Apache 2.0 vs MIT: Who rules open source in 2026

The open source world has officially traded its manifesto for a spreadsheet. We are seeing a massive, accelerating shift toward permissive licensing. Why? Because builders want to ship, not litigate. The era of ideological purity has been steamrolled by operational pragmatism. Enterprise demand is the hammer here, and it is hitting the nail of compliance hard.

According to data from RedMonk's State of Open Source Licensing report, permissive licenses now govern approximately 73% of open source components on GitHub. While this is down slightly from a previous peak of 82%, package registry data from platforms like deps.dev shows no such dip and skews even more permissive. The direction of travel remains clear: eliminate legal friction. Companies want to integrate, modify, and sell software without the ghost of a disclosure obligation haunting their repository. If you are building in the cloud or shipping AI agents, a permissive approach is increasingly becoming the only way to move at market speed.

Apache 2.0 and MIT take the throne

Two names dominate the landscape: Apache 2.0 and MIT. Together, they hold over 50% of the market, effectively becoming the default standards for modern software distribution.

The enterprise safe house: Apache 2.0

Apache 2.0 is the heavy hitter for commercial artificial intelligence. It provides what builders call enterprise-safe language. It does not just let you use the code; it grants explicit patent rights. This acts as a crucial shield against the kind of patent litigation that keeps technology executives awake at night.

Google released its Gemma 4 model family under Apache 2.0, a landmark move because it marked the first time in the Gemma family's history that models were released under a true OSI-approved open source license. Earlier versions shipped under a custom terms of use that, while relatively permissive, carried legally ambiguous restrictions that routinely stalled enterprise legal reviews. The switch to Apache 2.0 was not about charity; it was about utility. By replacing proprietary license terms with an industry-standard one, companies ensure their models become the foundation for as many commercial applications as possible. This follows a clear path set by other frontier models. If you want your AI model to be the undisputed industry standard, you give it an Apache 2.0 license.

The Swiss army knife: MIT

For tooling, agent frameworks, and libraries, MIT remains the king of simplicity. The release of Zhipu AI's massive GLM-5.1 MoE model under an MIT license reinforced this status, cementing the license as the go-to for complex AI infrastructure. The MIT license grants maximum freedom for fine-tuning, self-hosting, and commercial deployment without the overhead of patent clauses.

However, the MIT license is currently under fire from within the community. Proposals for AI-resistant addenda to permissive licenses have circulated, attempting to block AI model training without explicit permission. Critics rightly point out that once you add those kinds of behavioral strings, it is no longer an open source license. It simply becomes a contract.

The AI-driven copyleft crisis

Copyleft is not dead, but it is definitely backed into a corner. While GPLv3 still has a home in internal platforms and operating systems, it is becoming a rarity in customer-facing SaaS. Artificial intelligence is now creating a massive technical loophole that might make copyleft completely unenforceable in practice.

Take the high-profile case of chardet, a critical Python library with over 130 million downloads a month. The current maintainer used Anthropic's Claude Code to rewrite the entire library from scratch in just five days. He then flipped the license from LGPL to MIT. The logic behind this clean-room approach? If an autonomous AI rewrites the code from architectural specifications without direct access to the original source, the copyleft taint might not carry over. The original author, Mark Pilgrim, returned from a 15-year internet silence to dispute this directly, arguing that no right to relicense existed. The resulting community uproar highlighted a terrifying reality for copyleft advocates: agentic coding tools have removed the cost barrier of rewriting complex software.

The legal vacuum of AI authorship

This question of AI-generated code and copyright gained serious weight when the US Supreme Court declined to hear Thaler v. Perlmutter. By refusing certiorari, the court left intact lower rulings establishing that purely AI-generated works cannot receive copyright protection under current US law. The ruling reinforced the bedrock principle that human authorship is a strict requirement for intellectual property protection.

However, this leaves unresolved the harder question of how much human contribution is required, and whether an AI-rewritten codebase qualifies as a derivative work. If there is absolutely no copyright in purely AI-generated output, the enforceability of strict copyleft licenses against such agent-driven rewrites becomes genuinely murky legal territory.

The defensive retreat and security paradigm shift

Not everyone is happy about AI's impact on open code. Cal.com, a major open source scheduling platform, famously announced a complete shift to a closed-source model for its production codebase. The reason was not AI companies consuming their code without contributing back. The stated driver was AI-powered security threats.

Automated vulnerability scanning tools can now analyze public codebases at machine speed, dramatically lowering the barrier for attackers to find and exploit weaknesses. For example, AI recently uncovered and generated exploits for decades-old vulnerabilities in foundational security projects within hours. This dynamic effectively turns an open repository into a blueprint for automated exploitation. The company simultaneously released Cal.diy, a fully open-source version of its platform strictly for hobbyists and self-hosters, but locked down its enterprise core.

We are seeing a rapid rise of defensive plays across the broader community. For a growing number of developers, the risk of having a public codebase weaponized against them by AI-assisted attackers now outweighs the collaborative benefits of an open ecosystem. The industry is no longer just worried about software freedom; it is actively worried about software survival.