NDSS SafeOSE '27

An open-source ecosystem (OSE) is not a single open-source project, repository, or software dependency. It is the broader socio-technical system organized around one or more shared open-source products, standards, protocols, platforms, or connected technical artifacts. An OSE includes those artifacts together with the organizations and governance structures that guide them; the contributors, maintainers, and developers who create them; the users and downstream adopters who depend on them; the development, maintenance, integration, and deployment infrastructure that supports them; and the applications through which they are used.

NDSS SafeOSE therefore studies security at the ecosystem level, with an emphasis on advancing cybersecurity research, developing generalizable security principles and techniques, and translating promising approaches into practical open-source and standards-based mechanisms. Software supply-chain risks are an important part of this problem, but the scope is broader: it also encompasses shared standards and protocols, reference implementations, governance and maintenance processes, contributor and user interactions, ecosystem-wide trust relationships, and real-world deployment. Weaknesses in these common foundations can propagate across organizations, products, applications, and users.

This challenge is visible in standardized IoT and increasingly urgent in open-source AI-agent ecosystems, where independently developed agents communicate, delegate tasks, and access tools through shared protocols and frameworks. These are two prominent examples, not boundaries on the workshop's scope. NDSS SafeOSE encompasses open-source and/or standards-driven ecosystems across AI systems and infrastructure, data systems, software, applications, scientific and engineering processes, and emerging technologies. NDSS SafeOSE aims to build a sustained community around their security, privacy, safety, and trustworthiness, bringing together security, systems, and AI researchers; standards developers; open-source maintainers; industry practitioners; and downstream adopters.