# Open Source Is Dead. Long Live Open Source. — Saoud Rizwan, Cline AI Engineer · 2026-08-07 Saoud Rizwan, founder of Cline, argues that AI has killed the community side of open source while open weights models win on economics. He cites Zig banning AI from PRs, curl weighing shutdown of its bug bounty over AI-generated reports, and tldraw auto-closing pull requests, plus a LiteLLM compromise that stole credentials for three hours. Rizwan makes the case that closed labs' subsidized subscriptions lead to lock-in and price gouging, while open models like GLM match or beat Opus on cost and code quality — GLM used twice the tokens at half the cost and fixed a real Cline bug that Opus's faster fix left broken. He compares open weights to Facebook's Open Compute project and urges American labs to release open weights before foreign models become the standard. ## Questions this episode answers ### What does Saoud Rizwan mean when he says 'open source is dead'? Saoud argues that the community half of open source has died because AI-generated spam and supply chain attacks have eroded trust. Projects like Zig ban AI contributions, curl is overwhelmed by AI bug reports, and tldraw auto-closes PRs. GitHub even added a feature to disable third-party pull requests. However, he believes open weights models will thrive because sharing code and weights freely offers economic benefits that community-driven development no longer provides. [3:46](https://aiengineer.podhood.com/a58695b0-29d0-437d-8241-3b2ed1cb9296?t=226000) ### How did Cline's test of GLM versus Opus on a real bug turn out? Saoud's team tested both models on a real Cline repository bug. GLM spent twice as many tokens but cost half as much as Opus. Opus finished faster with half the tool calls, but GLM cleaned up dead code and verified the build compiled, while Opus left type errors that broke the production build. This made GLM the winner in cost and code quality, showing that cheaper open weights models can match or beat expensive frontier models. [9:46](https://aiengineer.podhood.com/a58695b0-29d0-437d-8241-3b2ed1cb9296?t=586000) ### What happened in the LiteLLM supply chain attack and how was it discovered? LiteLLM, a Python package with 3.5 million daily downloads, was compromised for three hours. Attackers used a GitHub app to steal PyPI publishing tokens and released a version that installed a credential harvester (for API keys, SSH keys, and crypto keys) and a remote execution backdoor. It was caught by sheer luck when a security researcher noticed the malware caused Cursor to crash, revealing the breach before catastrophic damage spread to enterprise customers. [4:21](https://aiengineer.podhood.com/a58695b0-29d0-437d-8241-3b2ed1cb9296?t=261000) ## Key moments - **[0:00] Intro** - [0:13] Cline users paid hundreds of dollars per day for API requests before prompt caching, giving many their first AGI moment. - **[1:47] Community's End** - [2:16] Zig's code of conduct bans AI in pull requests, issues, and comments because the team values growing contributors over collecting contributions. - **[3:46] Supply Chain Risk** - [3:46] Saoud Rizwan: "When I say that open source is dead, I mean some parts of it, like the community." - **[5:24] Economic Gravity** - [5:44] An anonymous CFO reports accidentally spending $500 million on Claude in a single month by not setting usage limits. - [6:27] SemiAnalysis finds a $200 Claude plan gives $8,000 worth of API usage, while a $200 Codex plan gives $14,000, showing labs subsidize heavily. - [8:27] Chinese open weights models reach an inflection point where raw intelligence lead matters less than cost; businesses prioritize value. - **[9:28] Real-World Test** - [9:46] GLM used twice as many tokens as Opus but cost half, cleaned up dead code and verified build while Opus left type errors and broke production build. - **[10:18] Adoption Wave** - [10:18] Coinbase CEO Brian Armstrong says defaulting internal LLM gateway to GLM and Kimi cut AI spend nearly in half while token usage grows. - [10:58] Facebook gave away data center designs through Open Compute; supply chain standardized, costs fell, saving Facebook billions of dollars. - [13:59] Open weights models enable hosting provider competition, likely leading to mass adoption of foreign models as closed labs' API costs become unviable. - **[14:23] Plea for Openness** - [14:23] Saoud Rizwan urges American labs to release more open weights models to prevent foreign models from becoming the standard and losing control over technology development. - **[15:55] Cline's Path** - [15:55] Cline launches an open weights subscription plan with volume discounts, demonstrating commitment to cheaper open weights model access. ## Speakers - **Saoud Rizwan** (guest) ## Topics AI Strategy ## Mentioned Anthropic (company), Coinbase (company), Fireworks (company), Google (company), OpenAI (company), base10 (company), Claude (product), Cline (product), Codex (product), Cursor (product), DeepSeek (product), GLM (product), GPT (product), GitHub (product), Kimi (product), LiteLLM (product), Open Compute (product), TLDraw (product), Zig (product), curl (product) ## Transcript ### Intro **Saoud Rizwan** [0:13] Hi, I am Saoud, um, founder of Cline. I started Cline as an open-source project a few