--- title: Adapting open source practices to an AI-first world: A... description: Google's 2025 open source retrospective covers key milestones: roughly 10% of Alphabet's workforce contributed to open source, with top projects including... canonical: https://daily.dev/posts/adapting-open-source-practices-to-an-ai-first-world-a-retrospective-on-2025-xjxwls2hf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Adapting open source practices to an AI-first world: A retrospective on 2025 | daily.dev og:description: Google's 2025 open source retrospective covers key milestones: roughly 10% of Alphabet's workforce contributed to open source, with top projects including... og:url: https://daily.dev/posts/adapting-open-source-practices-to-an-ai-first-world-a-retrospective-on-2025-xjxwls2hf og:image: https://api.daily.dev/og/posts/xjxWlS2hf.png og:image:alt: Adapting open source practices to an AI-first world: A retrospective on 2025 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Adapting open source practices to an AI-first world: A retrospective on 2025 **[Google Open Source Blog](https://daily.dev/sources/googleoss)** · 6 min read · 1 upvotes · 0 comments ## Summary Google's 2025 open source retrospective covers key milestones: roughly 10% of Alphabet's workforce contributed to open source, with top projects including LLVM, vLLM, Kubernetes, and Rust. Highlights include the Agent2Agent (A2A) protocol donated to the Linux Foundation, the release of Gemma 3 and the Agent Development Kit, and several security initiatives — CodeMender (an AI agent that upstreamed 72 security fixes), OSS Rebuild (supply chain attack prevention), OSV-Scalibr (vulnerability scanning), and credential scanning on deps.dev. Google's OSPO also directed $2M to over 40 open source projects and ran the 21st Google Summer of Code supporting 1,280 contributors across 185 organizations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does Google's CodeMender AI agent do for open source security? CodeMender is an AI agent built by Google DeepMind that patches vulnerabilities reactively and proactively rewrites existing code to eliminate entire classes of security flaws. In its first six months of operation, it upstreamed 72 security fixes to open source projects, including fixes applied to codebases as large as 4.5 million lines of code. _Teams evaluating AI-driven security tooling follow initiatives like CodeMender through daily.dev._ ### What is Google's OSS Rebuild project and what package registries does it cover? OSS Rebuild is a security initiative that prevents software supply chain attacks by verifying build provenance. It automates rebuilding packages and semantically compares the results against upstream artifacts to detect tampered code, covering registries including PyPI, npm, and Crates.io. _Developers hardening their supply chain track projects like OSS Rebuild via daily.dev._ ### What is the Agent2Agent (A2A) protocol and who governs it now? Agent2Agent (A2A) is a protocol Google developed with more than 50 partners to let AI agents communicate securely, exchange information, and coordinate actions across enterprise platforms and applications. Within weeks of its announcement, Google donated the A2A project to the Linux Foundation to keep it as an open, collaborative ecosystem. _Anyone building interoperable AI agents can follow protocol updates like A2A on daily.dev._ ## Similar posts on daily.dev - [2024 Open Source Contributions: A Year in Review](https://daily.dev/posts/2024-open-source-contributions-a-year-in-review-o5hwkbhnd) · Google Open Source Blog · 0 upvotes · 0 comments - [What to expect for open source in 2026](https://daily.dev/posts/what-to-expect-for-open-source-in-2026-mwjch4dcn) · GitHub Blog · 1 upvotes · 0 comments - [This Week in Open Source \#15](https://daily.dev/posts/this-week-in-open-source-15-ng8qql9ww) · Google Open Source Blog · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#google](https://daily.dev/tags/google), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/adapting-open-source-practices-to-an-ai-first-world-a-retrospective-on-2025-xjxwls2hf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Adapting open source practices to an AI-first world: A retrospective on 2025","url":"https://daily.dev/posts/adapting-open-source-practices-to-an-ai-first-world-a-retrospective-on-2025-xjxwls2hf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/adapting-open-source-practices-to-an-ai-first-world-a-retrospective-on-2025-xjxwls2hf"},"datePublished":"2026-08-03T20:39:14.183Z","dateModified":"2026-09-14T09:30:42.645Z","description":"Google's 2025 open source retrospective covers key milestones: roughly 10% of Alphabet's workforce contributed to open source, with top projects including...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/46b860d3897f07c227d437d76d899840?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/46b860d3897f07c227d437d76d899840?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Google Open Source Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Google Open Source Blog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8a87f457bf1a481b80c313f66a71200b","url":"https://daily.dev/sources/googleoss"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/adapting-open-source-practices-to-an-ai-first-world-a-retrospective-on-2025-xjxwls2hf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,google,ai-agents","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Google Open Source Blog","item":"https://daily.dev/sources/googleoss"},{"@type":"ListItem","position":3,"name":"Adapting open source practices to an AI-first world: A retrospective on 2025"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/adapting-open-source-practices-to-an-ai-first-world-a-retrospective-on-2025-xjxwls2hf#faq","mainEntity":[{"@type":"Question","name":"What does Google's CodeMender AI agent do for open source security?","acceptedAnswer":{"@type":"Answer","text":"CodeMender is an AI agent built by Google DeepMind that patches vulnerabilities reactively and proactively rewrites existing code to eliminate entire classes of security flaws. In its first six months of operation, it upstreamed 72 security fixes to open source projects, including fixes applied to codebases as large as 4.5 million lines of code. Teams evaluating AI-driven security tooling follow initiatives like CodeMender through daily.dev."}},{"@type":"Question","name":"What is Google's OSS Rebuild project and what package registries does it cover?","acceptedAnswer":{"@type":"Answer","text":"OSS Rebuild is a security initiative that prevents software supply chain attacks by verifying build provenance. It automates rebuilding packages and semantically compares the results against upstream artifacts to detect tampered code, covering registries including PyPI, npm, and Crates.io. Developers hardening their supply chain track projects like OSS Rebuild via daily.dev."}},{"@type":"Question","name":"What is the Agent2Agent (A2A) protocol and who governs it now?","acceptedAnswer":{"@type":"Answer","text":"Agent2Agent (A2A) is a protocol Google developed with more than 50 partners to let AI agents communicate securely, exchange information, and coordinate actions across enterprise platforms and applications. Within weeks of its announcement, Google donated the A2A project to the Linux Foundation to keep it as an open, collaborative ecosystem. Anyone building interoperable AI agents can follow protocol updates like A2A on daily.dev."}}]} ```