Jim Zemlin, Jonathan Bryce and Chris Aniszczyk spent an hour with press at KubeCon + CloudNativeCon NA. The best parts weren’t on the slides.
While at KubeCon + CloudNativeCon NA 2026 in Salt Lake City, Jim Zemlin said the quiet part out loud. Heading into 2026, the Linux Foundation CEO told press, his organization wasn’t sure it would have a good year. If AI agents write most of the code, he asked, what is a foundation for?
The answer turned out to be: more than ever. Zemlin has been at the Linux Foundation for 22 years, and he called this its biggest growth year. Membership is up 40% year over year, the organization hosted more than 130,000 people at events and trained over 350,000 developers, and it reports $400 million in collective value across its projects. The Agentic AI Foundation, one of the Linux Foundation’s 1,300 collaborative efforts, passed 303 members in its first year and grew from three projects to ten. Zemlin joked that it is nipping at CNCF’s heels in membership, “but not quite yet.”
A good year that nobody predicted
The reason for the worry is simple arithmetic. Zemlin said that at many Linux Foundation member companies, more than 80% of newly produced software is now written by agents. Code is plentiful and cheap.
So why is the foundation busier? His argument was that when code is cheap, trust is the expensive part. Somebody has to choose which code is worth using, check who wrote it, make sure the intellectual property is clean and decide what’s secure. That is exactly what a process like CNCF’s sandbox-to-incubation-to-graduation path was built to do. Zemlin said he’s bullish on agentic coding for that reason, even with the problems it creates.
I’ll admit the argument sounds convenient coming from a foundation. But the membership numbers back him up, and several of the specifics that followed were hard to dismiss.
When the bug reports turn out to be real
Last year’s open source headache was “AI slop,” a flood of bad vulnerability reports from automated tools. Zemlin said this year it got worse in a different way: the reports are real. He pointed to Anthropic’s Project Glasswing announcement in April as the moment people saw how capable AI tools had become at finding vulnerabilities. The tools find bugs, and they can chain them together.
The trouble is the humans on the receiving end. Maintainers are overwhelmed, with a pile of valid findings and no easy way to tell a low-severity bug from a serious one. His example was a project getting reports from many organizations at once, many of them duplicates.
The Linux Foundation’s response this summer is a project Zemlin called Akrites, named for the Byzantine frontier guards: a secure enclave where roughly ten full-time engineers from each of more than 30 companies, including the large hyperscalers and JPMorgan, triage findings together. The team de-duplicates reports, ranks them by severity and writes fixes that maintainers can accept. The first goal is to retire most of the bugs in the open source components that sit under banking, utilities, telecom and transportation. The second is to give maintainers better tooling, so new code is built securely from the start. It’s early, Zemlin said, but it’s an example of responding to the shift from cheap code to expensive trust.
Jonathan Bryce added a point I think deserves more attention. Even when an upstream patch lands quickly, can it reach production quickly? That’s what the cloud native stack was built for: going from a monthly release to dozens or hundreds of releases a day, with the software observed once it’s running. Plenty of organizations haven’t fully adopted that yet.
Why open should beat the single-vendor pitch
Here’s a question a lot of people at agent-curious companies would rather not say out loud. Many of us started with OpenClaw, Hermes and Codex on a laptop, with real company credentials already supplied. Does OpenShell help? Bryce’s answer was honest: it depends on your environment. On Linux you can use the VM isolation options it supports, and on a Mac there’s a containerization path. The first focus is the “claw”-style agents increasingly deployed in data centers, and the individual-on-a-laptop use case, he admitted, “no one’s figured out yet.” Chris Aniszczyk said he has started keeping his banking and financial accounts away from his own agent.
The obvious follow-up question? At security shows, hundreds of vendors each claim to have the one answer for agent identity and governance. How do you referee that?
Bryce didn’t hedge. Problems like this can only be solved in the open, he said, and open “always wins” in the end. He also pointed to numbers: OpenShell, created earlier this year, already has more than 300 contributing organizations. Aniszczyk added that OpenShell is mostly a handful of CNCF projects combined. Kubernetes handles workloads, SPIFFE handles identity, and Open Policy Agent handles policy.
