Open Source Is Under Attack & AI Made It Worse • Steve Poole & Olimpiu Pop • GOTO 2026

This interview was recorded for GOTO Unscripted. #GOTOcon #GOTOunscripted https://gotopia.tech Steve Poole - Developer Advocate at HeroDevs & Community Director at London Java Community Olimpiu Pop - Technologist & Tech Journalist Check out more here: https://gotopia.tech/articles/457 RESOURCES Steve https://x.com/spoole167 https://github.com/spoole167 https://www.linkedin.com/in/noregressions Olimpiu https://x.com/olimpiupop https://github.com/zroll https://www.linkedin.com/in/olimpiupop DESCRIPTION Steve Poole of HeroDevs, a longtime voice on software supply chain security, tells host Olimpiu Pop that the landscape has hit a "watershed moment" in the last few weeks. The long-standing attack methods are simple: typo'd or confusingly named packages, unchecked scripts, inflated version numbers that trick builds into pulling the wrong release, and maintainers who build trust and then turn bad. Developers are among the weakest links because their machines hold so many credentials. The new factor is AI-driven vulnerability discovery, which both attackers and security researchers are using. Steve's concern is that discovery is now industrialized while fixing is not: maintainers who once saw a CVE or two a year may now face batches of them, and he fears more will simply walk away. Unsupported packages are especially exposed, since CVEs against them often never get reported at all. His worst-case scenario is that open source security fixes end up arriving in small commercial enclaves first, as regulation and cyber insurers push companies to pay for maintenance. The practical advice for engineers is concrete. Fixing an open source dependency yourself is fine once, but then CVEs two through six arrive and you are in the maintenance business. Instead, scrutinize and reduce your dependencies, noting that studies suggest AI-generated apps pick roughly three times more of them than people do. Stay as close to HEAD as you can on maintained releases, and build your pipelines into "sleek engines" that can upgrade continuously, because under the EU Cyber Resilience Act "best efforts" to fix a vulnerability will not mean a migration in six months (Steve is clear he is not a lawyer). The two close on responsibility: like a compiler's output, AI-generated code is still your code, as Kubernetes' AI policy makes explicit by ruling out AI co-authorship. The hard part is the non-deterministic output, which means thinking harder about testing and proving quality. Steve's closing hope is that the industry becomes more pragmatic about AI's downsides, though he admits so many forces are converging that it's hard to predict where this ends. TIMECODES 00:00 Intro 01:30 A watershed moment for software supply chains 04:50 How attackers actually get in 08:59 The CRA, regulators & a surprise enforcer: Insurers 11:58 Maintainers are walking away 19:41 Vibe coding brings 3x more dependencies 24:09 AI-generated code is still your responsibility 27:46 Outro RECOMMENDED BOOKS Anna L. Davis • Open Source • https://link.amazon/B03AygKpw Nadia Asparouhova • Working in Public • https://link.amazon/B01nx6BLp Will McGugan • Beginning Python Games Development 2nd ed. • https://amzn.to/4ebBfxu Eric Evans • Domain-Driven Design • https://amzn.to/3tnGhwm https://bsky.app/profile/gotocon.com https://twitter.com/GOTOcon https://www.linkedin.com/company/goto- https://www.instagram.com/goto_con https://www.facebook.com/GOTOConferences #OpenSource #OpenSourceMaintainers #AI #SoftwareSupplyChain #SoftwareEngineering #Programming #TodayInTech #StevePoole #OlimpiuPop #GOTO CHANNEL MEMBERSHIP BONUS Join this channel to get early access to videos & other perks: https://www.youtube.com/channel/UCs_tLP3AiwYKwdUHpltJPuA/join Looking for a unique learning experience? Attend the next GOTO conference near you! Get your ticket at https://gotopia.tech SUBSCRIBE TO OUR CHANNEL - new videos posted almost daily. https://www.youtube.com/user/GotoConferences/?sub_confirmation=1