years ago. Some of you might know it as the first-ever coding agent, back before the Cloud Max subscription and the Codex subscriptions, when people had to pay for each and every API request, which got extremely expensive. This was before prompt caching became a thing, and so there were people that paid hundreds of dollars a day using Cline. But for a lot of people, it was their first AGI moment. It was the first time they saw LLMs be able to do their jobs end-to-end, and they got hooked. And I don't think Cline would have been as successful as it is if it wasn't open-source, because it allowed these developers to inspect their code and trust it and connect to any API so they could be comfortable with spending so much money on it and know that they weren't getting screwed over. And we were the first to add things like custom rules and plan mode, and a lot of that came from talking to and learning from this really incredible open-source community we had around the project. And so, you know, having spent most of my life building open source, it's really heartbreaking to see just, like, the broader open-source community wither and die over the last 2 years because of how AI has fundamentally changed everything about software development. GitHub is effectively an archive of SLOP PRs and issues and security reports, where the sense of community before has turned into this, like, deep skepticism and distrust of each other's responsible use of these tools. Because AI coding can be extremely dangerous to a project, and everyone's kind of had to learn that on the fly, but especially open-source projects that rely on trusting third parties. ### Community's End **Saoud Rizwan** [2:16] And so I wanted to share some examples of how open source has been dealing with AI. So this is the code of conduct for Zig, which is the language that powers Bun. And they essentially ban all use of AI. You can't use it on pull requests or issues or even comments. And the reason for this is that, to them, the core Zig team, they value contributors more than they do the contributions. And so the primary goal for reviewing PRs and things isn't to add new code, but it's to help grow new contributors who can become trusted over time, and AI assistance completely breaks that. This is a post from the CEO of curl, who says that his project is effectively being DDoSed by AI-generated bug reports, and they're even considering shutting down their bug bounty program for the first time in decades. And this is tldraw. They're automatically just closing all pull requests, whether they're AI-generated or not. And it's gone so bad that GitHub added a feature to disable third-party pull requests altogether, which is really sad because pull requests were the thing that made GitHub what it is today, and we're probably going to see a lot of big open-source projects opt into this. And so when I say that open source is dead, I mean some parts of it, like the community. It's just not worth cultivating anymore, especially because building software is so cheap. And also the risk of supply chain attacks. ### Supply Chain Risk **Saoud Rizwan** [4:02] I'm sure you've seen all the reports of things getting compromised. It's become more dangerous than ever to depend on third-party software, where it takes a single compromise and a massive chain of contributors to get poned. So just as an example, LiteLLM is a Python package. It gets, like, 3.5 million downloads a day. They were compromised for 3 hours where attackers used a GitHub app that they used to steal their PyPI publishing tokens and publish a compromised version of the package that would install a credential harvester that would steal your API keys, your SSH keys, your crypto keys, and also install a backdoor that lets them do remote command execution. And the only reason this was even caught, as quickly as it was, was just pure luck, because the malware had a bug in it where it would cause Cursor to crash if you ran the LiteLLM MCP server. And a security researcher noticed that and was able to figure it out, but if this had been out any longer, it would have caused, like, catastrophic damage, especially because a lot of the people using LiteLLM are, like, the enterprise customers and developers that have their own internal gateways. But despite all of this, I believe there are some parts of open source that are sticking around and becoming more important, like allowing others to use your thing freely in the public domain and build on top of. And those parts about it are going to become more important than ever, particularly with open weights models because of the economic impact. ### Economic Gravity **Saoud Rizwan** [5:44] And so to help explain why, I want to look at what's happening with inference spendright now. So this is a report from an anonymous report from a CFO at an unnamed company where they accidentally spent $500 million on Claude in a single month because they didn't set the usage limits on their thousands of employees on their Anthropic dashboard. This is another report by Uber's CTO where after they rolled Claude out to their organization, 95% of their engineers were using it, 70% of their committed code came from Claude, and their monthly spend per user was up to $2,000, and they said they