This Week in Open Source for October 30, 2026

by Daryl Ducharme & Shane Glass, Open Source Programs Office

A look around the world of open source

Right before Halloween weekend, it feels fitting to ask what actually haunts open source communities right now—from supply-chain ghosts lurking in commit histories and the hidden cost of maintaining isolated "zombie" forks to models wearing open source costumes without sharing what is under the mask. Across this week's reads, maintainers, researchers, and engineers share how they are keeping the lights on: setting clear community boundaries for AI contributions, wiring human sign-off and cost guardrails directly into automated workflows, and co-building open infrastructure across hardware stacks. Technology only serves people when the humans doing the work stay in control of the machinery—and transparent, inspectable tools remain our best defense against things that go bump in the night.

Upcoming events

🗓️ November 2026

• Open Source in Finance Forum (OSFF) New York (November 4–5, 2026) – New York, New York, USA. Dedicated industry conference examining open source compliance, supply-chain security, and collaborative innovation across regulated financial institutions.
• SeaGL (Seattle GNU/Linux Conference) 2026 (November 6–7, 2026) – Seattle, Washington, USA & Virtual. Free, grassroots technical summit dedicated to spreading awareness and knowledge of free and open source software, hardware, and culture.
• KubeCon + CloudNativeCon North America 2026 (November 9–12, 2026) – Salt Lake City, Utah, USA. The Cloud Native Computing Foundation's (CNCF) flagship conference uniting adopters and maintainers around Kubernetes and containerized distributed infrastructure—featuring over 35 sessions and keynotes from Googlers including Abdel Sghiouar, Jago Macleod, Tim Hockin, Kaslin Fields, John Belamaric, Dawn Chen, Janet Kuo, Benjamin Elder, Antonio Ojea, Lior Lieberman, Michelle Au, and Braydon Kains across Kubernetes Special Interest Groups (SIGs), etcd, containerd, Gateway API, Common Expression Language (CEL) admission policies, and agent sandboxes, plus the Google-sponsored Community Hub.
• SFSCON (South Tyrol Free Software Conference) 2026 (November 13–14, 2026) – Bolzano, Italy. One of Europe's longest-running free software conferences bringing together public-sector decision-makers and developers to advance digital sovereignty and open infrastructure.

🗓️ December 2026

• Yocto Project Virtual Summit 2026.12 (December 1–3, 2026) – Virtual. Community summit for embedded Linux engineers and maintainers building custom, reproducible Linux distributions across edge and Internet of Things (IoT) hardware.
• Open Source Summit Japan 2026 (December 7–9, 2026) – Tokyo, Japan. The Linux Foundation's premier Asia-Pacific conference connecting open source developers, kernel maintainers, and enterprise leaders across cloud, embedded Linux, and open AI—featuring a keynote by Google's Kaz Sato on building agents on open standards alongside sessions from Googlers Tanya Sharma, Tarun Sahu, and Anurag Sinha.
• Open Compliance Summit 2026 (December 10–11, 2026) – Tokyo, Japan. Specialized gathering uniting legal, security, and Open Source Programs Office (OSPO) practitioners around OpenChain, Software Package Data Exchange (SPDX), software bills of materials (SBOMs), and global open source supply-chain compliance.

🗓️ January 2027

• Free and Open Source Software Developers' European Meeting (FOSDEM) 2027 (January 30–31, 2027) – Brussels, Belgium. Europe's largest free, volunteer-organized gathering for free and open source software developers at the Université libre de Bruxelles—with calls for participation now open across 77 community developer rooms and main-track proposals open through November 16.

Open calls for proposals (CFPs)

• Free and Open Source Software Developers' European Meeting (FOSDEM) 2027 (Event: January 30–31, 2027 – Brussels, Belgium) – Main-track CFP deadline: November 16, 2026 (developer room calls for participation open across 77 accepted community developer rooms, with devroom schedules published by December 7, 2026).
• AtmosphereConf 2027 (Event: April 29 – May 2, 2027 – Amsterdam, The Netherlands) – Round 1 CFP deadline: November 30, 2026 (Round 2: January 11 – February 14, 2027). Community conference uniting developers, researchers, and creators building on the Authenticated Transfer Protocol (AT Protocol), open social web standards, and decentralized agent substrates across Build, Create, Inform, and Govern tracks.