Who owns governance? Depends which layer you mean
The question was raised, how does CNCF’s scope differs from the Agentic AI Foundation’s, and do engineers need to attend both groups’ events. The answers were refreshingly practical.
Bryce said the guiding principle is simple: who has to decide to deploy this thing? For OpenShell and Agent Substrate, it’s the people running data centers, which is why those projects came to KubeCon. Projects choose their own home, and foundations answer questions rather than assign them. Zemlin put it in layers. If you’re building an MCP server, picking a harness or designing multi-agent workflows, you go to the AAIF’s AgentCon. If you’re running the infrastructure underneath, you go to KubeCon. His analogy: app developers on one side, the people who keep the stuff running on the other.
The governance frameworks that enterprises keep asking about will probably come out of the AAIF, built from CNCF’s “Lego bricks.” Zemlin said the AAIF’s fastest-growing project is tokenomics, a way to measure whether agent productivity shows up at the company level and not just for individuals. He expects real breakthroughs in 2027, as governance matures. Bryce compared it to the early smartphone years, when IT shops panicked about phones touching Outlook and SharePoint and then built the security and authorization models in a couple of years. He thinks agents will move faster, because the payoff of a connected agent is so high.
CUDA, chips and data center anxiety
Hardware choice came up in two questions. On portability across chips, Bryce said the work mostly happens lower in the stack, in PyTorch and vLLM. Orchestrate with Kubeflow or manage inference with llm-d and you inherit that progress. Aniszczyk said nothing in Kubernetes or Dynamic Resource Allocation locks you to NVIDIA: people use TPUs and others, and that morning’s keynote demo ran on AMD GPUs at Vultr and NVIDIA GPUs at CoreWeave. The real answer, he said, depends on which layer of the stack you look at.
A reporter in the room asked whether data center builders should coordinate their message, given local backlash. Bryce said that’s up to them, but CNCF’s best contribution is the software side: stretching physical footprints further, as llm-d does. Zemlin added that the Linux Foundation educates policymakers on how open, transparent technology in many hands makes systems more efficient and more secure.
The certification push
CNCF said it’s making skills a main way it delivers value. The new Certified Kubernetes Network Engineer (CKNE) exam is now generally available. It’s a 120-minute, hands-on test in a Linux desktop environment covering five areas: core infrastructure and CNI (15%), service networking and DNS (25%), advanced traffic management (20%), network security and policy (25%) and observability (15%). CNCF also launched a five-module training pathway with Linux Foundation Education. Eight companies helped build it, including Ericsson, Infosys, Microsoft, Solo.io and Isovalent, now part of Cisco. Aniszczyk compared it to the Cisco CCNP, aimed at strong network engineers, “because distributed systems are all about networking.”
Two AI-focused credentials are planned for 2027: the Kubernetes AI Associate (KAIA), an entry point anyone in the briefing room could take, and the Certified Kubernetes Inference Engineer (CKIE), which drops you into the command line to run inference workloads. Aniszczyk said these are slow to build because you’re getting competing vendors to agree on a fair exam. An analyst in the room said vendors want certified staff and enterprise clients feel exposed. Aniszczyk pointed to the blue-jacketed certified professionals in the keynote audience, and noted the Certified Kubernetes Security Specialist pass rate is under 40%.
One thing that hasn’t gotten better
Asked about patents, Zemlin was blunt. The USPTO has scaled back inter partes review, the process the Linux Foundation and its members use to challenge patent trolls. The environment hasn’t improved, he said, and may get worse before it does. On copyright claims against AI, he said they’re still working through the courts and he wouldn’t predict the outcome.
The takeaway
One of the most useful thing I heard all day came from Bryce. CNCF has no authority over anyone here, he said; none of the people working in these halls work for the foundation. What it has is the ability to talk to a lot of people and spot where they could do something together. Based on the pace of Day 1, plenty of them are listening.
##
