QEMUBANNED

Declines code that includes or derives from AI output

ZigBANNED

Strict no-LLM policy: no AI-generated code or prose

Vol. 2026 · No. 42Late EditionPrice: one patch

The Open Source Gazette

Friday, October 30, 2026All the news that's fit to patchSpecial AI Security Supplement

Bulletin

PHP Cracked Open! AI-Found Flaws Hit Millions of Sites

"PHP2Shell" · CVE-2026-109618 and CVE-2026-109619 · severity 9.2

Two critical remote-code-execution bugs in PHP core, found by Wiz Research with help from frontier AI models, reach nearly every PHP version back to 5.4, the language Wiz says powers 70% of websites. Reported in August and patched on October 21 (8.5.12, 8.4.27, 8.3.36, 8.2.35), they are already being used against exposed PAN-OS management interfaces. Palo Alto counts over 22 million potentially vulnerable instances.

Source: Wiz Research and Palo Alto Unit 42

Extra! Extra!

AI Gateway Seized by Attackers!

LiteLLM · CVE-2026-42271 · on CISA's exploited list

A command-injection hole in a popular open source AI gateway let anyone with an API key run commands on the host. Chained with a Host-header bug, no key was needed. CISA listed it on June 8, five weeks after the fix. Attackers planted web shells and lifted credentials.

Source: Cloud Security Alliance and CISA KEV

Squeezed Shut

Brotli2Shell: Unzipping Data Can Hand Over the Server

CVE-2026-111497 · also "HTTP2Shell" · severity 9.2

A memory-writing bug in Google's Brotli decoder lets crafted compressed data take over any program that unpacks it, and Node.js, Python packages, .NET, Bun and Envoy all bundle it. Patches shipped October 21, and CISA put it on its exploited list on October 27.

Source: BleepingComputer and Cynet

The moral: AI now finds bugs faster than ever, and so do attackers. Patch fast, sandbox what you run, and read the advisories.

The recent run of AI-related CVEs, framed as breaking news. Lead story: PHP2Shell, two critical PHP RCEs (CVE-2026-109618 and -109619) that Wiz Research found with frontier AI models, reported in August and patched October 21; Palo Alto Unit 42 reports active exploitation against exposed PAN-OS management interfaces and counts over 22 million potentially vulnerable instances. LiteLLM CVE-2026-42271 was added to CISA's known-exploited list on June 8. Brotli2Shell (also called HTTP2Shell, CVE-2026-111497) is a critical out-of-bounds write in Google's Brotli decoder, patched October 21 and added to CISA's exploited list on October 27; it reaches Node.js, Python packages, .NET, Bun and Envoy. The point: it is ordinary software with ordinary bugs, but AI is speeding up both finding and exploiting them. Verify details against the primary advisories before quoting.

But it also opens the doors · 1 of 4

Dev setup in minutes

$ get it running

read README + CONTRIBUTING
install dependencies
build it
run the tests

● ready · localhost:3000

Get it running

Prompts to get up and running

>"Read the README and CONTRIBUTING.md. Install it, build it and run the tests for me."
>"I'm on macOS with Node 22. What's missing, and how do I fix it?"
>"The build fails with this error. What's wrong, and what do I run next?"
>"Which tests should I run for the files I'm changing?"

Let AI do the setup, and spend your time on the change.

But it also opens the doors · 2 of 4

Understand any repo

flowchart LR

Read the code

Prompts to understand the architecture

>"Give me a map of this repo: the main modules, the entry points and how they connect."
>"Trace what happens when a user does X, from the first call to the last."
>"Where would I change Y, and what else does that touch?"
>"Draw it as a Mermaid diagram."

A picture of the code is the fastest way to find your way around it.

But it also opens the doors · 3 of 4

Read the history

git blame

Read the history

Prompts to learn why it's this way

>"Run git blame on this function and summarise why each part changed."
>"Find the PR and issue that introduced this line, and explain the reasoning."
>"Has this been tried and reverted before? Check git log and closed PRs."
>"Summarise this issue thread: decisions, objections and open questions."

Every odd line has a reason. The history usually knows it.

