Ollama's $65M Round Is Proof Open Source Sells Trust, Not Charity

Ollama raised $65M this week and crossed 9 million users. Same week, The Register reported two separate attackers poisoned popular open source packages, previewing exactly what happens when nobody reads the diff because AI wrote it and AI reviewed it and everyone went to lunch. If you run engineering in Sweden and you think these are two different news stories, you are already behind.

They are the same story. Open source stopped being about free labor a while ago. Right now, in the middle of 2026, it is becoming the last layer where trust can actually be verified in a supply chain that AI writes faster than any human can audit. Ollama did not raise $65M because it gives away a local LLM runner for free. It raised because 9 million people trust the pipeline, trust the maintainers, trust that what ships is what was reviewed. That trust is the product. The code was always free.

Software development Sweden style: still treating open source as a checkbox

I have sat in enough procurement meetings in Jönköping and Stockholm to know how this plays out here. Someone on the security team runs a license scan, checks GDPR boxes, makes sure nothing is GPL-poisoned for commercial use, and signs off. That is the entire open source risk process at a lot of Swedish companies I talk to. It treats open source like a legal liability to be managed, not like the actual foundation the company runs on.

Meanwhile at HEIMLANDR, when we do AI agent development for clients, half our stack is open source. n8n for orchestration. TensorFlow underneath some of the model work. Half a dozen smaller libraries nobody in the boardroom has ever heard of. Every one of those dependencies is a door into the client's system. If a maintainer's account gets compromised, or a contributor slips in a malicious commit that an AI code reviewer waves through because it "looks syntactically fine," that door is open and nobody in the org even knows it exists.

The Register's reporting on this year's package poisoning incidents is not an edge case. It is the preview. When most commits into major repos start being AI-generated or AI-assisted, and most reviews are AI-assisted too, you get a review loop where a machine wrote it, a machine skimmed it, and a human clicked merge because the CI passed. That is not a hypothetical. That is Tuesday.

OpenAI selling you the fire extinguisher for the fire it helped start

Digital Trends flagged something worth sitting with: OpenAI is now positioning itself to make open source "less of a security bargain," meaning the company whose tools accelerated AI-generated commits at scale is now building the audit and verification layer on top of the mess. That is not hypocrisy, that is just how markets work. Somebody creates the risk, somebody else monetizes the fix. But if you are a CTO in Sweden, you should notice who is about to own both ends of that pipe. If OpenAI or Anthropic or whoever ends up owning "verified, trustworthy open source" as a paid layer, that is a chokepoint on infrastructure the entire industry depends on, sitting inside two or three American companies. Nobody in Brussels seems to be thinking about that yet.

Nordic reality versus the Silicon Valley trust economy

Here is the uncomfortable comparison. In San Francisco, trust in open source is being actively built and monetized right now. Ollama's raise, Anthropic and OpenAI's audit-layer plays, the entire ecosystem around tools like opencode and Anthropic's own agent harnesses, all of it treats "can I trust this dependency" as a product question with a price tag attached.

In Sweden, we still mostly treat trust in open source as an assumption. We assume Debian is fine. We assume npm is fine. We assume the maintainer of some library with 40,000 stars that half our stack depends on is a stable, well-resourced human being who is not burned out, not compromised, not about to get an offer from a threat actor to slip something into a minor version bump. That assumption has been wrong before. It will be wrong again, and when it is, it will not be a headline in Breakit about a funding round. It will be a breach disclosure nobody wants to write.

Swedish engineering culture has real strengths here that we underuse. We are good at process. We are good at consensus and documentation. Those are exactly the muscles you need to build a real open source trust posture: someone actually assigned to track upstream commit history, someone with authority to pin dependencies and question a suspicious release, someone reading the changelog instead of trusting the green checkmark. Most companies I talk to in Jönköping and the wider Nordic corridor do not have that person. They have a Slack channel that says "Dependabot merged 40 PRs this week, nice."