Open source reads and links

• [Blog] LiteLLM Compromised, GhostAction Git-History Mining & Core PHP Vulnerabilities - From trojanized LiteLLM wheels pushed via logged GitHub command-line interface (CLI) tokens and GhostAction workflows mining full git histories across 345+ repos to dual Common Vulnerability Scoring System (CVSS) 9.2 core PHP Common Vulnerabilities and Exposures (CVEs) (CVE-2026-109618 and CVE-2026-109619) uncovered with Gemini 4 Argon, AI is accelerating bug discovery while targeting developer credentials. How must open source release pipelines adapt when decade-old secret habits collide with AI-speed exploitation?
• [Blog] Why "secure by design" is the new standard for open source - With initial European Union (EU) Cyber Resilience Act (CRA) reporting rules now live, Roman Zhukov highlights Open Source Security Foundation (OpenSSF) research showing 66% of companies remain unfamiliar with the law—and that carrying private forks can add over $258,000 in compliance labor costs. How can upstream maintainers adopt "secure by design" hygiene without absorbing downstream manufacturer liability?
• [Repository] open-source-ai-contribution-policies - Across nearly 200 open source AI contribution policies tracked by Melissa Weber Mendonça, over half ban AI-generated pull request descriptions and issue comments to stop unreviewed comment walls—yet 61 projects explicitly carve out machine translation so non-native English contributors aren't shut out. How can maintainer policies protect human review bandwidth while keeping global participation accessible?
• [Blog] Triaging open source with agents - AI-assisted coding has put a spotlight on the human bottlenecks in software pipelines, making it refreshing to see maintainers build AI workflows that actually help them keep up. Bootstrap’s two core maintainers built twbs/triage to reproduce bugs and prep fixes offline while keeping every reply and merge human-led—which of these emerging patterns will stick as real best practices?
• [Blog] Genkit Go 1.14: Typed HITL tools, budgets, context compression, GenAI tracing, and decision models - Genkit Go 1.14 stabilizes typed human-in-the-loop (HITL) approvals via DefineResumableTool, adds run-wide token and cost budgets that include subagents, adopts OpenTelemetry GenAI semantic conventions, and loads portable Agent Skills bundles from any Go fs.FS. When autonomous loops can pause for human sign-off and cap spend in code, what high-stakes workflows become safe to automate?
• [Article] Open weights are not open source AI, and why it matters - Tuning up a car doesn’t mean you know how the engine was built—an analogy Open Source Initiative (OSI) Executive Director Duane O’Brien uses to explain why OSI’s Open Source AI Definition requires training code and data details alongside weights. As Group of Seven (G7) and United Nations (UN) policymakers adopt shared terminology, how does distinguishing open weights from open source AI help builders choose the right model?
• [Blog] Introducing TorchTPU: Run native PyTorch on TPUs - Co-developed by Google and Meta’s PyTorch team, TorchTPU replaces legacy PyTorch/XLA Lazy Tensor rewrites with a native C++ PrivateUse1 backend, TorchDynamo compilation, and a hybrid DeferAndFuse eager mode validated across 5,000 Hugging Face models on Tensor Processing Units (TPUs). When switching accelerators is as simple as changing .to("cuda") to .to("tpu"), what new hardware experiments open up for open source researchers?
• [Blog] llm-d v1.0: State-of-the-art inference, ready for Day 2 - Built by 500+ contributors across 25+ organizations in the CNCF Sandbox, llm-d 1.0 brings multi-tenant flow control, zero-downtime DisaggregatedSet upgrades, and session-aware key-value (KV) cache routing to vLLM and SGLang across Graphics Processing Units (GPUs) and Google TPUs. Once one open control plane spans heterogeneous accelerators, how does multi-cloud inference shift from benchmark tuning to Day 2 reliability?
• [News] FOSDEM 2027 Accepted Developer Rooms - FOSDEM 2027 has announced 77 accepted developer rooms for Brussels this January—including the first-ever dedicated Authenticated Transfer Protocol (AT Protocol) devroom alongside a combined AI Plumbers / Local-First AI track, with devroom calls for participation now open. As open social protocols and local open-weights inference move from scattered talks into dedicated rooms, what cross-project collaborations will define 2027?

Which of these stories will you be chatting about at your next meetup or conference? Let us know! Share with us on our @GoogleOSS X account or our @opensource.google Bluesky account.

This Week in Open Source for October 23, 2026

by Daryl Ducharme, Open Source Programs Office

A look around the world of open source

What actually sustains an open source community when the cost of generating code drops toward zero, while the human labor required to review, govern, and secure it stays just as demanding? Across this week's reads, researchers, legal scholars, and builders examine the tension between automated volume and human stewardship—from public-infrastructure policy and maintainer bandwidth to provenance transparency, copyright law, and compact models running entirely on local hardware. Because software only serves people when human judgment remains in the loop, protecting maintainer agency and keeping project doors open to real newcomers matter more than ever.

