On August 13, 2026, GitHub published lessons from another group of projects in the Secure Open Source Fund. The report describes open-source teams combining AI-assisted workflows, GitHub security tools, expert guidance and funding to improve project security systematically.
The practical lesson is that speed alone is not security. AI can accelerate code analysis, remediation work and routine dependency updates, but the final change still needs normal review. This is especially important for authentication, cryptography, build pipelines and software-supply-chain changes.
Commercial systems face an even stricter environment because they handle personal data, business operations and external integrations. AI-generated code should therefore follow exactly the same controls as human-written code: static analysis, dependency and secret scanning, tests, least privilege and auditable change history.
The positive side is that AI can also strengthen defence. It can help triage alerts, identify recurring patterns and prepare fixes more quickly. Secure development, however, remains a property of the process rather than a feature of one tool.