惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

WordPress大学
WordPress大学
Stack Overflow Blog
Stack Overflow Blog
人人都是产品经理
人人都是产品经理
Y
Y Combinator Blog
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
D
DataBreaches.Net
GbyAI
GbyAI
Microsoft Security Blog
Microsoft Security Blog
博客园_首页
大猫的无限游戏
大猫的无限游戏
Jina AI
Jina AI
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
Engineering at Meta
Engineering at Meta
IT之家
IT之家
MongoDB | Blog
MongoDB | Blog
The GitHub Blog
The GitHub Blog
月光博客
月光博客
U
Unit 42
Hugging Face - Blog
Hugging Face - Blog
博客园 - 叶小钗
腾讯CDC
B
Blog RSS Feed
博客园 - Franky
爱范儿
爱范儿

Help Net Security

ChatGPT advanced account security adds passkeys and hardware keys Week in review: High-severity LPE vulnerability in the Linux kernel, cPanel 0-day exploited for months Automating Pentest Delivery: A Step-by-Step Guide - PlexTrac Open-source privacy proxy masks PII before prompts reach external AI services Shadow AI risks deepen as 31% of users get no employer training Identity is the control plane for distributed infrastructure AI traffic is getting bigger, louder, and less predictable New infosec products of the month: April 2026 cPanel zero-day exploited for months before patch release (CVE-2026-41940) Cisco releases open-source toolkit for verifying AI model lineage Met Police face criticism for using AI to spy on their own officers Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431) Hacker with a special interest in breaching sports institutions ends behind bars - Help Net Security IP Fabric MCP server adds governance and control to enterprise AIOps workflows - Help Net Security Aqua Compass MCP server enables real-time investigation and containment of runtime threats - Help Net Security Google brings instant email verification to Android, no OTP needed - Help Net Security If cyber espionage via HDMI worries you, NCSC built a device to stop it - Help Net Security Apple fixes iPhone bug that let FBI retrieve deleted Signal messages(CVE-2026-28950) - Help Net Security GopherWhisper APT group hides command and control traffic in Slack and Discord - Help Net Security OpenAI tackles a bad habit people have when interacting with AI - Help Net Security A year in, Zoom's CISO reflects on balancing security and business - Help Net Security Scenario: Open-source framework for automated AI app red-teaming - Help Net Security GDPR works, but only where someone enforces it - Help Net Security Ransomware, fraud, and lawsuits drive cyber insurance claims to new peaks - Help Net Security Google’s Workspace Intelligence promises privacy while running on your data - Help Net Security Cyberattack on French government agency triggers phishing alert - Help Net Security Claude Mythos finds 271 Firefox flaws, Mozilla believes zero-days are numbered - Help Net Security Prove Identity Platform connects verification, authentication, and fraud prevention - Help Net Security New Mirai variants target routers and DVRs in parallel campaigns - Help Net Security Acronis GenAI Protection gives MSPs control over AI usage and data risks - Help Net Security
Best practices for AI in open-source work - Help Net Secu...
Anamarija Pogorelec · 2026-06-25 · via Help Net Security

Free and open source software developers us AI coding assistants such as Claude Code, Copilot CLI, Antigravity, and OpenCode in their daily work. The Software Freedom Conservancy responded to that trend with a set of recommendations for contributors who use these tools, which it groups under the label LLM-gen-AI, meaning generative AI systems backed by LLMs.

AI in open source

Best practices, ordered by priority

The document contains 14 recommendations presented in the authors’ order of importance. The Conservancy describes the items as best practices that guide contributors who decide to use these systems.

The top items address how projects treat people. The FOSS community should actively support contributors who reject LLM-gen-AI systems. Every contributor deserves self-determination over whether to use them, and the Conservancy calls on the industry to keep such use optional and to adopt non-discrimination policies for those who opt out.

The recommendations point to reports of technology workers ordered by management, sometimes under penalty of termination, to use these systems for all of their work. Projects that hold a zero-tolerance policy should still welcome contributors who submit AI-assisted work and respond with the same courtesy given to an inadequate first patch.

Review, disclosure, and records

Contributors must spend substantial time reviewing AI-assisted and AI-generated contributions before submission. Disclosure of how and when an LLM-gen-AI system assisted a contribution stands as a moral imperative, and that information belongs in commit logs in a machine-readable format, with the system name, its version, and a description of its role.

Prompt-generated contributions that lack human vetting belong only in areas a project designates for them. Contributors should keep records of their prompts and interactions and archive these meta-artifacts as part of the Corresponding Source, regardless of license.

Licensing and strategic use

The Conservancy advises caution around the legal significance of generated contributions. Changes made to a codebase under a copyleft license must carry that project’s license, due to copyright and the contractual terms of the license. “Copyleft Everything” remains the safest approach, since widely used LLM-gen-AI systems were trained on well-known copylefted code.

The Conservancy will lend staff time to the copyleft-next project to develop a license suited to LLM-gen-AI outputs. Use of these tools, including proprietary ones, counts as an appropriate strategic compromise when they can accelerate FOSS improvements. The recommendations also caution against overuse and skill atrophy, and ask developers to weigh resource consumption, including the environmental impact of these systems.