Upcoming Events

🗓️ October 2026

• Open Source AI Week 2026 (October 19–24, 2026) — San Francisco Bay Area, California, USA. Now in its final stretch across the Bay Area alongside PyTorch Conference, this decentralized week of community meetups, workshops, and hackathons—with Google DeepMind and Gemma as Platinum Sponsor—wraps up this weekend with tonight's Open Source AI Awards Night (Friday, October 23, 5:00–10:00 PM PT at Fort Mason, San Francisco) and tomorrow's Google Gemma Hardware Hackathon at AGI House (Saturday, October 24, 10:00 AM–5:00 PM PT in Hillsborough, CA).
• AGNTCon + MCPCon North America 2026 (October 22–23, 2026) — San Jose, California, USA. Happening this week, this Linux Foundation and Agentic AI Foundation (AAIF) conference focuses on building and scaling production agentic systems with open standards—featuring keynotes by Google's Rao Surapaneni, Sarah Drasner, and Chi Wang, plus sessions from Googlers Vishal Motwani & Alan Blount (on Agent-to-User Interface [A2UI]), Junjie Bu (on interoperable agent discovery), Amit Handa (on agentic commerce), Dominic Farolino (on Model Context Protocol [MCP] Apps + WebMCP), and Prerna Kakkar & Kurtis Van Gent (on EvalBench).
• GitHub Universe 2026 (October 28–29, 2026) — San Francisco, California, USA & Virtual. Annual global developer gathering highlighting open source workflows, collaborative security, and multi-model AI-assisted software engineering.

🗓️ November 2026

• Open Source in Finance Forum (OSFF) New York (November 4–5, 2026) — New York, New York, USA. Dedicated industry conference examining open source compliance, supply-chain security, and collaborative innovation across regulated financial institutions.
• SeaGL (Seattle GNU/Linux Conference) 2026 (November 6–7, 2026) — Seattle, Washington, USA & Virtual. Free, grassroots technical summit dedicated to spreading awareness and knowledge of free and open source software, hardware, and culture.
• KubeCon + CloudNativeCon North America 2026 (November 9–12, 2026) — Salt Lake City, Utah, USA. The Cloud Native Computing Foundation's (CNCF) flagship conference uniting adopters and maintainers around Kubernetes and cloud-native infrastructure—featuring over 35 sessions and keynotes from Googlers including Abdel Sghiouar, Jago Macleod, Tim Hockin, Kaslin Fields, John Belamaric, Dawn Chen, Janet Kuo, Benjamin Elder, Antonio Ojea, Lior Lieberman, Michelle Au, and Braydon Kains across Kubernetes Special Interest Groups (SIGs), etcd, containerd, Gateway API, Common Expression Language (CEL) admission policies, and agent sandboxes, plus the Google-sponsored Community Hub.
• SFSCON (South Tyrol Free Software Conference) 2026 (November 13–14, 2026) — Bolzano, Italy. One of Europe's longest-running Free Software conferences bringing together public-sector decision-makers and developers to advance digital sovereignty and open infrastructure.

🗓️ December 2026

• Yocto Project Virtual Summit 2026.12 (December 1–3, 2026) — Virtual. Community summit for embedded Linux engineers and maintainers building custom, reproducible Linux distributions across edge and Internet of Things (IoT) hardware.
• Open Source Summit Japan 2026 (December 7–9, 2026) — Tokyo, Japan. The Linux Foundation's premier Asia-Pacific conference connecting open source developers, kernel maintainers, and enterprise leaders across cloud, embedded Linux, and open AI, including sessions from Google engineers such as Anurag Sinha.
• Open Compliance Summit 2026 (December 10–11, 2026) — Tokyo, Japan. Specialized gathering uniting legal, security, and Open Source Programs Office (OSPO) practitioners around OpenChain, Software Package Data Exchange (SPDX), software bills of materials (SBOMs), and global open source supply-chain compliance.

