Open Source Is Dead.  🔗 **Source:** [Open Source Is Dead.](https://twitter.com/pumfleet/status/2044424163801129283/?rw_tt_thread=True) > [!note]+ Document Notes > --- > tags: [open-source, security, AI] > author: Bailey Pumfleet > source: Twitter > reference: [https://twitter.com/pumfleet/status/2044424163801129283/?rw_tt_thread=True] > date created: 2026-04-15 10:00 > --- > # 🏷️ Title: Open source is dead. > ## 🧭 Table of Contents > - [📝 Summary](#-summary) > - [📖 Main Content](#-  This really is not an easy post to write. Five years ago, my cofounder and I started [Cal.com](http://Cal.com), which is now the largest open source Next.js project. Open source has always been a very core principle that we built the company around, and today, we’ve had to give that up. And I honestly think the rest of the industry should too. You’ve already heard the narrative that “AI is changing everything”. It’s writing our content, building software and replacing entire parts of our day-to-day workflow. The part that nobody is talking about is that AI is now hacking our software. Previously, to hack an application, you'd need a really good hacker with years of experience, and they'd have to invest a significant amount of time into trying to find and exploit a vulnerability in the code. And the simple reality is, humans don't really have the time, attention span or patience to find everything. Because of this, we have a ‘security through obscurity’ situation such that most code, including open source code, is inherently vulnerable. It’s statistically improbable that you’re going to write perfect code that has no vulnerabilities. But because the ‘cost to hack’ is so high (requiring a skilled hacker with significant time investment), applications have survived for years with few successful attacks. Today, that’s all changed. You can now simply just point AI at an open source codebase and have it scour the codebase to find vulnerabilities in the code. And it will undoubtedly find some. Being open source is much like giving bank robbers the blueprints to the vault - you know what's behind the mask, and you can use this information to detect vulnerabilities much more easily. In the last few months, we've seen a lot of new AI security startups who have productized this. In YC alone, there are 6 of these companies. We’ve worked with a lot of these companies, and found that each platform has different findings than the other, and so that makes it impossible to establish a single test/source of truth that determines if something is secure or not. That puts us (and the industry) in a very scary position where nobody knows what’s secure, while new threats are coming in from the barrage of AI agents that have all been instructed to attack your codebase. The common denominator, however, is that code being open source exposes the inner workings of the application to AI, and therefore makes it considerably easier to reverse engineer the functionality and find a vulnerability. Hex Security, one of the leading AI vulnerability companies out of YC, said that open source applications are 5-10x easier to exploit than closed source. Recently, the risk of AI has increased significantly with cutting-edge models like Anthropic's Mythos being able to attack almost anything. One recent example is finding a 27 year old vulnerability in the BSD kernel, which is one of the most widely-used and security focused open source projects that exists. AI was not only able to find the issue, but build working exploits in mere hours. Now, Anthropic aren’t publicly releasing Mythos because of the damage it will do, and through Project Glasswing, they’re going to use it internally for defensive purposes, but what’s going to happen when China drops an open source model that has similar capabilities to Mythos? It’s a very scary situation to be in - soon, pretty much anyone will have access to the most powerful cutting-edge models which lets them harness the power of the smartest hacker in the world. There will be a radical transformation in how not just open source is looked at, but application security as a whole. And so I hate to say it, but I think that open source is ultimately dead. There’s no way that it’s worth risking your customer data just so people can read your source code. Open source applications are going to get ravaged by attacks in the coming months, and lots of sensitive data is going to be leaked. I don’t see how most open source projects can operate anymore. If even BSD and Firefox are getting hacked by Mythos, what chance does anyone else have? After a lot of deliberation, we decided that [Cal.com](http://Cal.com) will no longer be open source. We’re closing the codebase, releasing the core code under a new MIT-licensed open source project called cal.diy for hobbyists and tinkerers, and investing massively in security to try and defend ourselves from this rapidly growing threat. We’ve already diverged from our open source cal.diy repository, rewriting authentication and data handling while continuously testing our code using AI vulnerability scanning tools. Every open source company needs to be doing the same - as a customer, I’d expect companies to be doing whatever they can to protect my data, and right now, remaining open source is an almost negligent move. Strap in, everyone, because the world of open source is on the edge of descending into chaos., Open Source Is Dead., Bailey Pumfleet, 01kp8vrhb3v2dbhsec3f0e7h07.