Current AI's Gap Map: An SBOM-Style Inventory for the Open Source AI Stack

Current AI describes itself as a "global partnership building a public option for AI." It was established as a non-profit at the AI Action Summit in Paris in February 2025 and says it has already secured $400 million in committed capital. Its first major public output, flagged by Simon Willison, is the Open Source AI Gap Map — an attempt to systematically index the state of open source AI.

What's actually in the map

Version 0.1 of the Gap Map documents 421 products in depth: 266 software tools and libraries, 85 models, 50 datasets, and 20 hardware projects, contributed by 228 organizations. These are organised into 14 categories spanning three layers of the stack — model components, product/UX tooling, and infrastructure. Current AI says the depth analysis draws from a much larger pool: it evaluated over 24,626 projects, from foundation models through inference backends, before selecting which to document in detail.

The stated goal is to identify where the open source AI ecosystem has genuine coverage and where it doesn't — for instance, the map's own category breakdown shows areas like training and synthetic datasets with no products rated "mature," versus categories like benchmark and evaluation datasets or orchestration/agent tooling with a double-digit number of mature entries.

Why this matters for security teams

Most organisations adopting open source AI today have no equivalent of a software bill of materials for the models, datasets, and inference tooling they pull in. Teams often can't answer basic supply-chain questions — who maintains this model checkpoint, what data was it trained on, is this inference server still patched — because there has been no shared index to check against. A structured map like this one, even at v0.1 and even with obvious gaps, gives security and platform teams a starting point for that kind of provenance work, in the same spirit as SBOM initiatives for traditional software supply chains.

That said, the Gap Map is a coverage index, not a security assessment. It says what exists and how the ecosystem is organised — it does not attest to a model's provenance chain, a dataset's licensing cleanliness, or an inference tool's patch history. Anyone using it to select a component for a production pipeline still needs to independently verify the underlying package registry, model card, and maintainer activity, the same due diligence already recommended for any third-party dependency pulled from npm, PyPI, or a model hub.

The practical takeaway

If your organisation is evaluating open source models or tooling, a resource like the Gap Map is a reasonable place to start scoping what's available and where the ecosystem is thin — but it doesn't replace your own dependency and provenance review. Treat every open source AI artifact the way you'd treat any other third-party code entering your build pipeline: pin versions, verify the source, and check for known compromise before it reaches production.

FAQ