Google published its 2025 open source retrospective on August 3, 2026, disclosing contributor ratios, repository counts and security automation figures that describe the infrastructure layer beneath agentic advertising.

The numbers arrived without a product launch attached. On Monday, August 3, 2026, Google Open Source published its annual retrospective covering calendar year 2025, a document written by Sophia Vargas of the Google Open Source team and posted to the Google Open Source Blog. It reads as an accounting exercise rather than an announcement, and that is precisely what makes it useful to anyone trying to work out how much of the advertising technology stack now depends on code that Alphabet writes, maintains, or has handed to somebody else.

According to the retrospective, roughly 10% of Alphabet's full-time workforce actively contributed to open source projects during 2025. The company states that this contribution ratio has held steady over the past five years, scaling in step with headcount growth rather than expanding or contracting as a share of staff. Alphabet projects received commits from more than 20,000 user accounts not affiliated with the company.

A contributor base that runs in both directions

The retrospective is careful to note that Alphabet engineers are not only working on Alphabet's own code. According to the document, the top projects by unique contributors at Alphabet include community-led efforts such as LLVM, vLLM, Envoy and Rust, alongside Google-initiated projects including Kubernetes, Apache Beam and gRPC.

That list carries weight for anyone running programmatic infrastructure. Envoy is the proxy layer sitting inside a large share of service-mesh deployments. Kubernetes orchestrates the container fleets that most demand-side and supply-side platforms run on. vLLM is the inference server increasingly used to serve large language models in production, which is the layer that agentic campaign tools depend on when they answer a buyer's natural-language query about pacing or delivery.

The appendix attached to the retrospective sets out how the figures were derived, and the caveats are worth reading before the headline percentages are used for anything. According to Google, the data covers activity by Alphabet employees on public repositories hosted on GitHub and on Git-on-Borg, the company's internal production Git service, and these sources represent a subset of open source activity currently tracked by the Google Open Source Programs Office. Activity on GitHub mixes Alphabet projects, third-party projects, experimental work and personal projects, and the metrics report on all of it unless stated otherwise. Contributor counts include temps, vendors, contractors and interns as part of what the company calls its extended community, though full-time employees represented more than 95% of open source contributors in 2025.

There is a further limitation on the external figure. According to the appendix, for counts of GitHub accounts not affiliated with Alphabet, the company cannot assume that one account equals one person, since multiple accounts could be tied to a single individual or to a bot.

The A2A partner roster is a martech roster

The section of the retrospective dealing with emerging standards is the one most directly relevant to media buyers. According to Google, the company worked with more than 50 partners on the Agent2Agent protocol during 2025, a specification intended to let AI agents communicate with each other, exchange information securely and coordinate actions across enterprise platforms and applications. Within weeks of the initial announcement, Google donated the A2A project to the Linux Foundation, described in the post as part of a commitment to develop an ecosystem offering "greater autonomy and multiplying productivity."

The partner graphic published alongside the retrospective lists the contributing organisations. Among them sit Salesforce, SAP, Oracle, ServiceNow, Workday, MongoDB, Elastic, Datadog, Box, Atlassian, Intuit, S&P Global and LangChain, together with the consulting tier of Accenture, Deloitte, KPMG, PwC, McKinsey & Company, BCG, Capgemini, Cognizant, Infosys, Wipro, HCLTech, LTIMindtree and Tata Consultancy Services. The list also includes Zeotap, the Berlin-based customer data platform, which achieved Google Cloud Ready BigQuery certification in April 2025 and whose third-party audience business was acquired by Roqad in September 2025.

The composition matters because it shows where agent interoperability work was concentrated. Systems integrators and enterprise software vendors dominate; pure-play advertising technology firms are largely absent. That absence has since been filled by a parallel and separate standards effort inside the advertising industry, and the gap between the two tracks has become one of the defining structural facts of agentic media buying.

