Open source monetisation: what this week's releases say about paying for free code

OpenAI published new bounty terms on 3 November. Critical flaws in products such as ChatGPT or Codex now pay outside researchers up to $30,000. Exceptional findings pay up to $100,000. Quality, loyalty and campaign bonuses can push a single payout to roughly $172,000, according to The Decoder. Anyone who reported a vulnerability in the previous 30 days gets the difference backdated.

That is not charity. A company pays to keep a commercial product standing. It is one of the few places in this week's news where the money flow is easy to follow.

The harder question sits underneath most of the open source items: who funds the code, and what do they get? The Register reported on 3 November that cloud architect Andrija Panić built OpenVDDK, a from-scratch replacement for VMware's Virtual Disk Development Kit. Broadcom restricted public downloads of the kit in August. Panić wrote it in Go with a thin C layer that exposes the same library name and symbol versions as VMware's code. He says it contains no VMware code. He told The Register that testers have reported production use, including a German cloud provider migrating a large file server. He also stressed those reports are "not independently audited customer endorsements."

Panić's motive was not a business model. "I didn't think it was fair that people's ability to move or protect their own data should depend on a download page," he told The Register. That is the awkward part of the monetisation debate. A vendor tightens access to a tool, and a volunteer rebuilds it in his own time. No licence fee changes hands, and no revenue is replaced.

Free code, paid plumbing

Compare that with Cisco. The Register reported on 28 October that Cisco open sourced Project Quarry, a behaviour detection engine for AI agents. Cisco pitches it as a shared language for spotting rogue agent sessions, the way Snort did for network traffic. Amy Chang heads AI threat and security research at Cisco. She told The Register in an interview that single tool calls can look in scope until the next step ships data to an attacker-controlled inbox.

The risk comes from the relationship between the two actions, so the finding should preserve evidence from both.

That line comes from a Cisco blog post shared with The Register ahead of publication. The code is free; the credibility, the rule packs and the enterprise relationships are not. Cisco also maintains Snort, which is the template.

Nvidia took a similar route on 3 November. It published Auto Ontology under Apache 2.0, a Python framework that builds a semantic layer over enterprise metadata. The framework exposes that layer to agents through MCP, CLI and API. The repository states the project is not accepting external contributions. Free to use, controlled by the vendor.

Smaller outfits are testing whether hosted versions of free code can pay. A post at userecurrence.ai on 3 November asks directly whether hosting an open source inference engine is profitable. deepsense.ai argued on 29 October that as code gets cheaper, judgement becomes the scarce input in enterprise AI. Neither offers a clean answer.

The rebrand next door

OpenAI's week was mostly about positioning. On Monday it launched a Grid Protectors Program. In a roughly 900 word announcement it used the phrase "compute campus" far more often than "data center", The Verge reported on 3 November. Tom's Hardware reported on 2 November that Axios had described the rename as part of a push ahead of the midterms. Chris Lehane, OpenAI's chief global affairs officer, called the midterms "a bit of a movie trailer for what you're going to see in 2028."

Holly Elmore of PauseAI US told The Verge that the problem is not the label. "It's the giant, polluting construction projects," she said.

Money and politics also moved on 3 November. OpenAI hired former Army Secretary Dan Driscoll as Senior Counselor for National Security Modernization, per The Decoder and CNBC. The hire followed a February 2026 Pentagon deal for classified networks. On 2 November CNBC reported Altman signing Abu Dhabi deals spanning energy, government and investment.

None of that is open source. It is the context in which free code now gets paid for: bounties, hosted services, support contracts and government relationships. The licence stays permissive, and the vendor keeps the upper hand.