AI Is Speeding Up Open Source Security, But Developers Still Have the Final Say

Artificial intelligence is changing how open-source software is developed and secured, but GitHub says human judgment remains critical to deciding what is safe to release.

That was one of the key lessons from the fourth session of GitHub's Secure Open Source Fund, which invested more than $500,000 in 50 open-source projects across 22 countries.

AI Becomes Part of Security Work

The program brought together 71 maintainers with GitHub Security Lab experts, security tools, funding, and AI-assisted workflows.

GitHub says participating projects used AI to support tasks such as vulnerability investigation, prioritization, threat modeling, code review, and remediation.

For maintainers working with limited time and resources, these tools can help them investigate security problems and respond to vulnerabilities faster.

However, AI does not replace the people responsible for maintaining the software. GitHub says maintainers still provide the context, judgment, and accountability needed to decide what ultimately ships.

OpenClaw Strengthens Its Security

One of the projects in the fourth session was OpenClaw, which GitHub describes as its fastest-growing open-source project.

During the program, OpenClaw developed an incident response plan, expanded its use of GitHub security tools, audited its GitHub Actions workflows, and strengthened its processes for identifying and responding to security issues.

Other AI-related projects in the session included LangChain, ONNX, n8n-MCP, Deep Agents, and LadybugDB.

Security Improvements Go Beyond AI

The program also addressed traditional security risks, including exposed secrets, vulnerable dependencies, and weaknesses in software supply chains.

GitHub reports that 92% of participating projects completed the program with core security features enabled, including secret scanning, code scanning, protected branches, private vulnerability reporting, and Dependabot.

Across all Secure Open Source Fund sessions, 188 projects and 290 maintainers from 42 countries have participated. GitHub says participating projects have disclosed 533 new CVEs, carried out more than 1,500 Dependabot security updates, and resolved more than 650 exposed secrets.

What It Means for Developers

As AI makes software development faster, security teams and maintainers also need faster ways to identify and address new risks.

For developers and open-source communities in Africa, the lesson is relevant: AI can help smaller teams handle security work more efficiently, but it cannot replace human responsibility.

The future of open-source security may not be about choosing between AI and human expertise, but combining both.

AI can help find problems faster. Developers still decide what to do about them.

Read more: What 50 open source projects taught us about security in the AI era - The GitHub Blog