How the standards work reached advertising

Google's own description of A2A as connective tissue for enterprise agents matches how the protocol was framed to advertisers. A 54-page Google Cloud guideline published in November 2025 characterised A2A as the universal handshake for the agentic economy, with agents publishing capability descriptions known as Agent Cards that advertise endpoints and required security credentials.

The practical adoption pattern in advertising has, however, favoured the other protocol. The Model Context Protocol, developed by Anthropic and later donated to the same foundation, became the connective standard across programmaticinfrastructure. Google's Ads API team first floated an MCP server in July 2025, then released one as open source on October 7, 2025, enabling read-only reporting and diagnostics through natural language. Six companies launched the Ad Context Protocol on October 15, 2025 as an advertising-specific layer on top of MCP, offering both MCP and A2A access methods for the same nine core tasks.

The imbalance became measurable. The IAB Tech Lab's Agent Registry held 10 entries as of March 11, 2026, every one of them classified as an MCP server and none as A2A. A2A supplied the governance model and the enterprise partner base; MCP supplied the deployments. Meta opened its ads MCP server to any developer holding a Meta app in July 2026, cutting the integration step to zero, and Adform published 29 read-only agent skills for its FLOW DSP on the same protocol.

That dependency cuts both ways. A specification change is now an infrastructure event: proposals to strip sessions from every protocol call forced ad tech builders into a migration window in late July 2026, ending the sticky routing that MCP servers had relied on since 2024.

Repository counts point to pruning

The retrospective offers a figure that has rarely been published in this form. According to Google, the company has created more than 15,000 public repositories on GitHub over the last 15 years, and today maintains more than 5,000 public repositories on GitHub plus more than 1,500 public repositories on Git-on-Borg.

Read plainly, roughly two-thirds of what Google has ever put on GitHub is no longer actively maintained there. The appendix defines active repositories as those meeting internal activity criteria and not archived, so the gap between creation and maintenance reflects archiving and abandonment rather than deletion. For engineering teams evaluating a Google-authored library as a dependency, the ratio is a more honest signal than a repository's star count.

Open models and the Gemmaverse

According to the retrospective, Gemma 3 is a collection of lightweight open models built from the same research and technology behind Gemini 2.0, designed to run directly on devices ranging from phones and laptops to workstations. Since Gemma's 2024 release, the community Google calls the Gemmaverse has created more than 60,000 Gemma variants. The company states that it released Gemma 4 in 2026 under an Apache 2.0 licence.

The licence change is the substantive part. Earlier Gemma releases carried custom Google terms of use; Apache 2.0 is a standard permissive licence that legal teams already know how to clear. For agencies and platforms weighing whether to fine-tune a model on client data and deploy it in-house, licence familiarity reduces review time more than a benchmark score does. Google's earlier open releases in this family included EmbeddingGemma in September 2025, a 308 million parameter embedding model aimed at on-device retrieval workloads.

The retrospective also lists the Agent Development Kit, described as an open-source framework and SDK for building, composing and running both conversational and non-conversational AI agents. ADK appeared as one of three evaluation and deployment frameworks in a 424-page agentic systems guide published by a Google engineer in September 2025, alongside LangChain and CrewAI.

Security automation aimed at unaudited dependencies

Four security initiatives are itemised in the report, and the numbers attached to the first are the most concrete in the document.

CodeMender is described as an agent built to be both reactive, patching new vulnerabilities as they appear, and proactive, rewriting existing code to eliminate whole classes of vulnerability. According to Google, in CodeMender's first six months the company upstreamed 72 security fixes to open source projects, including some codebases as large as 4.5 million lines.

OSS Rebuild targets software supply chain attacks by verifying build provenance. According to the retrospective, it automates package rebuilding and semantically compares the results against upstream artifacts to detect tampered code on registries including PyPI, npm and Crates.io. OSV-Scalibr, a software composition analysis library, serves as the core engine for vulnerability scanning used internally and inside OSV-Scanner. A credential scanning service running on deps.dev, built on a tool called Veles, scans open-source packages for leaked Google Cloud credentials in order to prevent account compromise.