Open Source Reads and Links

• [Blog] Open Enables a Lot: The OSI at UNGA81 — At the 81st United Nations General Assembly (UNGA81), the Open Source Initiative (OSI) hosted a panel featuring Google OSPO’s Amanda Casari alongside policy and academic leaders to explore how open source reshapes public infrastructure. Framed by Duane O’Brien’s takeaway that “open by itself does very little, but enables a lot,” what shared scaffolding is needed to turn open licenses into real public value?
• [Paper] “AI Slop is DDoSing Open Source”: Understanding the Impact of AI-Generated Contributions on Open Source Sustainability — After hearing questions about AI-generated pull requests online and at conferences for a while now, I came to Google and Oregon State University’s study of 294 repositories looking for what solutions are actually working. Surveying 11 remediation strategies as first-time contributor merge rates drop 18.18%, how can communities filter synthetic noise without closing the door on newcomers?
• [Article] Who’s Writing Open Source Code? — Have AI coding agents actually taken over open source repositories, or is human authorship still the norm? Auditing 24,000 commits across 15 critical C infrastructure projects from the first half of 2026, RedMonk’s Stephen O’Grady finds that fewer than 1% carry explicit machine co-author or agent markers—raising a pressing question: how should open source communities build cultural norms around provenance transparency?
• [Article] The copyright problem with AI-generated code — In creative circles online, people often argue that prompting AI makes you closer to an art patron or a music producer than the artist—but I had never thought about the copyright realities for software. Since open source licenses rely on human copyright, FreeDOS founder Jim Hall asks a foundational question: can you even license code you didn’t actually author?
• [Blog] Launching an opt-in vulnerability-finding service for open-source software — Inspired by Google’s OSS-Fuzz, Anthropic’s new opt-in OSS Scanner offers open source maintainers free, periodic security audits complete with test reproducers and suggested patches running in isolated Docker environments. Giving resource-constrained projects direct access to frontier vulnerability detection is a welcome step forward—how can we keep expanding shared security tooling to help upstream maintainers catch complex bugs early?
• [Blog] Do Agent Skills Help? I Ran 72 Trials to Find Out — Evaluating whether AI agent skills beat prompt-and-guess baselines, Karl Weinmeister ran 72 sandboxed trials across 12 scenarios using Harbor and SkillEvaluator—complementing Google’s open source skill-reach suite for catching description collisions across harnesses like AAIF’s Goose and Claude Code. Together, they raise a practical question for maintainers: how do we test both skill discovery and execution quality?
• [Blog] Make the PDS Your Own: Customization and Metrics — The Authenticated Transfer Protocol (AT Protocol) is one of my major interests right now, so seeing how people are making its foundations work in practice is fascinating. The latest Reference Personal Data Server (PDS) release adds custom OAuth login branding, 300MB video blobs, and direct-to-Prometheus OpenTelemetry metrics in under 1GB of RAM—what other operational building blocks will help small teams self-host federated infrastructure?
• [Article] Google’s new 4B Gemma model cuts speaker-labelling errors on all four benchmarks, two barely — Automated transcripts still struggle when speakers talk over one another in meetings and interviews. Built on Google’s Gemma 4 E4B and open source DiarizationLM framework, the community-trained Apache 2.0 DiarizationLM-Gemma-4-E4B-v1 approaches speaker diarization as a lightweight post-processing pass over existing transcripts—beating an 8B Llama 3 baseline at half the size. Where can compact local models clean up brittle pipeline handoffs in your own workflows?
• [Blog] Open-Source Voice AI runs entirely on ESP32-S3 — Some of the most inspiring moments in open source come from individual builders experimenting at the edges of hardware constraints. Anankush Pandit’s GNU General Public License (GPL) Ivy AI packs wake-word detection, speech recognition, a 4-bit language model, and speech synthesis onto an ESP32-S3 microcontroller with just 8MB of pseudo-static RAM (PSRAM)—making us wonder what other everyday devices could run entirely offline?

Which of these stories will you be chatting about at your next meetup or conference? Let us know! Share with us on our @GoogleOSS X account or our @opensource.google Bluesky account.

This Week in Open Source for October 15, 2026

by Daryl Ducharme, Open Source Programs Office

This Week in Open Source for October 15, 2026

A look around the world of open source

After speaking about the Agent2Agent (A2A) protocol and Model Context Protocol (MCP) in Toronto last week (which I recapped in Tag-Team Transmission), open agent boundaries were clearly still on my mind while collecting this week's reads. As AI agents, terminal tools, and embedded micro-apps move deeper into everyday software workflows, a central tension keeps surfacing across the open source community: where do human judgment, interface trust, and maintainer sustainability fit in? Whether teams are wiring up open protocols in the Unix shell, running multimodal retrieval locally on a laptop, or stewarding decades-old kernel infrastructure, the healthiest open source architectures don't replace human agency—they give workers clearer boundaries, inspectable tools, and a genuine seat at the controls.

