Google published its annual open source retrospective this week, revealing that roughly 10% of Alphabet’s full-time workforce actively contributed to open source projects in 2025 and that its Open Source Programs Office directed $2 million in sponsorships to more than 40 projects during the year.
The report, posted to the Google Open Source Blog on August 4, is the company’s most detailed accounting yet of how its workforce engages with the broader developer community.
Scale of Alphabet’s contributions
Roughly 10% of Alphabet’s full-time workforce actively contributed to open source projects during 2025. That contribution ratio has remained steady over the past five years, scaling to match the company’s growth. The report notes that activity counts attributed to Alphabet open source contributors include full-time employees as well as temps, vendors, contractors, and interns; in 2025, full-time employees represented more than 95% of those contributors.
In addition, Alphabet projects received commits from more than 20,000 non-Alphabet-affiliated user accounts.
Google continues to maintain public repositories on GitHub and on Git-on-Borg. Top projects by unique contributors include community-led efforts such as LLVM, vLLM, Envoy, and Rust, as well as Google-initiated projects like Kubernetes, Apache Beam, and gRPC.
Agent2Agent protocol and interoperability push
One of the report’s most significant developer-tools milestones involves the Agent2Agent (A2A) protocol, an open standard designed to let AI agents built on different frameworks communicate and coordinate across enterprise platforms.
In 2025, Google worked with more than 50 partners on the A2A protocol to enable AI agents to communicate with each other, securely exchange information, and coordinate actions on top of various enterprise platforms and applications.
On June 23, 2025, at the Open Source Summit North America in Denver, Google officially donated the A2A protocol to the Linux Foundation, establishing it as a vendor-neutral, community-governed standard.
A separate Google blog post marking the one-year anniversary of A2A, published in April 2026, reported major adoption milestones. The Linux Foundation announced major adoption milestones at the protocol’s one-year mark, with more than 150 organizations supporting the standard, deep integration across Google, Microsoft, and AWS platforms, and active production deployments across multiple industries. In less than a year, A2A moved from initial release to a production-ready open standard.
The core repository has surpassed 22,000 GitHub stars, and the SDK ecosystem has expanded from a single Python implementation to five production-ready languages, including JavaScript, Java, Go, and .NET. The A2A project is complementary to the Model Context Protocol (MCP), also a Linux Foundation project. A2A defines how agents communicate and coordinate with each other across organizational boundaries, while MCP defines how agents connect to internal tools and data sources.
This kind of vendor-neutral, multi-stakeholder governance model mirrors the approach Google previously used with Kubernetes, now the de-facto standard for container orchestration across the industry and a subject GCN has tracked in the context of data center infrastructure demand.
Security tools and supply-chain protection
The retrospective dedicates significant space to security, an area where open source maintainers have faced growing pressure since high-profile supply-chain incidents in recent years.
OSS Rebuild, a security initiative to prevent software supply-chain attacks by verifying build provenance, automates package rebuilding and semantically compares results to upstream artifacts to detect tampered code on registries like PyPI, npm, and Crates.io.
As the threat landscape evolves and accelerates in the AI era, Google is working on solutions to mitigate vulnerabilities at scale and reduce some of the burden on open source maintainers.
In 2025, the company introduced several security initiatives to support upstream open source projects, including CodeMender, an agent designed to be both reactive and proactive in patching flaws. The use of AI agents to maintain open source security infrastructure marks a notable shift in how large technology organizations are addressing the maintenance gap that has long affected volunteer-led projects.
Gemma 3, Summer of Code, and what comes next
A quick look back at 2025 launches includes Gemma 3, a collection of lightweight, state-of-the-art open models built from the same research and technology that powers Google’s Gemini 2.0 models, designed to run directly on devices from phones and laptops to workstations. Gemma 3 was released on March 12, 2025.
Downloads of Gemma models across all generations exceeded 150 million by May 2025, with more than 60,000 community-built variants available on Hugging Face. Gemma 4 was released on April 2, 2026, under the Apache 2.0 license.
In 2025, the Open Source Programs Office directed $2 million in sponsorships and investments to more than 40 open source projects. Google Summer of Code celebrated its 21st year, with 185 mentoring organizations selected. The retrospective reports that the program directly supported 1,280 contributors during the year.
Over its lifetime, the global program has connected more than 21,000 participants with over 1,000 open source organizations. The breadth of that pipeline matters as the industry debates open versus proprietary AI development paths, a tension also visible in the hardware layer, where the push for open tooling intersects with accelerator infrastructure that increasingly shapes what models developers can run and where.
Google’s retrospective does not break out figures by product area and does not quantify how much external open source code Alphabet consumes relative to what it contributes, a distinction independent analysts have flagged as important context when assessing claims about corporate open source commitment.
