SALT LAKE CITY – November 10, 2026 -- Fifty-eight percent of surveyed teams ship code faster than security reviews can keep up, according to a 2026 study supported by the Open Source Security Foundation (OpenSSF), as the Linux Foundation initiative expands its AI security programs and adds three members.
Survey finds 60% of teams report more external packages from AI coding assistants
The State of AI Impact on Software Security and Cybersecurity 2026 report was supported by OpenSSF, ActiveState and the LF AI & Data Foundation. It found that 60% of respondents say AI coding assistants have increased the number of external packages in their codebases. OpenSSF says AI speeds up both code production and vulnerability discovery for attackers and defenders. Reporting windows are also shrinking under regulations such as the EU Cyber Resilience Act.
Laura Guazzelli, OpenSSF Security Architect for AI/ML/LLM/Agentic Systems, said the new development cycle has "collapsed the window between bug discovery and automated attack."
OpenSSF joins MOSAIC to build a standardized map of AI security initiatives
Membership in the Multi-Organization Secure AI Coordination (MOSAIC) group lets OpenSSF and MOSAIC members pool knowledge and resources. A major goal is a standardized map of participating initiatives, aligned with efforts such as NIST SP 800-53 Control SC-42 and built on existing frameworks.
Three General Members join, including DevGuard and UElement Technologies
Beautiful Majestic Dolphin, DevGuard and UElement Technologies joined as General Members. Beautiful Majestic Dolphin CEO Shane Morris said the company released GoRapide as open source under an MIT license. DevGuard, operated by L3montree GmbH, said it already uses OpenSSF projects and data. UElement Technologies co-founder and CEO Chaitanya Vijay Ghate said the company joined to help make open source trustworthy and quantum-safe.
New developer guide stresses AI-generated patches need automated tests and human review
The OpenSSF Best Practices and AI/ML working groups released Finding and Fixing Software Vulnerabilities Using AI: A Guide for Developers. The free guide covers preparing and sandboxing AI, validating and fixing issues, and preventing recurrence. It states that AI-generated patches should never be trusted without automated tests and human review. An online course, LFD126, is planned for the coming months.
OpenSSF and Linux Foundation Education will launch the Secure AI Associate (SAIA) certification in December 2026. It covers security risks across the AI/ML lifecycle, from training data to production pipelines.
GitHub extends Dependabot malware alerts from npm to eight ecosystems
A new case study shows GitHub integrated OpenSSF's Malicious Packages data into its Advisory Database. Dependabot malware alerts now extend beyond npm to eight package ecosystems, including PyPI, Maven, RubyGems, NuGet, Go, crates.io and PHP Composer. The community-driven repository holds more than 238,000 malicious package reports.
Zarf 1.0 targets software deployment in disconnected environments
Zarf 1.0 helps teams package and deploy software in environments without internet connectivity. The release strengthens package signing and verification workflows, improves configuration management and sets a base for long-term compatibility.
OpenSSF members are meeting at Open Source SecurityCon North America and KubeCon + CloudNativeCon North America (November 9-12) in Salt Lake City. Open Source SecurityCon Europe is planned for March 15, 2027.