For twenty-five years, open source security rested on two assumptions: that enough human eyes would eventually catch any bug, and that the people showing up to help could, over time, be trusted. AI dissolves both. A single actor can now generate an endless stream of plausible patches, file superhuman-polished vulnerability reports, and play the patient, helpful long-term contributor — the exact social-engineering pattern behind the xz backdoor — at a scale no volunteer maintainer can match. The attackers already have their force multiplier. Most maintainers do not (yet).

This talk examines what open source security actually looks like when both sides of a commit might be a machine: AI “slop” reports drowning security inboxes, and self-propagating supply-chain worms like Shai-Hulud moving faster than any human can triage. Drawing on a decade of building tooling for maintainers — from Breeze to the agentic workflows behind Magpie — it argues the answer isn’t asking exhausted volunteers to work harder. It’s handing them the same asymmetric leverage attackers already wield: defensive, agentic infrastructure that protects the one thing AI can’t replace — human trust — by guarding the scarce human attention that grants it.

Speakers:

Jarek Potiuk: Independent Open-Source Contributor and Advisor

Independent Open-Source Contributor and Advisor, Committer and PMC member of Apache Airflow, Member of the Apache Software Foundation

Jarek is an Engineer with a broad experience in many subjects - Open-Source, Cloud, Mobile, Robotics, AI, Backend, Developer Experience, but he also had a lot of non-engineering experience - running a company, being CTO, organizing big, international community events, technical sales support, pr and marketing advisory but also looking at legal aspect of licensing and building open-source communities are all under his belt.

With the experience in very small and very big companies and everything in-between, Jarek found his place in Open-Source world, where his internal individual-contributor drive can be used to the uttermost of the potential.