Don’t Download an AI Agent Until You Know What You’re Really Bringing Into Your System!

GitHub is a platform for publishing and sharing code, but publicly visible source code does not automatically mean that anyone is free to use it for any purpose. The licence defines what users are allowed to do with the software, and without a licence granting those rights, the situation may be far more restrictive than it first appears.

AI can make copying, modifying and deploying code extremely easy, but technical convenience does not change the underlying usage rights.

Code can be fully visible on GitHub while its licence still restricts commercial or production use. Open source and source available are therefore not interchangeable terms. This distinction becomes particularly important in AI development because an agent can inspect, modify and install both types of software just as easily, even though the legal conditions governing their use may be very different.

Modern software is rarely a single, isolated block of code. An AI agent may depend on frameworks, libraries, bundled components and other third-party dependencies governed by different licences.

As a result, the licence shown at the root of a repository may not fully describe the rights attached to every component that eventually becomes part of your system.

Licensing answers one question: what are you allowed to do with the software? Security asks another: what are you allowing the software to do inside your environment? An agent, skill, plugin or MCP server may be far more than a passive collection of files. Its significance depends on the systems, data and capabilities it can access, which means adding a new component also means establishing a new trust relationship.

The same component can represent very different levels of risk depending on the environment in which it operates. Access to local files, network connections, environment variables, APIs, credentials or external tools expands the area that the component can influence.

In an agentic system, the question is therefore not simply whether the code itself is malicious, but what authority the surrounding environment gives it.

Traditional software security often focuses on whether a program executes harmful code. Agentic systems introduce another dimension: external content can potentially influence how an AI interprets a situation and what it decides to do next. When a system uses persistent memory or long-lived context, the origin and trustworthiness of the information stored there become part of the security model as well.

Software supply-chain risk is not new, but AI is expanding what the supply chain contains. In addition to conventional libraries and packages, modern systems may incorporate agents, skills, MCP servers, memory layers, RAG components, prompt packages and other elements that shape AI behaviour.

The easier these components become to install, the more important it becomes to understand where the critical parts of your system came from.

A component that appears technically safe is not automatically licensed for your intended use. Likewise, software that permits commercial use is not automatically safe to run in your environment. These are two parallel questions: Do we have the right to use this, and can we trust it in this particular system? Focusing on only one side creates a blind spot on the other.

Vibe coding is not inherently unsafe. What it does is remove much of the technical friction that once slowed down the adoption of unfamiliar software and forced developers to investigate components more closely.

When AI handles much of the integration work, part of the developer’s responsibility shifts from writing code toward understanding trust, provenance, permissions and the consequences of bringing external components into the system.

AI agents, GitHub and vibe coding can accelerate software development dramatically, but speed does not change software licences or eliminate technical trust relationships. In fact, the easier it becomes to import external components, the more valuable it becomes to understand what is actually entering the system.

The important question is no longer just “Does this work?” It is also “Under what rights does it work, and what is it allowed to access?”