Open Source Summit Korea 2026

As Generative AI and Agentic AI continue to evolve, cyberattacks have become increasingly automated. With hundreds of new CVEs disclosed every day and AI-powered attacks are automated in zero-hour, traditional security and patch management approaches have reached their limits.

This session explores how organizations can build a lightweight hardened infrastructure and a trusted Zero-CVE environment with Red Hat AI on a proven platform that leverages the strengths of the open source ecosystem. It also examines the need for autonomous defense systems and approaches to implementing them, enabling real-time threat response while maintaining infrastructure stability through controlled AI-driven automation.

When enterprises bring AI into real-world operations, reliability challenges extend far beyond hallucinations and response accuracy. Document structure and meaning can be lost during processing, retrieval may fail to provide sufficient grounding, and models may violate business rules or operational constraints. As agents connect to enterprise systems, additional risks emerge, including unauthorized tool calls and actions that are difficult to trace or audit.
These challenges cannot be addressed by adding a guardrail at the final stage. Reliability must be designed across the entire workflow, from document understanding and retrieval to reasoning, generation, and execution.
This session presents an open-source reference architecture that combines document representation with Docling and DocLang, grounded retrieval and reasoning with OpenRAG and Granite, requirement-driven generation and validation with Mellea, and controlled, observable tool integration with ContextForge.
 

Large Language Models (LLMs) are widely used to search, summarize, and generate answers. They are powerful, but results are not always stable and can be difficult to verify.

Many systems use Retrieval-Augmented Generation (RAG) to connect LLMs with external data. This helps, but does not fully solve the problem. The same question can produce different answers depending on the model or context, making knowledge hard to manage.

This raises a simple question: where should knowledge be managed?

A similar issue exists in software supply chains. SBOM (Software Bill of Materials) makes components and relationships visible, but is often treated as static data.

Based on hands-on experience designing graph-based knowledge systems, this session introduces a design approach: managing knowledge outside LLMs as structured, persistent data.

We discuss lessons from SBOM and how graph-based approaches—using technologies such as SQL/PGQ or GQL—can help understand relationships and trace changes.

The focus is a practical way of thinking for more open and sustainable knowledge practices.

AI agents are quickly moving from prototypes to production systems that manage APIs, tools, and complex reasoning tasks.

Once these systems are deployed, they often act like black boxes, hiding failures, slowdowns, and unexpected behavior.

This session will show you how to add observability to agentic systems with open-source tools and cloud-native tech.

​Brandon and Mostafa will break down the lifecycle of an AI agent, covering prompt execution, tool invocation, memory access, and multi-agent coordination, and demonstrate how to make each stage observable.

Using a practical, architecture-focused approach, they will show how to:

- Trace agent workflows across distributed systems
- Monitor latency and token usage
- Detect anomalies such as hallucinations, tool misuse, and runaway behavior.
- Connect LLM behavior with infrastructure metrics like GPU, container, and network data.

They will also present a complete reference architecture that uses open-source projects including OpenTelemetry (OTel), Prometheus, Grafana, and some new tools for LLM observability.

Attendees will learn practical ways to build transparent and reliable production AI agent systems.

The shift to digital money is accelerating in Korea and globally - central bank digital currency pilots, tokenized deposits, and real-world asset tokenization are moving toward production, stablecoins are gaining regulatory clarity. However, key challenges remain around interoperability, scalability and integration with existing financial systems.

In this panel, Julian Gordon, VP Asia Pacific & Middle East at LF Decentralized Trust, will host a discussion with leaders from Korea’s financial and technology ecosystem on moving from PoC to production-grade digital money infrastructure.

Panelists will share insights from initiatives including CBDC pilots, public-private collaboration, agentic AI integration, and developments in tokenized deposits and assets – exploring how open source decentralized technologies are improving settlement efficiency, programmability and interoperability across platforms and networks.

They will examine the role of open development, governance and standards in building secure, scalable systems. Attendees will gain practical perspectives on architecture, ecosystem coordination and policy shaping the next phase of digital money.

In April 2026, x402 joined the Linux Foundation with over 20 founding members. It is the first payment protocol under open source governance at the Linux Foundation.

x402 activates HTTP 402 "Payment Required," reserved in 1997 but never used. A server responds with 402 and payment terms, the client settles on-chain, the resource is delivered. Apache 2.0, zero protocol fees, chain-agnostic, no single-organization dependency.

Part 1: Why now. Every internet layer runs on open protocols except payments. That breaks when AI agents must pay at machine speed. We map the agentic payment stack and ask: is it open, who governs it?

Part 2: How x402 works. HTTP 402 challenge-response, stateless architecture, one middleware line to gate any API, production deployments today.

Part 3: Bottom-up to foundation. x402 was open-sourced, developers adopted it, major infrastructure providers shipped native support, competing protocols chose to integrate x402 rather than build a rival. Then it moved to the Linux Foundation.

