Former OpenSSF General Manager Warns AI Will Amplify Open-Source Supply-Chain Risks

Open-source software has become a foundational pillar of AI infrastructure, with operating systems, databases and frameworks such as PyTorch all relying on community-developed components. Research shows that open source accounts for about 74% of the code in the average enterprise application, while 96% of codebases contain open-source packages. A single vulnerability can therefore spread rapidly through the supply chain, making the issue a corporate governance priority.

At a COMPUTEX forum on June 5, 2026, former OpenSSF General Manager Brian Behlendorf said the 2021 Log4Shell vulnerability and the 2024 XZ backdoor had exposed supply-chain weaknesses. AI training, fine-tuning, RAG and agent frameworks are adding further attack surfaces. OpenSSF is promoting SBOM, Scorecard, Sigstore and SLSA to help companies build verifiable, trusted supply chains.