Open Source Security Incidents Aren't Going Away

This commentary outlines the growing reliance on open source software and argues that organizations must invest in developers with both soft and technical security skills—such as threat modeling, ecosystem and dependency risk management, CI/CD pipeline security, and comprehensive testing—to mitigate risks inherent in public collaboration. It also highlights unique challenges in securing open source AI, including model opacity, data poisoning, adversarial attacks, and unintended bias, using the XZ maintainer compromise as a cautionary example of the exposure created by open development.