Part 4: What comes next. The protocol is early. Foundation governance changes the signal. We examine what sustained adoption requires.

The team shipped semantic search. It worked. Then came 100M vectors, a RAM bill that tripled overnight, filtered queries silently returning zero results, and a proposal to "just add Pinecone alongside Postgres."

This talk is for engineers who've already built the thing and now need to scale it without burning the budget or the team. We'll do the RAM math that should happen before any architecture decision, walk through quantization strategies that deliver 32x compression with 95%+ recall, show why filtered search is the #1 silent production failure, and lay out when DiskANN, hybrid BM25+vector search, or a specialized vector DB actually makes sense — and when it doesn't.

Live demos included. Decision matrices to take back to the team on Monday. No hype, just trade-offs in plain English.

Open-source agents like Hermes and OpenClaw can reason and use tools, but edge deployment is still hard - not the model, the compute underneath: limited memory, tight power budgets, no ops team. Democratizing agentic AI means fixing the compute layer. This deep dive covers GPU and memory slicing at the edge: carving one device’s unified memory so multiple agents run concurrently on hardware as small as an NVIDIA Jetson, and time-sharing when demand exceeds memory.

We compare Jetson-class GPUs with NPUs from Axelera and DeepX - higher performance per watt - and what it takes to make them schedulable. HAMi, the CNCF Incubation project for hardware-agnostic GPU virtualization, is that layer: one scheduling plane across heterogeneous accelerators, fine-grained memory slicing, open source. A blueprint for edge AI without a cloud budget.

Trusted OSS is an open-source self-certification kit that guides any organization from zero to ISO/IEC 5230 (license compliance) and ISO/IEC 18974 (security assurance) conformance using AI agents.
No prior expertise required.

Built by the OpenChain Korea Work Group and released under CC BY 4.0, the kit features:

• AI agents (Claude Code) that auto-generate company-specific compliance artifacts: OSS policy, SBOM, vulnerability response procedures, training curriculum, and conformance declaration
• DevSecOps pipelines (SAST, SCA, secret detection, IaC) ready to drop into any CI/CD environment
• A 5-level AI Coding Governance Maturity Model — from ad-hoc prompting (Level 1) to AI-augmented defense (findings-driven review, AI fuzzing) and continuous auto-remediation (Level 5).

In this session, I'll walk through how any team can go from no compliance process to a fully documented, self-certifiable program in hours, not months. I'll also share how we're using AI to close the compliance skills gap across Korean enterprises and SMEs — making OpenChain certification accessible to all.

Attendees leave with a working toolkit they can clone and run today.

AI coding tools can generate patches quickly, but maintainers still cannot merge a PR on generated code alone. They need evidence, what was reproduced, what changed, how it was validated, and whether the contributor actually reduced review work instead of shifting it downstream.

In this session, I draw on recurring patterns from reviewing and maintaining Argo CD contributions to show why many AI-assisted PRs stall and what makes others move quickly. I present a simple four-stage framework for review-ready OSS contributions, Set up the environment, validate the problem before changing code, harden the fix with tests and checks, and submit a PR with enough context and proof for efficient review. Attendees will leave with practical guidance they can use immediately to improve contribution quality and reduce maintainer burden.

Building AI agents is easier than ever with open source tools, but ensuring their reliability in production remains a major challenge. Unlike traditional software, AI agents are non-deterministic, making simple pass/fail testing insufficient.

This talk introduces a practical approach to evaluation and observability for AI agents, combining open source tools such as TruLens with agent architectures inspired by AgentGPT.

We will demonstrate how to instrument agent workflows, capture execution traces, and implement evaluation metrics such as faithfulness, tool selection accuracy, and answer relevancy. Attendees will also see how to visualize agent behavior and identify failure points across retrieval, reasoning, and generation layers using a lightweight dashboard.

Finally, we show how to build a feedback loop to iteratively improve agent performance, and share a reference implementation (GitHub) that can be reused with different agent frameworks.

Building AI agents is easy, but ensuring their reliability is hard. Because agents operate in open-ended, non-deterministic environments, traditional Test-Driven Development (TDD) falls short. The solution is Eval-Driven Development (EDD), a paradigm that embeds continuous evaluation throughout the agent lifecycle.

This talk explores how to operationalize EDD. First, we examine the critical role of observability. Evaluating just a final output is insufficient for multi-step workflows. We show how OpenTelemetry (OTel) compatible tracing exposes internal reasoning and tool usage for granular debugging.

Next, we tackle scaling evaluation via LLM-as-a-Judge. Since uncalibrated judges often miss domain-specific nuances, we demonstrate aligning custom judges with human experts. Using open-source MLflow, attendees will learn to capture traces, collect expert feedback, and use alignment optimizers to create expert-aligned evaluators.