Open Source Caught Between Corporate Cash and AI Chaos

The excavator and the garden

Franck Nijhof, a maintainer for Home Assistant, published a post this week that I keep coming back to. His analogy is perfect: if you rent an excavator to dig a pool, you don't become a professional. You become a person with a powerful tool and a very real chance of destroying your garden. That's AI-assisted contributions to open source right now. The tool amplifies whatever's already there. Judgment gets amplified. Confusion gets amplified too.

The pull request, Nijhof argues, is not the finish line. It's where a different kind of work begins: review, edge-case analysis, behavioral verification, long-term maintenance thinking. And here's the thing nobody in the "AI will 10x developer productivity" crowd wants to talk about: contributors got amplified, but maintainers didn't. The verification bottleneck is the same size it always was, and now there's ten times more stuff flowing through it.

This isn't a hypothetical problem. It's happening now, in real repositories, to real people who maintain software that runs in millions of homes and servers. AI didn't create the maintainer burden. It accelerated it. And if you've ever maintained anything (a codebase, a community garden, a friendship with someone who texts too much), you know that acceleration without capacity is just a fancier word for collapse.

Five billion dollars and a taxonomy

So naturally, the corporate response is to throw money at it. IBM and Red Hat announced Project Lightwell on May 28: a $5 billion commitment, 20,000 engineers, and a "trusted enterprise clearinghouse" for open source software. The pitch is straightforward. Over 90% of Fortune 500 companies rely on open source. Frontier AI models (IBM specifically cited Anthropic's Mythos Preview finding nearly 3,900 high- or critical-severity vulnerabilities) are making it easier to discover and exploit holes. Someone needs to be the adult in the room.

The early adopters list reads like a who's who of financial services: Bank of America, Goldman Sachs, JPMorganChase, Visa, and about half a dozen others. Which tells you exactly who's scared enough to pay for this. Fair enough. But I keep wondering whether a commercial subscription layer on top of open source security fixes changes the fundamental dynamic of open source itself. You're essentially creating a two-tier system: enterprises who can afford validated patches, and everyone else who can't. That's not new (Red Hat's entire business model, basically), but at $5 billion scale with AI-driven vulnerability scanning, it feels like a qualitative shift.

Meanwhile, two days later, the G7 Digital and Technology Ministers agreed on shared language around open-source AI. And look, I know "shared language" sounds like the least exciting outcome possible from a ministerial meeting, but this one actually matters. They defined four distinct categories: Open Source AI with Open Data (everything open, including training data), Open Source AI (everything open but with exceptions for training data that's legally or technically impossible to share), Open Weights AI (weights and deployment code under an open source license), and Weights Available AI (weights available but with usage restrictions).

That last category is basically the Meta Llama model. And the fact that the G7 now has a name for it, distinct from actual open source, is quietly significant. It means governments are starting to draw lines that companies have been deliberately blurring. Whether those lines hold up in practice is another question entirely, but at least there's a vocabulary now.

The layoffs blamed on AI

Aaron Levie, the Box founder, coined a term this week that deserves to stick around: "AI psychosis." As discussed on TechCrunch's Equity podcast, it describes what happens when the people deciding AI can replace your job are the ones least likely to understand what your job actually involves. ClickUp cut 22% of its workforce for AI agents. Tech layoffs in 2026 are already nearly matching all of 2025, according to the same report. DuckDuckGo installs are climbing because users want Google to stop forcing AI into search and just give them links.

That last detail is the one that sticks with me. Not the layoffs (grim but expected), not the executive delusion (eternal), but the fact that a meaningful number of people are actively seeking out a search engine that doesn't use AI. There's a consumer revolt happening in plain sight, and it's not organized or loud. It's just people quietly switching to DuckDuckGo because they want ten blue links and not a hallucinating paragraph.

The Equity hosts framed it well: the AI-pilled and the AI-skeptical are both right at the same time. That's not a comfortable position for anyone. It means the technology is genuinely powerful AND genuinely being misapplied, often by the same companies, sometimes in the same product.

Amazon's Hollywood fumble

Speaking of misapplication. Amazon MGM Studios greenlit three animated series produced using generative AI, and the backlash was immediate and brutal. Jorge Gutierrez, who was attached to one of the projects called "Punky Duck," publicly walked away. NBC News noted the timing: the same week Pope Leo XIV urged caution about AI in his first encyclical, Amazon delivered what amounted to a holy endorsement of the technology in creative production.

OK, I find it genuinely funny that a Pope and a streaming service are now on opposite sides of an AI debate about cartoon ducks. But the creator revolt here is real and it matters beyond Hollywood. This is what happens when you try to use AI to replace the thing people actually value (and yes, I know "creative vision" sounds precious, but it's literally what audiences pay for). You can automate the production pipeline. You cannot automate the reason anyone cares about the output.

The data pipeline nobody consented to

Amnesty International released a briefing this week called "Unlawful by Design," and the title is the argument. They researched the models behind GPT-3, Gemini, Llama, DeepSeek, Midjourney, and Stable Diffusion, and concluded that the large-scale web scraping used to train these systems constitutes a mass invasion of privacy. Billions of public posts and images extracted without explicit consent. As datasets scale up, hateful and discriminatory content in outputs gets amplified along with everything else.

Likhita Banerji, head of Amnesty's Algorithmic Accountability Lab, called it "an extractive data pipeline" that opens up "a risk of mass abuse of human rights." Strong language. But when you put it next to the G7's new taxonomy and IBM's $5 billion security play, a pattern emerges: the infrastructure of AI is being built on foundations that are legally questionable, ethically contested, and operationally fragile. Everyone's racing to build the second and third floors while arguing about whether the basement has a permit.

The thing that connects all of these stories, from Nijhof's overwhelmed maintainers to Levie's AI psychosis to Amazon's cartoon duck disaster, is a gap between capability and readiness. The tools are powerful. The institutions, the workflows, the legal frameworks, the creative norms, none of them have caught up. IBM is betting $5 billion that enterprises will pay someone to close that gap for them. The G7 is betting that shared vocabulary will help. Amnesty is betting that calling it unlawful will force a reckoning. And somewhere, a maintainer is staring at forty AI-generated pull requests, knowing that maybe three of them are worth reviewing, and wondering who exactly all this progress is for.