Why AI is making open source less open

For twenty years, when a company closed its source code, the reason was money. A cloud provider was reselling their product, so they changed the license. In 2026 the reason changed. Companies now close their code because AI can read it faster than they can fix it.

I don't think open source is dying. But I do think it is becoming conditional: released later, released smaller, or released only after someone has checked what an attacker could do with it.

What changed in 2026?

In April 2026, the scheduling company Cal.com moved its core product to closed source. Its post was unusually direct: "there's one simple reason: security." The argument fits in one sentence from the same post: "Today, AI can be pointed at an open source codebase and systematically scan it for vulnerabilities." Cal.com called being open source "increasingly like giving attackers the blueprints to the vault", and released an older version of its code under the MIT license as Cal.diy for hobbyists and self-hosters.

Two months later, in June 2026, Daytona followed with almost the same words: "There is one reason behind this, and it is the only reason that matters to us: security." Daytona builds sandboxes for running AI-generated code. Publishing how its isolation works, it wrote, means "handing the exact blueprint of that boundary to anyone who wants to test it."

Two companies are not a trend yet. What makes them interesting is that both gave the same reason, and neither gave a business one.

Why does AI change the math?

Finding a security bug used to be slow, skilled work. That is what kept a lot of public code safe in practice: it was open, but nobody had the time to read all of it.

That cost is collapsing. In April 2026, Anthropic announced Project Glasswing and said its Claude Mythos Preview model had found a 27-year-old bug in OpenBSD and a 16-year-old bug in FFmpeg, in code that automated testing tools had already hit millions of times. By May, the project had scanned more than 1,000 open-source projects and produced 23,019 findings, about 6,202 of them estimated as high or critical. Anthropic also wrote that maintainers face "a deluge of low-quality, AI-generated bug reports" and that several are "severely capacity constrained."

The curl project had already felt this. In January 2026 it announced the end of its bug bounty, because AI-written reports were burying the real ones.

So the asymmetry looks like this: finding bugs is now cheap and fast, fixing them is still slow and human. If you are a company with customer data and a small team, publishing your code makes you the easiest target to scan.

Isn't this just business dressed up as security?

Partly, and it's worth being precise here. The well-known license changes of the last few years were about business, not security:

• Elastic changed its license in January 2021 and added AGPL back in August 2024.
• HashiCorp moved Terraform and its other products to the Business Source License in August 2023.
• Redis changed its license in March 2024 and added AGPL back with Redis 8 in May 2025.

All three were about stopping cloud providers from reselling free software. Discourse's co-founder Sam Saffron hinted at this in his response to Cal.com: some closures may be business decisions with a security label on them.

That is a fair suspicion. But even if you discount it, something new is happening: in 2026, security has become a reason companies say out loud, and their users accept it.

Is the same thing happening with AI models?

Yes, and earlier than in software. In February 2019, OpenAI held back its GPT-2 model, writing: "Due to our concerns about malicious applications of the technology, we are not releasing the trained model." The full model followed later that year in stages. GPT-3 and GPT-4 were never released as weights. Only in August 2025 did OpenAI publish open-weight models again, with gpt-oss.

Meta is the clearest 2026 example. For years it was the big champion of open weights with Llama. In April 2026 it launched Muse Spark, its first frontier model without downloadable weights. Meta's chief AI officer Alexandr Wang later said the model had triggered internal risk checks, including around biological risks, that made it "not suitable for open sourcing" at that point.

Then Meta opened it after all, just differently. In August it released Muse Glimmer, a smaller 30-billion-parameter model distilled from Spark, under Apache 2.0. On 15 October 2026 it released the weights of Muse Spark Open, about six months after launch, with extra safety training and under its own license with conditions that a classic open-source license does not have.

And Anthropic has said it does not plan to make Claude Mythos Preview generally available at all.

That is the pattern I mean by conditional: the strongest version stays closed, and what gets opened comes later, smaller or with strings attached.

What do I expect?

Three things.

1. Commercial open source will close first. Startups with an open-core model and customer data, like Cal.com and Daytona, have the most to lose and the least capacity to patch. Expect more "the old version stays open, the product doesn't" moves like Cal.diy.
2. Community infrastructure stays open, and gets AI-funded security. Linux, curl and Vikunja have no product to protect, and their openness is the point. Programmes like Glasswing, which committed $100 million in usage credits and $4 million in donations to open-source security, are what keeps that side sustainable.
3. Frontier AI models get opened late and with conditions. The pattern from Meta and OpenAI is release the strongest model closed, open a smaller or older one after a safety review. Open weights will keep coming, but they won't be today's best model.

For anyone choosing tools at work, the practical lesson is simple: "open source today" no longer guarantees "open source next year." Check the license, and have a plan if it changes.

There is a second half to this story, though. Even if the strongest models stay closed, the open ones are now good enough that companies run them on their own hardware, at a fraction of the price. I wrote about that in why more companies will run their own AI models.