Albanese, Chen funded for conference advancing secure open-source ecosystems amid AI era

George Mason University researchers Massimiliano Albanese and Songqing Chen have received $438,568 from the National Science Foundation to organize a national conference focused on one of the most urgent and least visible challenges in artificial intelligence: keeping the open-source software infrastructure that powers modern technology secure, sustainable, and resilient.

The two-day event, titled “POSE: Conference: A Community-Wide Convening to Grow Secure Open-Source Ecosystems in the Era of AI,” will bring together specialists from universities, technology companies, government agencies, nonprofit organizations, and open-source communities. Its central question is increasingly important as AI transforms software development: how can the global ecosystem of freely shared code remain trustworthy when machines are beginning to write, modify, test, and deploy software at unprecedented speed?

Open-source software forms the hidden foundation of much of the digital world. Operating systems, cloud platforms, web servers, databases, cybersecurity tools, scientific applications, and artificial-intelligence systems often depend on code maintained by distributed communities rather than a single corporation. A small library maintained by a handful of volunteers may be incorporated into thousands of commercial products and public services. This structure accelerates innovation, but it can also make vulnerabilities difficult to track, responsibilities unclear, and essential projects financially fragile.

The rapid emergence of AI-assisted programming is intensifying those pressures. Generative AI tools can produce large amounts of code in seconds, while autonomous or semi-autonomous AI agents may soon be able to select software components, write patches, run tests, and submit changes with limited human intervention. These capabilities could help developers repair vulnerabilities and maintain neglected projects, but they may also introduce errors at scale. A flawed suggestion generated once by an AI assistant could be copied into thousands of repositories, creating a vulnerability that spreads faster than conventional review processes can detect.

The conference will examine how open-source communities can respond to this changing technical environment without sacrificing the openness that makes them productive. Participants are expected to explore methods for improving code review, vulnerability disclosure, dependency management, automated testing, and software provenance. Provenance—the ability to determine where a piece of code came from, how it was modified, and which tools contributed to it—is becoming especially important as software increasingly combines human-written code with machine-generated components.

Security is only one part of the challenge. Open-source projects also depend on social and economic systems that are often overlooked. Many widely used packages rely on unpaid or underfunded maintainers who are responsible for responding to security reports, reviewing contributions, managing releases, and supporting users. When these maintainers are overwhelmed or leave a project, critical software can become vulnerable even if the underlying code was once carefully designed. The planned gathering will therefore address organizational and financial models that could make important projects more viable over the long term.

Legal and policy questions will also be part of the discussion. Open-source licenses determine how software can be copied, modified, and redistributed, but AI-generated code raises new questions about authorship, training data, attribution, and liability. Organizations may need clearer ways to document whether software was written by a person, generated by an AI system, or assembled from existing components. They must also determine who is responsible when an AI-assisted change introduces a security flaw into infrastructure used by millions of people.

Albanese, a professor and associate chair for research in Information Sciences and Technology and executive director of George Mason’s Institute for Digital Innovation, and Chen, a professor of computer science, will use facilitated plenary discussions, structured breakout sessions, and hands-on working activities to connect experts who rarely participate in the same conversations. The format is intended to move beyond broad statements about the importance of open source and toward practical recommendations that developers, institutions, policymakers, and funders can implement.

Expected outcomes include a synthesis of major themes, an assessment of gaps and opportunities, recommended next steps, and widely distributed materials to support future initiatives. The organizers hope the conference will help establish shared priorities across communities that often view the software ecosystem from different perspectives. A technology company may focus on supply-chain risk, a government agency on public resilience, a researcher on reproducibility, and a volunteer maintainer on the time required to review every change. Bringing these concerns together could produce more realistic security strategies.

The project is scheduled to begin in July 2026 and continue through late June 2027. Its importance extends beyond the conference itself because the software under discussion is embedded in everyday systems, from online services and medical technologies to transportation networks and scientific computing. As AI-generated code becomes commonplace, the strength of the digital infrastructure beneath society will depend not only on more powerful tools, but also on transparent development practices, durable communities, and sustained investment in the people who keep open-source software alive.

Web References: https://www.gmu.edu/about; https://www.gmu.edu/masonnow

Keywords

Artificial intelligence, open-source software, cybersecurity, software supply chain, AI-assisted development, AI agents, digital infrastructure, software security, George Mason University, National Science Foundation