Where EU and Swedish policy is behind

The EU Cyber Resilience Act is trying to force accountability onto software vendors, including open source maintainers in certain commercial contexts, and it is a step in the right direction on paper. But it was written for a world where humans wrote most of the code and humans reviewed most of the pull requests. It has almost nothing specific about AI-generated commits, AI-assisted review, or the verification gap that opens up when both sides of a code review are machines nodding at each other. Sweden's own cybersecurity agencies, MSB included, talk a good game about supply chain risk in national infrastructure but I have not seen anything concrete about the AI-authored code problem specifically. This is a regulatory blind spot, and it is going to stay a blind spot until something breaks publicly enough that a Minister has to answer for it on SVT.

Where this goes: AGI, agents, and the death of "just trust the checkmark"

Push this forward two to five years. As we get closer to genuinely autonomous coding agents, and I think we are closer than most boardrooms want to admit, more and more of the world's software gets written by agents talking to other agents. Your CI pipeline reviews code written by an agent, using a linter maintained by a project whose last three commits were also agent-generated. At some point the chain of human verification gets so thin that "open source" stops meaning "code anyone can read" and starts meaning "code nobody reads but everyone can theoretically read."

That is exactly the environment where trust becomes the scarce resource and therefore the valuable one. Ollama's raise is an early data point. The winners in the next five years will not be the companies with the most open source. They will be the companies that can prove, cryptographically or organizationally, that what ships matches what was actually reviewed by something with judgment, human or otherwise. Think signed commits as standard, provenance tracking as standard, an entire category of tooling around "verify this dependency graph was not tampered with between commit and deploy." Some of that already exists in nascent form. Most companies are not using it.

For builders, this means the moat is not "we use open source" anymore. Everyone uses open source. The moat is "we can prove our supply chain integrity end to end," and that becomes a sales argument, a procurement requirement, eventually a regulatory requirement. Sweden could actually lead here if it wanted to. We have the trust culture, the transparency instincts, the engineering discipline. We just are not applying it to the software supply chain the way we apply it to, say, financial reporting or workplace safety.

What to look at this week

If you run engineering and you want to actually do something instead of nodding along to this post, here is where to start.

• Ollama itself is worth running locally if you have not. It is a genuinely good example of the trust-first open source model working, and understanding why 9 million people chose it over alternatives tells you something about what your own product needs to earn.
• n8n, the workflow automation platform, is a good case study in a project that built trust through self-hosting transparency rather than just feature velocity. We use it in client work at HEIMLANDR for exactly that reason, you can see everything it does.
• ECC, the agent harness performance system trending this week, is worth a read specifically because it is trying to formalize "research-first development" for coding agents. That is the exact instinct the industry needs more of: slow down the agent enough that a human can still verify what it produced.
• Sigstore and SLSA, not on the trending list but worth your CTO's time, are the actual open frameworks for proving software provenance right now. If your team has not looked at these, that is the gap Ollama's raise is telling you to close.

What to actually do about this

Stop treating your open source dependency list as a license compliance spreadsheet. Assign a real owner to supply chain trust, someone whose job includes reading changelogs on your critical dependencies, not just running an automated scanner and calling it done. If you are building AI agents or shipping products fast, and we do a lot of both in rapid MVP development here at HEIMLANDR, bake provenance checks into your pipeline from day one rather than bolting them on after your first incident. It is cheaper that way, always.

And if you are a Swedish company still asking "is this open source library free to use commercially" as your only diligence question, that question was answered in 2015. The question for 2026 is "can I prove this library is what it says it is, and will still be tomorrow." If you cannot answer that, you do not have an open source strategy. You have an open source hope.

The bottom line for tech company Jönköping and beyond

Being a tech company in Jönköping instead of San Francisco does not exempt you from this. If anything it should make Swedish builders more paranoid, not less, because we do not have the bench depth of security researchers that the Bay Area throws at these problems by default. We have to be smarter about where we spend attention. Spend it on your supply chain. It is the actual foundation everything else sits on, whether you are shipping a SaaS product or running fullstack development for a client who has no idea how many open source layers are between their button click and their database.

Ollama earned trust and got rewarded with $65M and 9 million users. Two unnamed packages lost trust this year and got rewarded with a breach report nobody wanted to write. That is the whole market now. Pick which side of that story you want to be on before someone else picks it for you.

Fredrik Brunnberg is the CEO of HEIMLANDR.IO, building AI and software solutions from Jönköping, Sweden. This is the daily HEIMLANDR briefing. If you found this valuable, share it with someone who builds things.