Upcoming Events

🗓️ October 2026

• All Things Open 2026 (October 19–20, 2026) — Raleigh, North Carolina, USA. One of the largest community-focused open source conferences on the U.S. East Coast exploring open source software, AI engineering, and maintainer sustainability—featuring Googlers Andrew Brogdon, Mark Techson, and Marc Dougherty speaking on "Where Is My Futuristic App? Generative UI and the Open Future" and Abdel Sghiouar on "Taming Agentic AI: How to Run Agents-Generated Code Safely on Kubernetes", alongside the Google Community Lounge with the Flutter team.
• PyTorch Conference North America 2026 (October 20–21, 2026) — San Jose, California, USA. Two days of open source machine learning innovation across the PyTorch ecosystem—featuring a keynote by Google's Bill Jia ("Workload Fungibility in the Age of Agents") and technical sessions from Googlers Chris Jones, Sandeep Pokkunuri, Rob Mulla, Ankita Luthra, Trinadh Kotturu, Claudio Basile, Qi Zhou, Jago Macleod, and Aleksey Vlasenko on TorchTPU, vLLM, SGLang, Ray, and Kubernetes.
• AGNTCon + MCPCon North America 2026 (October 22–23, 2026) — San Jose, California, USA. Linux Foundation and Agentic AI Foundation conference focused on building and scaling production agentic systems with open standards—featuring keynotes by Google's Sarah Drasner and Chi Wang, plus sessions from Googlers Alan Blount (on A2UI), Junjie Bu (on interoperable agent discovery), Amit Handa (on agentic commerce), Dominic Farolino (on MCP Apps + WebMCP), and Prerna Kakkar & Kurtis Van Gent (on EvalBench).
• GitHub Universe 2026 (October 28–29, 2026) — San Francisco, California, USA & Virtual. Annual global developer gathering highlighting open source workflows, collaborative security, and multi-model AI-assisted software engineering.

🗓️ November 2026

• Open Source in Finance Forum (OSFF) New York (November 4–5, 2026) — New York, New York, USA. Dedicated industry conference examining open source compliance, supply-chain security, and collaborative innovation across regulated financial institutions.
• SeaGL (Seattle GNU/Linux Conference) 2026 (November 6–7, 2026) — Seattle, Washington, USA & Virtual. Free, grassroots technical summit dedicated to spreading awareness and knowledge of free and open source software, hardware, and culture.
• KubeCon + CloudNativeCon North America 2026 (November 9–12, 2026) — Salt Lake City, Utah, USA. The Cloud Native Computing Foundation's flagship conference uniting adopters and maintainers around Kubernetes and cloud-native infrastructure—featuring over 35 sessions and keynotes from Googlers including Abdel Sghiouar, Jago Macleod, Tim Hockin, Kaslin Fields, John Belamaric, Dawn Chen, Janet Kuo, Benjamin Elder, Antonio Ojea, Lior Lieberman, Michelle Au, and Braydon Kains across Kubernetes SIGs, etcd, containerd, Gateway API, CEL admission policies, and agent sandboxes.
• SFSCON (South Tyrol Free Software Conference) 2026 (November 13–14, 2026) — Bolzano, Italy. One of Europe's longest-running Free Software conferences bringing together public-sector decision-makers and developers to advance digital sovereignty and open infrastructure.

🗓️ December 2026

• Yocto Project Virtual Summit 2026.12 (December 1–3, 2026) — Virtual. Community summit for embedded Linux engineers and maintainers building custom, reproducible Linux distributions across edge and IoT hardware.
• Open Source Summit Japan 2026 (December 7–9, 2026) — Tokyo, Japan. The Linux Foundation's premier Asia-Pacific conference connecting open source developers, kernel maintainers, and enterprise leaders across cloud, embedded Linux, and open AI, including sessions from Google engineers such as Anurag Sinha.
• OpenCompliance Summit 2026 (December 10–11, 2026) — Tokyo, Japan. Specialized gathering uniting legal, security, and OSPO practitioners around OpenChain, SPDX, software bills of materials (SBOMs), and global open source supply-chain compliance.

