[Interview] "AI Companies Should Bear Greater Responsibility for Open Source"

Deb Nicholson, executive director of the Python Software Foundation (PSF), said in an interview that AI companies need to shoulder more responsibility for the open source ecosystem. He said the open source ecosystem is the product of long-standing dedication from many contributors and communities, and that AI companies have grown on top of that foundation.

Nicholson said that, since the AI industry has benefited from the Python ecosystem, it should also share the costs and responsibilities needed to maintain it. He said AI companies have grown on the basis of the achievements of open source and the Python ecosystem, and therefore need to play a corresponding role.

The backdrop to PSF's concerns is the rapid expansion of the ecosystem driven by the AI boom. The size of the repository grew to 43TB in July 2026 from 15TB in May 2023, roughly tripling, and usage, various requests, security reports, and patches also increased.

PSF, however, has only 11 employees. Nicholson said that, amid this, the influx of unverified information has also surged, leaving the foundation struggling even to sort through the information.

As Python continues to grow in the AI boom, new burdens have emerged as well. PSF is considering changes to its operating structure and is pursuing a plan to offer AI companies a separate paid service with large-scale bandwidth. PSF plans to use revenue from that paid service to improve and maintain PyPI, the Python Package Index.

The foundation said this is not a billing plan for individual users. PSF is reviewing an operating model that would raise funds through a paid bandwidth service tailored to AI companies' demand and channel that money into the maintenance and improvement of PyPI, the Python Package Index.

Nicholson explained the relationship between open source, AI, and technological progress, saying open source is the foundation of AI and technology development. He also stressed that not only companies but governments have an important role, and said the security of programming resources and development tools needs to be viewed from the perspective of public infrastructure.

Nicholson advised Korea to strengthen its ability to connect with and understand open source. The interview took place at "PyCon Korea 2026" in Seoul last month, and the topics were the changes AI has brought to the Python ecosystem and the sustainability of open source.

He said this was not only his first visit to Korea, but also his first visit to Asia. He said he had been tired after the long flight from Boston to Seoul, but that Korea's hospitality helped ease that fatigue.

He said that when he visited a restaurant late on his first night, a staff member responded kindly. He added that the staff member showed him how to put rice into gomtang, and that through this he felt the spirit of helping others that runs through Korean culture.

He said he thought this kind of culture fits well with open source. He said his reason for coming to Korea this time was to see the Korean Python community's activities firsthand, and added that he hopes to build a close relationship with the community in the future.

On Python's position, he said Python was already widely used in data science before the AI boom. He added that, based on data science use, an ecosystem of libraries for mathematics, science, and data analysis was formed.

He cited NumPy and SciPy as examples of core libraries. He then explained that these libraries drew in new users, including people who do not consider themselves programmers but write code every day for work such as data analysis, bringing them into the Python ecosystem.

Python is less syntactically difficult than Java and C, and its simplicity means beginners face a relatively lower burden when trying to understand concepts. Another strength is that it can be downloaded for free. In addition, tools for large-scale numerical computing and data analysis were already available before the AI boom, and he said Python was ready by the time AI arrived.

He said Python had been growing gradually even before AI. He added that AI accelerated Python's growth, with the pace becoming more than twice or even three times faster than before. In this trend, Python quickly secured an advantageous position as AI spread.

But this rapid growth also created new challenges. The enlarged ecosystem is drawing in external requests that the foundation cannot easily handle, and the influence of generative AI is increasing the discovery of vulnerabilities. He also said that large volumes of unverified bug reports and patches are coming in.

The foundation currently has 11 employees. There are contributors who help improve Python, but even with their support it is difficult to respond to the increased requests. He said the biggest problem right now is having to handle rising demand while also sorting through information.

Python's rapid growth and rising profile have expanded its influence, but its maintenance costs and staffing issues have also come into focus. The question at hand was whether AI companies have benefited from the Python ecosystem and whether open source maintenance responsibilities should be expanded.

Against that backdrop, Nicholson said AI companies need to take on greater responsibility. He pointed out that Python was not built overnight, and that countless contributors invested time and the developer community supported it for many years.

Nicholson said AI and open source differ in some respects. He said AI, after receiving a user's request, uses results created by others, and that the compensation for that use is not sufficient. He added that this issue is closely tied to the realities of the open source ecosystem.

Nicholson said he hopes the collaborative and contributory culture of open source will spread to AI. He also stressed that, since the AI industry uses open source, it needs to think about ways to support the ecosystem as well.

Asked whether he is considering concrete measures to share corporate responsibility, he said PSF is reviewing a paid service for companies using PyPI that would add large bandwidth and high-volume download limits. He said it would not apply to general community users or individuals.

He said that if AI companies generate greater demand for bandwidth and downloads, PSF could provide a separate service and charge for it. He added that the funds raised through the paid service could be used to support PyPI and related tools and services.

He explained that if usage rises, the financial capacity to support it must expand as well. Asked how he assesses the sustainability of an open source operating model that depends on nonprofit foundations and support from a few companies, he said some degree of change is needed.

He said a paid service is one alternative for finding a balance between usage and financial conditions. He added, however, that a paid service alone is not the answer.

He said governments can also play a role. Citing the example of Germany's "Sovereign Tech Agency," introduced at this year's PyCon, he explained that in Germany the government views the open source ecosystem as public infrastructure and bears part of the responsibility. He welcomed such moves and said governments around the world need to consider treating the programming resources and development tools used in their countries as public infrastructure, with safety and security in mind.