But it also opens the doors · 4 of 4

Debug with the logs

$ tail -f app.log

12:00:02DEBUGcache hit user:42
12:00:04INFOworker 3 idle
12:00:05INFOGET /api/users 200 12ms
12:00:08INFOGET /api/users 200 12ms
12:00:10DEBUGretry 1/3 webhook
12:00:11INFOGET /health 200 1ms
12:00:12INFOserver started on :3000
12:00:13WARNslow query 312ms
12:00:15INFOGET /api/users 200 12ms
12:00:16INFOGET /api/users 200 12ms
12:00:19WARNslow query 312ms
12:00:20DEBUGtoken validated
12:00:23INFOGET /api/users 200 12ms
12:00:24INFOworker 3 idle
12:00:27DEBUGretry 1/3 webhook
12:00:28DEBUGretry 1/3 webhook
12:00:31WARNslow query 312ms
12:00:32INFOjob queued sync-repos
12:00:33INFOGET /health 200 1ms
12:00:34DEBUGconfig loaded
12:00:36DEBUGcache hit user:42
12:00:39INFOGET /api/users 200 12ms
12:00:42DEBUGconfig loaded
12:00:45DEBUGtoken validated
12:00:48DEBUGcache hit user:42
12:00:49DEBUGretry 1/3 webhook
12:00:52INFOworker 3 idle
12:00:53INFOPOST /api/login 200 48ms
12:00:54INFOGET /health 200 1ms
12:00:57INFOGET /api/users 200 12ms
12:01:00INFOserver started on :3000
12:01:03INFOjob queued sync-repos
12:01:05INFOworker 3 idle
12:01:08WARNslow query 312ms
12:01:10DEBUGsession refreshed
12:01:13DEBUGsession refreshed
12:01:15DEBUGconfig loaded
12:01:16INFOGET /api/repos 200 21ms
12:01:17WARNdeprecated option "legacy"
12:01:18INFOGET /api/users 200 12ms
12:01:21DEBUGconfig loaded
12:01:24DEBUGsession refreshed
12:01:26WARNdeprecated option "legacy"
12:01:28DEBUGconfig loaded
12:01:31INFOGET /api/users 200 12ms
12:01:32INFOGET /health 200 1ms
12:01:34DEBUGcache hit user:42
12:01:36DEBUGcache hit user:42
12:01:38WARNslow query 312ms
12:01:39INFOworker 3 idle
12:01:40INFOGET /api/repos 200 21ms
12:01:43DEBUGretry 1/3 webhook
12:01:45INFOPOST /api/login 200 48ms
12:01:48INFOPOST /api/login 200 48ms
12:01:51DEBUGsession refreshed
12:01:54WARNempty Authorization header
12:01:56ERRORnull token (auth.ts:42)
12:01:57ERROR at check (auth.ts:42)
12:01:58DEBUGconfig loaded
12:02:00WARNdeprecated option "legacy"
12:02:03INFOGET /api/users 200 12ms
12:02:04WARNdeprecated option "legacy"
12:02:07DEBUGconfig loaded
12:02:10DEBUGretry 1/3 webhook
12:02:13DEBUGtoken validated
12:02:15DEBUGconfig loaded
12:02:18WARNslow query 312ms
12:02:21INFOPOST /api/login 200 48ms
12:02:22DEBUGsession refreshed
12:02:24DEBUGcache hit user:42
12:02:27INFOGET /api/users 200 12ms
12:02:29INFOserver started on :3000
12:02:30INFOGET /api/repos 200 21ms
12:02:32DEBUGcache hit user:42
12:02:35INFOjob queued sync-repos
12:02:37WARNslow query 312ms
12:02:39INFOGET /api/users 200 12ms
12:02:40DEBUGsession refreshed
12:02:42INFOGET /health 200 1ms
12:02:44DEBUGcache hit user:42
12:02:46DEBUGtoken validated
12:02:49DEBUGconfig loaded
12:02:52WARNslow query 312ms
12:02:54INFOworker 3 idle

◀◀ rewind

Read the logs

root cause

Prompts to debug with an agent

>"Here are the logs and the stack trace. What's the root cause?"
>"Find the first error in these logs and explain what led up to it."
>"Reproduce this bug locally and tell me which line to fix."
>"Compare the logs from a good run and a failing run. What's different?"

Let an agent dig through the logs, then check its answer yourself.