used their entire 2026 budget in just 4 months. And the crazy part is that the AI labs are losing money too. This is a chart from SemiAnalysis where they ran experiments with Claude code and Codex subscriptions, where they would give them long horizon coding tasks until they exhausted their weekly limits, and they found that a $200 plan for Claude would give them about $8,000 worth of API usage, and a $200 subscription to Codex would give them about $14,000 worth of API usage. So I think the strategy is pretty obvious. They're essentially going to subsidize this until they have as many engineers dependent on their tooling as possible with agents in their CI and background Cloud agents and looping agents and all these things where it feels like every new feature and marketing push from these labs seem to be a new workflow to standardize on, to use even more tokens, and to be locked in even more. And then inevitably, the price gouging once they've got you trapped where your developers can't work without the tools. And this isn't theoretical. We're seeing this happen live with some of the customers that we talked to. So just a quick show of hands, how many of you basically stop working whenever there's a Claude outage? Or a GPT outage? Yeah, same. I think that's a reason why we've seen Anthropic and OpenAI go from being API businesses to investing so much into the application layer. It's because they know that that's where they can set these sorts of traps and build their moat for the day that these models inevitably become a commodity. But I don't actually think the strategy is going to work, and that's the message I wanted to get across today, that this feels very short-sighted. And what we're noticing happen in the world is that it doesn't matter how many features your CLI agent has, developers and businesses will just jump to whatever offers them the best value for their dollars. So if we look at current open weights models, many of which are built in China, we'll notice that although they've lagged behind the American closed-source competitors, we're at an inflection point where raw intelligence lead doesn't matter as much anymore because these models are powerful enough where you don't always need the best one for all your work. And that cost is becoming extremely important to these businesses that have kind of turned a blind eye until now. And I think we all kind of feel it, that to get the best output from these models, it's more a problem of what context and tools you give the agent access to and less about its raw intelligence. With theright AI-native development infrastructure, with project skills and rules, systems of verification, and quality gates, even a mediocre model can produce similar results as a more intelligent model. It just might take more tokens. The intelligence is better placed in the system and guardrails around the model so that you don't have to be as reliant on the model or your end developers' responsible use of the model itself. ### Real-World Test **Saoud Rizwan** [9:28] So we recently shared an anecdotal experience where we were skeptical of the benchmark saying that GLM was better than Opus. So we tested them on a real bug from the Cline repo, and while both models fixed the issue, GLM was the winner in terms of cost and code quality. So GLM used twice as many tokens but only cost half as much. Opus finished faster. It used half as many tool calls. But GLM cleaned up dead code and verified that the build compiled before completing, while Opus didn't. It left a bunch of type errors and it broke the production build. And so that gave us the sense that GLM was trained to spend more tokens verifying its output, which is fine because the tokens are cheaper anyways, and it's really the end result that matters. ### Adoption Wave **Saoud Rizwan** [10:18] And because these open weights models can deliver the same output, a little bit more tokens, we're seeing signs of the industry adopting and standardizing on these models. So this is Brian Armstrong, the CEO of Coinbase, saying that they've defaulted to using GLM and Kimi in their internal LLM gateway and that this has cut their AI spend by nearly half, while their token usage continues to grow. And I think we'll see other businesses building their own internal tooling and routing to work with these agents in the most dollar-efficient way for them, even if it means not having access to the latest new feature in something like Claude code. We're seeing the same thing that happened with Open Compute 15 years ago. So just a quick history lesson for those that haven't heard of this. In 2011, Facebook was just getting started on building out stuff like distributed computing infrastructure and data centers. But by the time they built it, Amazon and Google already beat them to the punch, so it wasn't a competitive advantage. So Mark said, "Allright, let's just open source it and see what happens." So they took the designs for their data centers and their servers and their networking and cooling racks and all the physical hardware they spent all this energy and money building, and they just gave it away. They published schematics and CAD files and everything and called it the Open Compute project. And what they saw was that the entire supply