> Markdown version of [/events/conference-india-2026/sessions/1978-beware-of-strangers](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1978-beware-of-strangers). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Beware of Strangers Bearing Code: Open Source Trust in the Agent Era


- **Event:** Conference India 2026

## Description

Open source has always run on a simple trust model: contributions are scarce, contributors are known, and review keeps quality high. AI broke all three assumptions at once.

Maintainers are already closing the door: some projects now ban drive-by AI PRs outright. But closing the door isn't the answer. Maintainers need to prepare their repos for AI coding assistants rather than push well-meaning contributors away.

This talk argues the OSS trust model needs five concrete operational changes.

Provenance over identity: Review the path a change took, not just who pushed it. Patterns: signed agent attestations, PR templates that surface generation context, and CI provenance checks.

Agent declaration standards: Require contributors to declare which tool generated a PR, a DCO for the agentic era. 

Layered triage: Automated reviewers handle style, security, and test coverage, giving contributors faster feedback and freeing maintainers for higher-order decisions.

Sandboxed execution for untrusted code: Test external contributions in isolated environments so a malicious or broken PR can't poison the build cache or compromise the code.

Self-healing CI: When the build breaks, an agent opens a fix PR rather than waiting for a human.

Drawing on real-world experience and lessons, this session also addresses what doesn't change: code of conduct, governance, and community health matter more than ever when contributors are non-human.

## Speaker

### [Vikram Vaswani](https://www.wearedevelopers.com/@vikram-vaswani)

Consultant


## Related talks at this congress

- [Autopsy of an Autonomous Incident: When the Agent Made It Worse](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1977-autopsy-of-an) — Navin Pai
- [Teaching AI Coding Agents to Build It Right the First Time](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1995-teaching-ai-coding) — Sajeetharan Sinnathurai
- [Beyond File Dumps: Context Engineering for Coding Agents](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1979-beyond-file-dumps) — Animesh Dutta
- [Build a Zero-Cost AI Agent in Your Browser](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1980-build-a-zero-cost-ai) — Aishwarya Mathuria, Nishant Thakur

## Watch remotely

Can’t make it to Bengaluru? Watch this session live with Pro. You also get:

- All full videos, bookmarks, and playlists
- World Congress livestreams

[See pricing](https://www.wearedevelopers.com/pricing)

## Links

- [Get tickets](https://www.wearedevelopers.com/conference-india/tickets)