Open Source Reads and Links

• [Blog] Meet the A2A CLI: discover, message, and manage agents from your terminal — In Developer Relations, few things beat showing a protocol live in a terminal during a conference talk without a complex web stack in the way. The new Apache 2.0 A2A CLI lets you discover, message, and wrap any stdin/stdout script into a streaming Agent2Agent server with --exec—raising an interesting question: does meeting developers in the Unix shell matter more for open protocol adoption than heavy SDKs?
• [Blog] Talking to Agents with a2a (as a human!) — Right after the MCP Dev Summit in Toronto, Marc Dougherty shared a post that uncovered even more about the Agent2Agent (A2A) protocol by flipping the lens from autonomous systems to human-to-agent interfaces with A2UI. Building a2term so agents render interactive terminal confirmation forms before acting raises a compelling question: could open agent protocols also save humans from enterprise UI bloat?
• [Article] Dreamforce 2026 — When major enterprise platforms start telling customers they may never need to log into a web UI again because every workflow is now an API, MCP tool, or CLI command, where does the user interface go? RedMonk's Rachel Stephens examines this shift toward headless software and asks a question every open source protocol builder should ponder: when third-party agents mediate our data and workflows, how well does trust actually travel?
• [Blog] EmbeddingGemma 2: an open, lightweight multimodal embedding model — Moving RAG setups fully on-device opens up real-world possibilities—from kiosks in low-connectivity areas and offline backup systems to hardware that ships with all of its own help and support docs onboard. With Google DeepMind's Apache 2.0 release of EmbeddingGemma 2 fitting multimodal search into 567MB of RAM, what new resilient tools become possible when devices don't need an internet connection to know how they work?
• [Blog] Atproto Web Tile Embeds — Seeing AT Protocol Web Tiles in the wild sparks curiosity about what new publishing patterns become possible when open protocols move beyond text and static images. Nathan Cassell walks through embedding a live, sandboxed 3D Web Tile straight from a personal data server into a blog post—making us wonder what developers might build when interactive micro-apps can travel anywhere without phoning home.
• [Report] Navigating Open Source Governance in the Age of Artificial Intelligence: The 2026 State of OSPOs and Open Source Management — Working in an OSPO myself, seeing how other teams operate is essential for improving how we serve as liaisons between our organizations and the broader open source ecosystem. With the Linux Foundation and TODO Group's 2026 survey finding 79% of AI-involved OSPOs shaping model policy and 69% piloting agentic workflows, how can we ensure enterprise AI governance also supports upstream maintainers?
• [Report] Celebrating 35 Years of Linux: The Open Source Engine Powering Three Decades of Global Innovation and Infrastructure — It is incredible to see the success of the Linux kernel and distributions across enterprise software development—and to ponder how a project from the early 1990s has kept up with so many technological shifts. As Linux Foundation Research celebrates 35 years of Linux across billions of devices and every top-500 supercomputer, how can the community's model of continuous adaptation guide the next generation of maintainers?

Which of these stories will you be chatting about at your next meetup or conference? Let us know! Share with us on our @GoogleOSS X account or our @opensource.google Bluesky account.

This Week in Open Source for October 2, 2026

by Daryl Ducharme, Open Source Programs Office

This Week in Open Source for October 2, 2026

A look around the world of open source

As AI becomes part of everyday software development, the most compelling questions in open source are shifting from the models themselves to everything surrounding them. I’m always drawn to how technology affects individuals, and especially the workers who use and maintain it, for better or for worse (I definitely prefer better). That’s why I’m convinced the next phase of open-source AI won’t be won by chasing bigger benchmarks, but by building the open infrastructure, transparent local tooling, and community norms that keep developers and maintainers in control. This week’s reads explore what that looks like in practice.

Upcoming Events

🗓️ October 2026

• ValkeyConf 2026 (October 5, 2026) — Prague, Czechia. Dedicated community conference advancing the open source Valkey in-memory data store, featuring a keynote by Valkey TSC member and Google Cloud engineer Jacob Murphy on open source in-memory data structures and scaling high-performance workloads.
• MCP Dev Summit Toronto (October 5–6, 2026) — Toronto, Ontario, Canada. Dedicated Linux Foundation developer summit advancing the Model Context Protocol (MCP) and open agentic interoperability standards. Join Google OSPO's Daryl Ducharme (that's me!) on Tuesday, October 6 (11:00 AM EDT) for "Tag-Team Transmission: Navigating A2A and MCP for Optimum Orchestration," examining how the Agent2Agent (A2A) protocol and MCP interoperate across multi-agent architectures.
• Open Source Summit Europe (October 7–9, 2026) — Prague, Czechia. The premier Linux Foundation gathering in Europe celebrating the 35th anniversary of Linux and connecting developers, technologists, and community leaders—including a keynote by Google OSPO's Erin McKean on Docsy and technical documentation for humans and AI agents.
• Community Over Code (October 11–14, 2026) — Glasgow, Scotland. The flagship Apache Software Foundation conference bringing together project maintainers, committers, and users to collaborate on open governance, data architecture, and community-led software development.
• BazelCon 2026 (October 13–15, 2026) — Amsterdam, Netherlands. Annual gathering of the Bazel community uniting build system engineers, maintainers, and ecosystem contributors around fast, reproducible, multi-language software builds.
• All Things Open 2026 (October 19–20, 2026) — Raleigh, North Carolina, USA. One of the largest community-focused open source conferences on the U.S. East Coast exploring open source software, AI engineering, and maintainer sustainability—featuring a Google keynote on Generative UI and the Open Future alongside the Google Community Lounge with the Flutter team.
• PyTorch Conference North America 2026 (October 20–21, 2026) — San Jose, California, USA. Two days of open source machine learning innovation covering training, inference, compiler toolchains, and hardware heterogeneity across the PyTorch ecosystem.
• AGNTCon + MCPCon North America 2026 (October 22–23, 2026) — San Jose, California, USA. Linux Foundation conference focused on building and scaling production agentic AI systems with open standards, observability, and control, featuring a keynote by Google's Rao Surapaneni.
• GitHub Universe 2026 (October 28–29, 2026) — San Francisco, California, USA & Virtual. Annual global developer gathering highlighting open source workflows, collaborative security, and AI-assisted software engineering.

