Is AI killing Open Source?

• Flood of "slop PRs." It now costs almost nothing to generate code, but reviewing it still takes human time and attention. That asymmetry is brutal for maintainers. Jazzband is winding down, Godot maintainers have described AI slop PRs as draining and demoralizing, cURL shut down its bug bounty after a wave of low-quality AI-generated reports, and GitHub is now building more granular controls so maintainers can restrict pull requests or disable them in some cases.
• Security. Open code has always made auditing easier. Now it also makes automated vulnerability discovery much easier. Anthropic's Mythos Preview says it found and exploited zero-days across major operating systems and browsers, including bugs that had apparently been sitting there for decades. And this is already bleeding into the real world: after Vercel's recent incident, Guillermo Rauch said he strongly suspects the attackers were "significantly accelerated by AI." I think this changes the risk calculation for some companies. Cal.com is a good example: they recently moved their codebase to closed source while explicitly pointing to security as the main reason.
• Relevance. A lot of useful open source used to have a built-in moat simply because building it took effort. That moat is thinner now. Small tools, wrappers, UI kits, and straightforward utilities can increasingly be recreated from a prompt in Claude Code. That does not make them worthless, but it does make some projects easier to commoditize, easier to clone, and harder to monetize. Tailwind is the most famous example here, where its business model of selling Tailwind UI components has completely collapsed.
• Open source still has some advantages. It creates trust, helps with hiring, generates more word of mouth, more feedback, and more contributions from people who actually care. But I'm not sure it's worth it. It's a hard time for open source right now.

Originally published in CTO Circle Issue 004.