Asked about the biggest security challenge amid ongoing supply chain threats targeting the open source repository PyPI, he said the main difficulty is the constant evolution of security threats. Even if one problem is solved last month, a new one may emerge next month, and it is also hard to predict new attack types accurately.

He explained that this difficulty is also linked to PyPI's structural characteristics. PyPI is accessible to anyone on the internet, and while that openness makes it possible to produce excellent results, it also allows harmful elements to enter.

He added that PyPI continues to be a target of attacks precisely because it is open to everyone. At the same time, that openness is also the driving force behind PyPI's growth, and thus remains a security issue that requires ongoing management.

Meanwhile, after Anthropic invested USD 1.5 million in PSF earlier this year, he was asked how far efforts to strengthen PyPI supply chain security through that investment had progressed. He said the first step is to build a structure to expand security capabilities.

He said a small core team currently handles PyPI's security work, and the existing system was also designed for a small team. For that reason, even if new staff members try to support some tasks, it has been difficult to grant them only the level of access needed. Accordingly, PSF is working to improve the system by separating access privileges by task, with the goal of enabling volunteers and additional staff to share security work without accessing the entire core system.

In his earlier remarks, he outlined areas where AI could be useful. He said AI could be used to analyze incoming vulnerability reports and patches, and could also help determine whether a reporter had conducted prior review. At present, classification work was identified as the most useful area for AI.

The discussion continued at "PyCon Korea 2026." "PyCon Korea 2026" was held from August 15 to 17 at Dongguk University in Jung-gu, Seoul. The photo source on site was the Korea PyCon Users Group.

The article then moved on to how AI has contributed to the expansion of the open source ecosystem. At the same time, it said AI has also driven changes in development methods.

In the following Q&A, the topic was whether AI coding is an opportunity or a threat for developers in the age of code generation. Nicholson did not define AI coding as either purely an opportunity or purely a threat.

Nicholson said it is both. He described AI as a powerful tool, but said that depending on a developer's experience and judgment, it can be either useful or a new risk.

Nicholson also said AI helps coding learners through the learning process. He said he views positively the use of AI by people teaching themselves Python.

He explained that if people trust AI too much, the time needed to build judgment through writing code from scratch and learning through trial and error becomes longer. He said this could work to the disadvantage of junior developers in the AI era.

He said the group best suited to using AI right now is experienced developers. Experienced developers already have a mental model of the expected answer, allowing them to judge whether an AI response is appropriate or contains errors.

By contrast, he said less experienced developers may lack a picture of what the answer should be. In such cases, AI output can be a shot in the dark, a guess made with little information or evidence. He said there is a chance the AI answer is correct, but there is also the possibility that important security issues are omitted and that the structure and context of the codebase are not adequately reflected. He added that without experience, it is difficult to judge whether an AI answer is appropriate.

He acknowledged the efficiency of AI use while also pointing out its limits. He said it was positive that new developers can learn skills quickly through AI use. But he also said he had seen examples in which AI suggested code revisions based on a library that does not exist. He likened that to inputting a nonexistent premise and then claiming it can be fixed with a patch, saying that such a "unicorn" does not exist.

He also said there is a need to build the ability to self-check AI output. He further called for cultivating judgment on responsible use of AI results. He stressed that because AI can make suggestions based on wrong premises, users themselves must verify them and use them responsibly.

In the latter part of the interview, the focus shifted to Korea's role. The question was framed around the conditions needed for Korea to expand its role in the Python and open source ecosystems in the AI era. Nicholson said that long-term accumulation of people and expertise within the open source ecosystem is more important than simply donating money to the foundation.

Nicholson said Korea should directly engage with the technology stack that underpins AI and technological progress. He explained that even in Europe, discussion has begun over whether all technologies should be made in the United States and whether only Americans should be able to look inside the system. He added that Korea's expanded role should also be sought not merely through financial support, but through the long-term accumulation of people and expertise within the open source ecosystem and through stronger direct ties to the technology stack.

He emphasized the need to directly review and evaluate the technology being used in one's own country. He said direct review is necessary to determine whether privacy laws and other requirements are being met, and argued for directly examining code in Korea. He also said it is necessary to assess the components of technologies provided to the public.

He then explained that government and corporate support for open source cannot be solved with money alone. He said that because of the high complexity of today's Python ecosystem, simply proposing language changes immediately after joining the community would not lead to instant agreement.

He said open source contributions require investment of both time and expertise. He added that contributors need to understand the codebase, understand the interests of the global community, and build relationships with other contributors.

He also said governments and companies need to show interest in and make efforts toward supporting the development and maintenance of open source. He added that they need to help people secure time for community activity, support the accumulation of expertise, and help them grow into trusted experts within the community.

Asked what is most important for sustaining the Python ecosystem over the next 10 years, he said a steady influx of new people is needed. He explained that Python is a project built over decades, and that some contributors who have long played key roles are preparing to retire. Accordingly, he said successors must be able to take over those roles.

He explained that in the past the codebase was smaller and the number of industries depending on Python was lower than it is now. He also said that in the past, introducing new participants could be as simple as giving them a small-teacup-level explanation of how to get started. By contrast, he said code, libraries, and stakeholders have all increased significantly today.

For that reason, he said the current project has become so complex that it can be compared to a vast "palace of code." He said that, amid these changes, the important challenge ahead is helping new developers settle into complex projects. He said it will be important going forward to help new developers understand complex structures and find their place.

Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=241610

References

• https://www.itdaily.kr/news/articleView.html?idxno=241610