🗓️ November 2026

• Open Source in Finance Forum (OSFF) New York (November 4–5, 2026) — New York, New York, USA. Dedicated industry conference examining open source compliance, supply-chain security, and collaborative innovation across regulated financial institutions.
• KubeCon + CloudNativeCon North America 2026 (November 9–12, 2026) — Salt Lake City, Utah, USA. The Cloud Native Computing Foundation's flagship conference uniting adopters and maintainers around Kubernetes, platform engineering, and cloud-native infrastructure.
• SFSCON (South Tyrol Free Software Conference) 2026 (November 13–14, 2026) — Bolzano, Italy. One of Europe's longest-running Free Software conferences bringing together public-sector decision-makers and developers to advance digital sovereignty and open infrastructure.

Open Source Reads and Links

• [Article] Mila and Mozilla announce new initiative to build trustworthy open source AI for everyone, with Canadian government support — As a Canadienthusiast, seeing Mozilla and Mila partner with the Canadian government on an open source AI foundation layer immediately grabbed my attention. The crossover of open source and public-sector sovereign systems seems clear on the surface, yet real-world adoption reveals unexpected decisions. How do we make open source and open models useful to governments—is it in the open source infrastructure around them?
• [Article] Google’s open source EnvHarness lets AI agents train against environments that evolve with them — As AI adoption matures, the need for solid infrastructure around AI is becoming more evident. It is nice to see Google Research’s work leading to open source tools like EnvHarness, which adapts training sandboxes to an agent’s failure modes—and raises the question of how our evaluation infrastructure must evolve alongside the agents themselves.
• [Blog] Inside LLM Inference: Every Calculation from Text to Token using Gemma 4 12B — LLM inference often feels like an opaque black box, making Amulya Bhatia’s calculation-by-calculation trace of a token moving through Google’s open source Gemma 4 12B fascinating to ponder. Seeing how hybrid attention bounds memory under the hood prompts a broader question: how differently do we design AI systems when we actually understand the math happening inside the model?
• [Video] 100% Local RAG Without Internet: Qdrant Edge and Google LiteRT — GDE Tarun R Jain pairs Google LiteRT and Gemma 4 with Qdrant Edge to run retrieval-augmented generation 100% offline. It prompts an interesting question for system design: how differently do teams experiment with their knowledge bases when local prototyping is free—and how much of what we default to the cloud could stay on the edge?
• [Post] UISurf: An Operator-Centric Multi-Agent Platform for Observable and Cross-Environment UI Automation — UISurf explores orchestrating UI agents across Web, Desktop, and Mobile boundaries using the open Agent2Agent (A2A) protocol. Beyond the tool itself, its lessons on sandboxing and human-in-the-loop oversight are worth pondering: when autonomous agents coordinate across environments, what level of observability do human operators actually need to stay in control?
• [Article] PS5 Linux lead quits as open-source projects have become “a bunch of noobs using LLMs” that “they don’t even understand” — When maintainers leave high-profile projects like PS5 Linux, it is important to look at the reasons. In the age of AI-assisted software development, unvetted LLM code and shifting bounty incentives are straining both maintainers and community trust. What can we learn from these events as we update open source and AI governance best practices to keep projects safe, secure, and viable?

Which of these stories will you be chatting about at your next meetup or conference? Let us know! Share with us on our @GoogleOSS X account or our @opensource.google Bluesky account.

This Week in Open Source for September 24, 2026

by Daryl Ducharme, Open Source Programs Office

This Week in Open Source for September 24, 2026

A look around the world of open source

Open source underpins an $8.8 trillion global economy, yet sustaining it requires moving beyond voluntary charity and philosophical appeals. This week’s reads examine how the ecosystem is adapting to modern economic and AI pressures—from proposing package-registry royalties and quantifying 2–5x net value for regulated utility grids, to turning autonomous AI security incidents into hardened supply-chain defenses that empower open-science breakthroughs like NASA and IBM’s Lunar Foundation Model.

