The enterprise software industry has long sold companies on the idea that open source offers something proprietary software cannot, giving them greater control over the technology they rely on while avoiding dependence on a single vendor. However, rapid advances in AI are putting pressure on that bargain, as software decisions increasingly shift from developers to AI systems that can make and act on them faster than humans can review.
A USENIX Security study that analyzed 576,000 code samples generated by 16 large language models found that 19.7% of the recommended packages did not exist, producing more than 205,000 unique hallucinated package names; in repeated tests, 43% of those names appeared consistently, suggesting that some AI-generated dependencies are predictable enough to become targets for software supply chain attacks.
MariaDB CEO Rohit De Souza sees this growing software supply chain risk as a reason for enterprises to adopt what he calls “curated open source,” an approach that keeps the flexibility of open-source software while adding the security and accountability needed to manage AI-generated code at enterprise scale.
“As AI agents increasingly generate code, select dependencies and take actions that humans may never inspect line by line, provenance, validation and governance become much more consequential,” he told me. “Enterprises need confidence in what is entering their environments and someone accountable for it. So curated open source isn’t about putting a new label on an old model. AI is making curation a fundamental enterprise requirement.”
That distinction, however, also creates a challenge for MariaDB. The company wants to help enterprises decide which software they can trust, but taking on that role could also give it more control over the technology customers use. That could recreate the kind of vendor dependence that open source is meant to avoid.
De Souza suggests using a simple test that can also be applied to MariaDB.
“If ‘curation’ simply means replacing one company that controls your technology with another, then we’ve missed the point. The test I would apply is if I stop buying from you tomorrow, how much control do I still have? At the end of the day, curation should be an accountability layer, not a control layer.”
Expanding the Database Platform for Agentic AI Era
MariaDB has been expanding beyond its core database business, acquiring Galera Cluster and repurchasing SkySQL in 2025 before launching Enterprise Platform 2026 with transactional, analytical and vector capabilities alongside RAG and AI features. In March 2026, it added GridGain Systems, bringing in-memory computing technology associated with Apache Ignite into a broader platform designed for agentic AI.
“By uniting MariaDB’s platform with GridGain’s in-memory data grid, we are entering a new weight class. This enables us to provide a high-performance, scalable, open alternative to the rigid lock-in of Oracle and the fragmented complexity of hyperscalers,” De Souza says. “For the last 18 months, we have been building MariaDB for the agentic era.”
That broader approach also shapes how MariaDB thinks about curated open source, with the company combining an open foundation with the technology, security and support enterprises need to run it at scale.
For instance, MariaDB moved MaxScale 25.01 and later versions from the Business Source License to a fully proprietary commercial license on Jan. 16, 2025. MaxScale is a database proxy that sits between applications and MariaDB databases, directing traffic and helping keep databases available during failures. De Souza says that commercial layer does not change MariaDB’s commitment to an open foundation.
“Advocating openness doesn’t mean every piece of software a company develops has to use the same licensing model forever. The line I draw is around the foundation and the customer’s freedom. MariaDB Server’s community foundation remains open source. Around that foundation, we provide the additional technology, support and expertise enterprises need to run mission-critical systems with confidence.”
He says the commercial model allows MariaDB to continue investing in the engineering, security and support that enterprise customers require while keeping the underlying database open. For De Souza, the principle is straightforward: customers should pay for enterprise capabilities, but they should retain control of the technology underneath them.
“You shouldn’t use commercial licensing to trap customers in technology they can no longer control or realistically leave. That’s the standard I think companies should be held to, including MariaDB,” he says.
De Souza does not see curated open source as a one-size-fits-all approach for every enterprise. He says companies with the engineering expertise to build, secure and maintain their own technology stack may still prefer that approach, particularly when controlling those components gives them a meaningful advantage.
“If you’re a technically sophisticated organization with the engineering resources to assemble, secure and operate best-of-breed components yourself, and the differentiation you get from doing that is worth the complexity, you may be better off doing exactly that,” he says. “That’s one of the freedoms open source gives you.”
The Control Layer Verdict
As AI systems generate more code and make more technical decisions, De Souza sees curated open source as a way to give enterprises greater confidence in what they deploy while preserving the flexibility and choice that open source provides. For MariaDB, the goal is to make open source easier to trust and operate as AI pushes more software decisions into the hands of machines.