chain reorganized around it. So before Open Compute, every company designed its own proprietary servers, so manufacturers were doing small production runs of, like, very custom hardware, which was expensive. But when Facebook's designs became this sort of shared open standard, suddenly everyone was ordering the same thing. And manufacturers could do these massive standardized production runs, commoditizing these components, so no single vendor could charge a premium. And the price of everything came down for the whole industry, including Facebook itself. And so what Facebook found was by giving these designs away, they created the market that drove their own costs down and saved them billions of dollars down the road. And so I think the lesson taught here is that the industry will adopt and standardize on something that they can build on top of, even if it isn't the best thing. And with how much CapEx we've locked in for the next 5 years for AI infrastructure buildout, open weights models are only going to get cheaper. There's estimates that we'll spend nearly $3 trillion and create over 100 gigawatts of new data center capacity by 2030, roughly doubling global capacity today. And hosting providers like Base10 and Fireworks, their whole purpose is to beat each other, to beat the competition. So they'll use infrastructure efficiency gains like dedicated hardware and caching and batching volume tricks and inference specialized silicon to drive costs down even more. And by 2030, the estimates are that inference on a 1 trillion parameter LLM will cost 90% less than it does today. We're seeing the same sort of cost-cutting tricks that commoditized the Cloud 10 years ago happening in inference. So in 2014, Google at their GCP live March announcement said that they would cut compute by 32% and storage by 68%. And AWS fired back with similar cuts within days. And this was AWS's 42nd price cut at that point. And so from 2015 onwards, once raw compute and storage were a commodity, the hyperscalers stopped competing on it as much and started competing on other things, like databases and serverless. And I think because open weights allows these host providers to compete and cost-optimize so aggressively, we'll see mass adoption of these foreign open weights models because when dollars are involved, the markets are extremely efficient. And the absurd API costs that these closed labs charge just won't be worth it anymore for most knowledge work. And so this is me just, like, humbly requesting the American labs to take open weights more seriously because before we know it, all this infrastructure that we're investing in could be built on foreign models that take the world by a storm and make GPT and Claude irrelevant. ### Plea for Openness **Saoud Rizwan** [14:40] Mindshare and adoption is incredibly important, and there's a chance that if the foreign models become the standard, there won't be a reason to switch back to GPT or Claude or Gemini, no matter what the marginal improvements are. And then we lose control over the development of this technology. And who knows where the world is headed if we don't have the likes of Anthropic and OpenAI to invest so heavily into safety research in ways that perhaps these other labs wouldn't. I think the development of a technology this transformative is deeply tied to the ideals of the people and the nation that's building it. And to instill those values in the future of this technology, we need to keep the lead. So I don't mean we need to open source our research. I think that's what gives us the lead. I think we need to open we need to open up our models and start releasing more open weights models, which, as we know, are not nearly as useful. You can use and extract the traces and train more, you know, your copycat models on them more easily, but not in a way that can leapfrog. And this would make models more usable by the industry in a way that allows more competition and adoption and better price and value for customers. ### Cline's Path **Saoud Rizwan** [15:55] And I think that's how we keep our lead during this very critical moment. Me and Cline believe so much in this open weights future that we launched an open weights subscription plan earlier this week that through volume-based discounts and partnerships with inference host providers, we can offer significant discounts compared to paying for these models at direct API cost. And we plan on continuing to increase the usage quota for these models as they become cheaper. You can sign up at that link, cline.bot/pass, if you'd like to get a feel for how far models like GLM and DeepSeek have come and how you don't need the most expensive closed frontier model access to get work done anymore. Cline is also open source, and you can bring your own API key and use any other provider. You can use it on your CLI and VS Code and JetBrains. And yeah, we continue to add the newest models whenever they're released. So it's a good way to get a feel of, like, how much better the latest newest model is, especially with open weights because you can't access those with, like, the Claude or ChatGPT subscriptions. Cool. That is my presentation. Thank you. --- This library is powered by PodHood (https://podhood.com), the podcast website platform.