Cal.com closes commercial codebase, sparks security debate

Reporting by The Register says Cal.com has closed its commercial codebase and moved its main program from AGPL-3.0 to a proprietary license, a shift the article links to concerns about AI-driven vulnerability discovery. The Register quotes Punfleet saying, "AI attackers are flaunting that transparency," and adds a reported line, "And now there are 100× more hackers studying the blueprint." The Register also cites security reports that claim a 107 percent surge in open source vulnerabilities per codebase and quotes Jason Schmitt, CEO of Black Duck, saying, "The pace at which software is created now exceeds the pace at which most organizations can secure it."

Reporting from Black Hat Asia (via The Register) says Ari Herbert-Voss, CEO of RunSybil and OpenAI's first security hire, told the conference that open source models can find bugs as effectively as Anthropic's Mythos when multiple models are run together under orchestration. Herbert-Voss is quoted describing supralinear scaling in model capability and arguing that combining models with toolchains can produce complementary detections and reduce single-model blind spots. The report also frames cost and access as drivers: Mythos is described as tightly restricted and expensive, making open alternatives attractive for many organizations.

The Register's opinion piece places Cal.com's licensing change into a larger debate about transparency versus attack surface in the age of generative AI. The article restates a variant of Linus's Law as "given enough tokens, all bugs are shallow," noting both the increased speed of bug discovery using LLMs and the potential for defenders to use the same tooling to accelerate patching. Public comments from security vendors and practitioners quoted in the coverage highlight a tension between faster automated detection and the operational burden of triage and remediation.

For practitioners:

• •Adoption patterns for proprietary versus copyleft licenses in projects that have security-sensitive commercial offerings.
• •Emergence of open source "scaffolding" toolchains that orchestrate multiple models for bug finding and the degree to which those toolchains reduce false positives.
• •Evidence in public disclosures of attackers using LLM-driven workflows to find vulnerabilities and corresponding changes in vulnerability reporting timelines.
• •Vendor claims about detection rates for closed models like Mythos versus ensembles of open models, and independent tests that validate those claims.