Loading story…
AI-powered tools from major technology companies such as Google and OpenAI are increasingly being used to discover vulnerabilities in open-source software, leading to a surge in bug reports for projects maintained largely by volunteers. While these AI systems, like Google's Project Naptime and OpenAI's Aardvark, have successfully identified significant flaws—including a critical vulnerability in OpenSSL (CVE-2024-9143) and a stack buffer underflow in SQLite—the volume and complexity of AI-generated reports are overwhelming open-source maintainers, many of whom lack the resources to address the influx, especially when reports lack accompanying patches.
The issue has prompted discussion within the open-source and security communities about the need for new frameworks and scoring systems tailored to AI-discovered vulnerabilities. At the 2025 OWASP Global AppSec USA conference, experts highlighted the limitations of traditional vulnerability scoring models like CVSS for AI-related threats and previewed the development of the OWASP AI Vulnerability Scoring System (AIVSS). This initiative aims to address the unique, non-deterministic risks posed by AI in software security, underscoring the growing recognition that AI-driven vulnerability discovery requires new approaches to risk management and remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
21 events from the most recent confirmed update back to the earliest known activity.
In a July 4, 2026 oss-sec moderation reply, Solar Designer said a submitted 'Wasm OCI Image Fetcher Bearer Realm SSRF Bypass' report was almost certainly AI-generated, internally inconsistent, and unreliable. He also noted contradictions over whether the issue was private or public and said posting it to oss-security made it public.
In a May 24, 2026 oss-sec post, a reporter using the name ROI AI / Jacob said they had submitted about a dozen OpenStack issues and alleged that one serious security bug was made public by OpenStack, which they characterized as negligent. The post said the incident discouraged further reporting and highlighted disclosure-handling tensions around LLM-assisted vulnerability research.
Alan Coopersmith highlighted Anthropic's new coordinated vulnerability disclosure dashboard on oss-sec, alongside its Project Glasswing initiative. Anthropic said that as of 2026-05-22 it had privately disclosed 1,596 vulnerabilities across 281 open source projects, with 97 patched and 88 assigned CVEs or GitHub Security Advisories, while withholding project names and bug types until fixes are available.
In the ongoing oss-sec discussion, Jacob Bachmeyer argued that coordinated disclosure embargoes impose real operational costs on open-source projects and may provide limited security benefit if LLM-assisted tools let others, including attackers, rediscover the same vulnerabilities quickly. He suggested duplicate reports can indicate an issue is already quasi-public and should be fixed with greater urgency.
In the oss-sec discussion, Tim Shephard said he had recently reported several OpenStack-related vulnerabilities, including Launchpad bugs #2149789, #2150261, #2149775, and #2150316, with three reportedly classified as critical and one as high. He also referenced a critical oslo rabbit man-in-the-middle issue that was difficult to fix without breaking deployments, providing a concrete example of LLM-era disclosure pressure on large legacy codebases.
During the ongoing oss-sec discussion, participants cited curl as having canceled its bug bounty program because maintainers were overwhelmed by excessive low-quality 'AI slop' vulnerability submissions. The example provided another concrete open-source ecosystem response to operational strain from AI-generated security reporting.
In the ongoing oss-sec discussion, Jeffrey Walton cited Anthropic guidance recommending frontier models for defensive security tasks including bug triage, deduplication, reproduction, patch proposals, cloud misconfiguration analysis, pull request review, and secure migrations. He said such uses appear promising but warned that projects relying on AI for bug finding or triage need especially strong positive and negative test coverage because AI may operate without sufficient human oversight.
In a May 15, 2026 oss-sec reply, Yves-Alexis Perez argued that stripping security-relevant detail from commit messages can backfire by hiding important fixes from downstream integrators and users. He said defenders cannot realistically inspect every commit in fast-moving projects, increasing the risk that security changes will be missed without explicit notice.
On the oss-sec mailing list, Tim Shephard argued that detailed public security reasoning in bug records, code reviews, commit messages, and advisories can help LLMs identify vulnerabilities, variants, regressions, and related insecure patterns. He proposed separating public fix and impact guidance from deeper technical analysis that could be shared through more restricted channels.
In the oss-sec discussion, Douglas Bagnall said Samba was receiving duplicate reports of the same valid security issue from multiple independent groups using LLMs, with about one-third of valid security bugs being reported more than once while under embargo. The report provided concrete evidence that LLM-assisted discovery is eroding exclusivity in coordinated disclosure and increasing pressure for simultaneous patching.
In the oss-sec discussion, Santiago Ruano Rincón clarified that while the EU Cyber Resilience Act broadly applies from December 2027, Article 14 vulnerability and incident reporting obligations take effect earlier on 2026-09-11 under Article 71. The clarification refined Greg KH's point about future mandatory reporting of security fixes to EU authorities.
In the April 29, 2026 oss-sec discussion on disclosure in the LLM era, Greg Kroah-Hartman said upcoming European Union Cyber Resilience Act requirements would obligate projects to report security bug fixes to the EU by the end of the following year. He suggested this reporting could become a future source of visibility for downstream defenders even as maintainers reduce public security detail in commits and releases.
In an April 29, 2026 oss-sec reply, Willy Tarreau argued that vulnerabilities found with LLM assistance should be considered effectively already public because others can likely reproduce them with similar prompts. He said embargoes now increasingly delay fixes while users remain exposed, and noted he has adapted by reducing sensitive detail in commit messages and releasing fixes more quickly.
Jeremy Stanley raised concerns on the oss-sec mailing list that public LLM services could weaken coordinated disclosure and embargo workflows by retaining or reusing prompts and outputs containing sensitive vulnerability details. He argued embargoed patch development and advisory drafting should avoid LLM assistance and suggested shorter embargoes may be necessary if LLM-assisted discoveries are effectively trivial to reproduce.