Registry-level tampering is not an abstract concern for advertising operations. Tag management, consent management and measurement libraries reach production sites through npm, and a compromised package in that chain executes in the same browser context as ad serving and analytics code.

Funding and the maintainer question

According to the retrospective, the Open Source Programs Office directed $2M in sponsorships and investments to more than 40 open source projects during 2025. Google Summer of Code marked its 21st year, directly supporting 1,280 individuals contributing to 185 organisations. Across its lifetime, the programme has connected more than 23,000 participants from 125 countries with over 1,000 open source organisations.

Set against the scale of the dependency base described elsewhere in the same document, $2M across 40 projects is a modest figure, and the company acknowledges the tension. According to the post, Google recognises the need to evolve its programme structures so they continue to support maintainers effectively in the AI era, and it encourages projects to document preferred practices and policies in the wake of new technologies.

Why the accounting matters

Advertising technology spent 2025 and 2026 rebuilding around protocols it did not write. The buying agents now querying campaign data, the servers exposing that data, and the registries distributing the client-side libraries all sit on foundations maintained by a small number of organisations, with Alphabet among the largest single contributors.

The retrospective quantifies that position without arguing for it. A steady 10% workforce ratio, 20,000 external contributor accounts, a two-thirds gap between repositories created and repositories maintained, and 72 automated security fixes in six months describe a company that is simultaneously the largest donor to, and a substantial dependency of, the code layer under agentic advertising. Regulators have already begun examining the governance of that layer: the UK's Digital Regulation Cooperation Forum set out its position on agentic AI oversight in early 2026, and IAB Tech Lab chief executive Anthony Katsur has argued that protocols do not resolve misaligned incentives.

What the document does not provide is any breakdown by product area, any figure for how much external code Alphabet consumes rather than contributes, or any measure of adoption for A2A specifically. The partner count of more than 50 is a count of contributors to a specification, not of production deployments. For buyers assessing vendor claims about agent interoperability, that distinction remains the one to hold onto.

Timeline

Summary

Who: Google Open Source, part of Alphabet, with the retrospective authored by Sophia Vargas of the Google Open Source team. The Agent2Agent partner roster named in the report includes Salesforce, SAP, Oracle, ServiceNow, Workday, Accenture, Deloitte, McKinsey & Company, LangChain and the customer data platform Zeotap.

What: An annual retrospective covering 2025 open source activity across Alphabet. Headline disclosures include a 10% full-time workforce contribution ratio held steady over five years, more than 20,000 non-Alphabet accounts committing to Alphabet projects, more than 15,000 public GitHub repositories created over 15 years against more than 5,000 currently maintained plus more than 1,500 on Git-on-Borg, more than 50 partners on the Agent2Agent protocol, more than 60,000 community-built Gemma variants, 72 security fixes upstreamed by the CodeMender agent in its first six months, $2M directed to more than 40 projects by the Open Source Programs Office, and 1,280 individuals supported through the 21st year of Google Summer of Code.

When: The retrospective was published on Monday, August 3, 2026, covering calendar year 2025 with references to 2026 releases including Gemma 4.

Where: On the Google Open Source Blog, with underlying data drawn from public GitHub repositories and Google's internal Git-on-Borg service, as tracked by the Google Open Source Programs Office.

Why: The report quantifies Alphabet's position in the code layer that agentic advertising now depends on. A2A, donated to the Linux Foundation within weeks of announcement, supplies the enterprise interoperability model, while the Model Context Protocol supplies most working deployments across demand-side platforms, ad servers and measurement vendors. Security tooling aimed at PyPI, npm and Crates.io addresses the same registries through which tag management, consent and measurement libraries reach live advertising environments, making registry provenance an operational concern rather than a purely engineering one.