The cheapest model in your stack may not be the risky part. The risky part is the charming pile of packages, weights, agents, plugins, and permissions you invited into production because the demo worked and everyone clapped. Open-source AI is not the villain here. The villain is enthusiasm without inventory, which is basically adopting a dragon and labeling it dog. Open models and tools give builders real leverage: portability, inspection, customization, and less dependence on one vendor’s pricing mood ring. But the operational lesson is blunt. If your AI stack is open, your security process needs to be open-eyed too, with provenance checks, dependency monitoring, and threat modeling before the thing starts calling APIs like a caffeinated intern with root access. ## The risk moved into the build system Recorded Future’s Emerging Enterprise Security Risks of AI says agentic AI adoption is accelerating as enterprise software adds task-specific agents that can execute complex work at machine speed. The same report warns that agent autonomy and scale can let errors, misconfigurations, or malicious manipulation propagate quickly across interconnected systems. It also says agentic AI can worsen existing software supply-chain weaknesses because vulnerable or malicious open-source components can be deployed faster and at scale. Translation: the dependency graph did not become cursed. It got a scooter. The builder response is not to ban open source and retreat into a proprietary panic bunker. It is to treat AI components like production dependencies, because they are production dependencies, just with more probability distributions and fewer helpful error messages. Teams should know which model weights they are using, where they came from, what license applies, what packages wrap them, and what permissions any agent receives. If that sounds boring, congratulations, you have discovered security engineering. ## Black Duck says governance has entered the AI era Black Duck’s 2026 OSSRA Report, published in March 2026, frames the issue as software governance in the AI era. The report says the explosion of AI-assisted development has altered the open source risk landscape and changed the baseline for compliance with regulatory initiatives including the EU Cyber Resilience Act and the Digital Operational Resilience Act. Black Duck also says its OSSRA analysis is based on anonymized findings from commercial codebases audited by its Audit Services team, which makes this less of a vibes memo and more of a mirror nobody asked for. For AI builders, that means dependency monitoring cannot stop at the application layer. Model-serving code, orchestration frameworks, evaluation tools, data connectors, notebooks, and generated code all belong in the inventory. The awkward truth is that AI-assisted development can make teams produce more code before they produce more process. That is how you end up with a beautiful prototype held together by abandoned packages, mystery weights, and one shell script named final_final_really_final.sh. ## Provenance is not paperwork, it is runtime context The International AI Safety Report’s First Key Update says newer training techniques that let AI systems use more computing power have helped systems solve more complex problems in mathematics, coding, and scientific disciplines. The report also says those capability improvements have implications for risks including cyber attacks, while creating new monitoring and controllability challenges. In other words, models are getting better at the exact tasks developers use to build systems, which is delightful until your guardrails are a sticky note that says be normal. The Global Center on AI Governance, in research published Feb 21, 2025, warns that highly capable open-source models could be repurposed by malicious actors to perpetuate crime, cause harm, or undermine democratic processes. Builders do not need to solve global policy before shipping a useful product, but they do need basic provenance discipline. Record the model source, version, license, hash, safety notes, fine-tuning lineage when available, and deployment owner. If you cannot answer where a model came from, you do not have an AI strategy. You have a very expensive shrug. ## Policy debate is becoming product reality R Street Institute’s Mapping the Open-Source AI Debate, published April 17, 2025, treats open-source AI as a cybersecurity and policy question rather than a simple open versus closed theology fight. That is the right frame for builders too. The practical question is not whether open-source AI is safe in the abstract, because abstract software has never paged anyone at three in the morning. The question is what your system can do, what it can access, and how quickly a bad component or bad instruction can spread. So threat model the workflow, not just the model card. Ask what happens if a package is malicious, if an agent is prompted into taking an unsafe action, if a model artifact is swapped, if a dependency goes stale, or if credentials are broader than the task requires. Put human checkpoints where actions cross trust boundaries, especially for agents that touch data, infrastructure, payments, customer communications, or internal systems. Open-source AI remains one of the best ways to build useful systems without waiting for a vendor roadmap to descend from the clouds, but the discount only works if you do not finance it with incident response. For readers building with open models, the next move is practical: inventory the stack, monitor dependencies continuously, verify model provenance, and run threat modeling before the agent gets keys to the kingdom. Open source gives you the parts bin. Security decides whether you are building a race car or a confetti cannon pointed at prod. ## Sources - 2026 OSSRA Report: Open Source Security & Risk Analysis

Sources