Linux kernel developers discussed removing the AX.25, NET/ROM, and ROSE amateur radio protocols and related hamradio drivers from the mainline kernel, arguing the code is poorly maintained, attracts syzbot findings, and is now drawing AI-generated security reports. The discussion framed the issue as reducing attack surface from obscure, undermaintained subsystems, with some participants pointing to user-space alternatives and out-of-tree maintenance as substitutes.
A proposal submitted by Andrew Lunn to the Linux netdev mailing list called for removing numerous old ISA- and PCMCIA-era Ethernet drivers from the mainline kernel, arguing their unclear user base no longer justified the maintenance cost. The proposal cited growing strain from AI-assisted and fuzzer-generated bug reports and would remove roughly 27,646 lines of code if adopted, with drivers restorable if maintainers emerge.
Cal.com announced that it is placing its core hosted production code and future development in a private repository, citing increased risk that AI systems can more easily find and exploit vulnerabilities in public code. The company said it will keep a stripped-down open-source version available as Cal.diy and had already moved critical security components such as authentication and data handling out of the public codebase.
Forescout warned that advances in AI are likely to sharply increase both valid and false-positive vulnerability reports, potentially overwhelming CVE assignment and vendor triage processes. Its follow-up testing found all evaluated AI models could identify vulnerabilities and more than half could autonomously generate exploits, highlighting growing offensive as well as defensive implications.
HackerOne halted new vulnerability submissions to its Internet Bug Bounty program effective March 27, 2026, citing a mismatch between AI-accelerated vulnerability discovery and the limited capacity of open source maintainers to validate and remediate issues. The move marked a concrete industry response to mounting pressure from high volumes of low- to medium-quality AI-assisted reports.
ReversingLabs published analysis describing how AI-driven vulnerability reporting was flooding open-source software maintainers with low-quality or excessive submissions, creating operational strain in vulnerability handling. This marks a distinct development in the security ecosystem around AI-assisted disclosure practices.
An SC Media report from the OWASP Global AppSec event described industry discussion around AI security, criticizing superficial 'AI magic dust' approaches and the illusion of managed risk. The conference itself is the underlying real-world event reflected in the coverage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
45 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceresilientcyber.io
Open sourceseclists.org
Open sourcereversinglabs.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AI-assisted vulnerability discovery is driving a sharp rise in open source security findings, straining the systems used to validate, disclose, and remediate flaws. Chainguard said its Athena coalition has already processed more than **20,000** AI-generated findings and helped produce over **2,000 patches** across **500 projects**, while Anthropic previously estimated its tooling uncovered **6,202** high- or critical-severity issues in more than 1,000 open source projects. The Linux Foundation has also launched **Akrites**, a coalition with a shared incident response capability and standardized coordinated disclosure process to help the ecosystem manage AI-enabled vulnerability discovery. GitHub said the resulting volume has pushed its Advisory Database to record levels, with **1,560** reviewed advisories published in May 2026 and more than **6,000** advisory decisions processed per month from March through May, yet incoming private reports, repository advisories, and CVE requests still outpaced review capacity. The company said reviewed advisories remain human-validated and Dependabot alerts continue to function normally, but publication timelines for many new advisories have stretched from roughly a week to several weeks as analysts handle package disambiguation, version-range reconstruction, multi-ecosystem verification, and conflicting upstream data; GitHub is responding with improved triage, expanded backend capacity, automation, AI-assisted research tools, and guidance for researchers to submit more complete reports and request CVEs only when publication is intended.
Jul 12, 2026
Organizations are rapidly integrating AI into software development pipelines, with AI-generated code now present in every surveyed environment and a significant portion of codebases produced by AI tools. Security leaders report increased risk due to limited visibility into where and how AI is used, the proliferation of shadow AI, and the introduction of logic flaws or insecure patterns by autonomous agents. The lack of oversight and formal controls over AI-generated code and tools has expanded the attack surface, making product security and supply chain integrity top priorities for 2026. Industry experts emphasize the need for responsible adoption of AI-driven security tools, highlighting the importance of evaluation, deployment, and governance to maintain control and transparency. New frameworks, such as the AI Vulnerability Scoring System (AIVSS), are being developed to address the unique, non-deterministic risks posed by agentic and autonomous AI systems, which traditional models like CVSS cannot adequately capture. The shift to runtime application security and the management of non-human identities further underscore the evolving landscape, as organizations seek to balance innovation with robust security practices.
Jul 2, 2026
Security researchers have highlighted the risks associated with 'Excessive Agency' vulnerabilities in Large Language Models (LLMs), where granting AI systems excessive permissions or autonomy can enable attackers to exploit internal APIs, invoke unauthorized plugins, or perform unintended actions such as SSRF attacks and unauthorized interactions with business applications. These vulnerabilities arise when LLMs are given more control than necessary, often without sufficient human oversight or intervention mechanisms, leading to critical and high-severity security risks in environments where AI agents are integrated with sensitive systems. In response to the unique challenges posed by agentic AI, the Open Worldwide Application Security Project (OWASP) has introduced the AI Vulnerability Scoring System (AIVSS), a new framework designed to assess and manage vulnerabilities specific to AI and agentic systems. Unlike traditional models such as CVSS, AIVSS accounts for the non-deterministic and dynamic nature of AI, including issues like ephemeral identities and the need for privilege management in autonomous agents. The AIVSS provides structured risk assessment guides and a scoring tool to help organizations quantify and address AI-specific security risks that are not adequately covered by existing vulnerability frameworks.
Jun 29, 2026