Upcoming Events

🗓️ October 2026

• MCP Dev Summit Toronto (October 5–6, 2026) — Toronto, Ontario, Canada. Dedicated Linux Foundation developer summit advancing the Model Context Protocol (MCP) and open agentic interoperability standards. Join Google OSPO's Daryl Ducharme on October 6 for "Tag-Team Transmission: Navigating A2A and MCP for Optimum Orchestration," examining how the Agent2Agent (A2A) protocol and MCP interoperate across multi-agent architectures.
• Open Source Summit Europe (October 7–9, 2026) — Prague, Czechia. The premier Linux Foundation gathering in Europe celebrating the 35th anniversary of Linux and connecting developers, technologists, and community leaders across open AI, embedded systems, and digital trust.
• Community Over Code (October 11–14, 2026) — Glasgow, Scotland. The flagship Apache Software Foundation conference bringing together project maintainers, committers, and users to collaborate on open governance, data architecture, and community-led software development.
• All Things Open 2026 (October 19–20, 2026) — Raleigh, North Carolina, USA. One of the largest community-focused open source conferences on the U.S. East Coast exploring open source software, AI engineering, DevSecOps, and maintainer sustainability.
• GitHub Universe 2026 (October 28–29, 2026) — San Francisco, California, USA & Virtual. Annual global developer gathering highlighting open source workflows, collaborative security, and AI-assisted software engineering.

🗓️ November 2026

• Open Source in Finance Forum (OSFF) New York (November 4–5, 2026) — New York, New York, USA. Dedicated industry conference examining open source compliance, supply-chain security, and collaborative innovation across regulated financial institutions.
• KubeCon + CloudNativeCon North America 2026 (November 9–12, 2026) — Salt Lake City, Utah, USA. The Cloud Native Computing Foundation's flagship conference uniting adopters and maintainers around Kubernetes, platform engineering, and modern cloud infrastructure.
• SFSCON (South Tyrol Free Software Conference) 2026 (November 13–14, 2026) — Bolzano, Italy. One of Europe's longest-running Free Software conferences bringing together public-sector decision-makers and developers to advance digital sovereignty and open infrastructure.

Open Source Reads and Links

• [Blog] Nobody pays for open source. We can force them to. — Companies already spend over $1 billion a year on open source, but that money goes to supply-chain mirror and security vendors rather than the maintainers writing the code. Laurie Voss breaks down why voluntary charity and license changes always fail, arguing that commercial package registries and mirror vendors should pay automatic royalties down the dependency tree to long-tail maintainers.
• [Article] AI Is reshaping open source software and straining the systems that sustain it — As conversations grow around moderating the speed of AI development across the industry, it is critical to watch the friction points where AI and open source overlap—particularly as an influx of AI-generated code and vulnerability discovery strains maintainers of an $8.8 trillion ecosystem. Funding remains front and center, requiring not just raw capital but continuous monitoring for effectiveness in sustaining the human governance, consensus-building, and non-coding infrastructure that AI cannot replace.
• [Report] LF Energy Research Finds Open Source Software Can Deliver 2-5x Greater Net Value for Grid Operators — While open source software and public utilities seem like natural philosophical allies as public goods, philosophical appeals routinely fail in regulated infrastructure sectors where operators are bound by strict reliability mandates and ratepayer accountability. This new LF Energy report demonstrates how to bridge that gap: by translating collaborative "make together" governance into an auditable benefit-cost framework showing two to five times greater net value over proprietary procurement.
• [Article] AI Is at a Turning Point — High-profile incidents of autonomous AI agents breaching Hugging Face or social-engineering open source maintainers inevitably dominate headlines and amplify purely negative narratives around AI. However, treating these security failures as concrete post-mortems—exposing how standard reinforcement learning incentivizes deceptive subgoals—is exactly what allows open source communities to establish hardened supply-chain defenses and safely advance high-impact, positive AI use cases.
• [Article] IBM and NASA Release Open-Source AI Model to Support Lunar Exploration — Seeing open source, AI, open data, and space science converge is genuinely inspiring, especially when it demonstrates that open scientific models are only as useful as the open datasets beneath them. While NASA and JAXA planetary archives have long been public, IBM and NASA's release of the Lunar Foundation Model alongside the first harmonized, machine-learning-ready lunar dataset (unifying 30+ multi-instrument layers) proves that transforming raw open data into shared, interoperable infrastructure is what unlocks domain discovery.

Which of these stories will you be chatting about at your next meetup or conference? Let us know! Share with us on our @GoogleOSS X account or our @opensource.google Bluesky account.