Open Source Is Not Dead

As Cal.com switched its core code to private, citing the threat of automated AI-based vulnerability detection, it sparked a debate over open source security strategy.

Background of Cal.com's Decision Cal.com judged that as AI becomes able to automatically detect vulnerabilities at scale for near-'zero cost,' we have entered an era where making source code public directly leads to security exposure.

Strix's Counterargument: "Closing the Code Is Not the Solution" Strix, an autonomous AI security agent project, opposes the private-code strategy for the following reasons.

• Possibility of black-box attacks: Autonomous AI agents can find vulnerabilities even without code access, through manipulation of endpoints, network traffic, and browser state.
• Limits of security through obscurity: Hiding code cannot keep pace with the speed of automated attacks carried out 24/7 by attackers' AI bots.
• Blocking review opportunities: Switching to private code deprives well-intentioned developers of the chance to discover and contribute fixes for security flaws.

A New Security Strategy for the AI Era The real solution is not to hide code, but to integrate AI defense into the development process.

• AI-based Continuous Validation: When a developer creates a Pull Request or changes infrastructure, AI should immediately attempt attacks to validate vulnerabilities.
• CI/CD Integration: Security testing should be automated to build an internal automation response system that is faster than attack automation.