Contributing in the age of AI

The AI development life cycle

Agents

Subagents

Loops

Software factories

Spec-driven

Skills

MCP

Whatever's next

Same workflow, different fit

Your projectExactly how you want

Your teamNeeds a nudge

Open sourceSquare hole

The AI industry has a name for every piece of the AI development lifecycle: agents, loops, software factories, spec-driven development, skills, MCP, context engineering, subagents, harnesses, evals. Most were made for someone's own workflow. In your own project you can adopt them as they are. In a team you adapt to shared conventions. In someone else's open source project you are at the ground floor of their process, so you shoehorn your workflow into how they do things: their CONTRIBUTING.md, their review habits, their AI policy. Think of a toddler's shape sorter, and the square hole meme: in your own project every shape drops into its own hole, in a team one needs a nudge, and in someone else's project everything goes through the one hole their process allows. Take the idea, not the whole machine.

My past contributions

Pets to boost productivity

VS Code Pets

Interactive pets of many kinds in your editor.

My contributions

New pet names
Code refactor
Pet name tags (not merged)

github.com/tonybaloney/vscode-pets

Podcast website

Syntax FM

Syntax is a podcast about web development.

My contributions

Added episode metadata

github.com/syntaxfm/website

3D / AR web component

<model-viewer>

Google's web component for interactive 3D models, optionally in AR.

My contributions

Better link previews (Open Graph metadata)
AR button accessibility

github.com/google/model-viewer

React to AR and VR

React XR

React components and hooks for AR/VR apps with @react-three/fiber.

My contributions

AR hit testing

github.com/pmndrs/react-xr

Have Twitch help you code

Twitch Highlighter

Lets Twitch chat highlight lines and leave comments in VS Code.

My contributions

Moved tests to @vscode/test-electron
TSLint → ESLint (not merged)

github.com/clarkio/vscode-twitch-highlighter

Even music can be Open Source

Shuttle (archived)

An Open Source local music player for Android.

My contributions

Icon active visibility
Shake to shuffle (not merged)

github.com/timusus/Shuttle

Start your own!

Low Poly

React + WASM site that generates low-poly-style digital art.

My contributions

I AM the maintainer

github.com/Technickel-Dev/low-poly

CNC control software

gSender

CNC machine control software from Sienci Labs.

My contributions

Configurable toast duration
Proposed script access
Reported a leaked API key

github.com/Sienci-Labs/gsender

The browser engine

Chromium

The open source browser project behind Chrome, Edge and more.

My contributions

Found the root cause of multiple almost-teenage bugs

chromium.org

Open Sourcein the age of AI

HEY ME,REMEMBER TO RECORD :)

Bradley Leonard/ Technickel

Today's plan

> What is Open Source?

What is Open Source?

The code is public

Anyone can improve it

The license says you can

Open Source runs on licenses

Looks open, isn't

> My origin

Hacktoberfest broughtOpen Source to the masses

Four PRs, one t-shirt

The on-ramp, then the flood

The scoreboard goes away

Two versions of the same year

Open Source happens in October

Open Source happens all year

> The now

Nothing has changed,everything is different

Runs everything

Built on Open Source

Open Source underneath

Why do Open Source?

> The how

Where to look for repos?

Ask AI

Look around

> But for reals, how?

Six steps to your first PR

> The AI

Own your AI output

It looks bad on you

It makes the maintainer's life harder

Prove it works

Tests

Screenshots

Short recordings

Before / after

AI is at the gates

PHP Cracked Open! AI-Found Flaws Hit Millions of Sites

AI Gateway Seized by Attackers!

Brotli2Shell: Unzipping Data Can Hand Over the Server

Dev setup in minutes

Understand any repo

Read the history

Debug with the logs

The AI development life cycle

> Show and tell

VS Code Pets

My contributions

Syntax FM

My contributions

<model-viewer>

My contributions

React XR

My contributions

Twitch Highlighter

My contributions

Shuttle (archived)

My contributions

Low Poly

My contributions

gSender

My contributions

Chromium

My contributions

> Live walkthrough

Questions?

Happy hacking!

Open Source
in the age of AI

HEY ME,
REMEMBER TO RECORD :)

Bradley Leonard
/ Technickel

Hacktoberfest brought
Open Source to the masses

Nothing has changed,
everything is different