Skip to content

Back to the catalog

FOSSA: Underappreciated OSS License Compliance Risk from AI Coding Tools
fossa.comarticle

FOSSA: Underappreciated OSS License Compliance Risk from AI Coding Tools

FOSSA analyzes how AI coding assistants (Copilot, Cursor, Windsurf, Claude, agentic tools) introduce open source license compliance risk in two distinct ways: memorized code snippets from training data (potentially carrying copyleft/GPL obligations) that evade traditional SCA tools since they scan manifests/lockfiles rather than source text, and AI agents autonomously installing full open source dependencies mid-session with little human review, bypassing normal dependency-intake and PR-review checkpoints. It argues legal/compliance programs built around human-driven, manifest-visible dependency additions are structurally blind to these AI-driven pathways.

TL;DR AI coding assistants can silently introduce license-encumbered code snippets and unreviewed OSS dependencies that slip past traditional SCA/manifest-based compliance checks.
Open original ↗

Organisations named here

  • GitHub Copilot duplication-detection filter

Technologies named here

  • FOSSA snippet scanning
  • GitHub Copilot
  • FOSSA core license compliance engine
  • Cursor
  • FOSSA AI Guardrails
  • Windsurf
  • Claude
  • Conventional SCA tools

Techniques named here

  • AI-generated code snippet reproduction from training data

Related in Supply Chain