Loading story…
AI-assisted vulnerability discovery is driving a sharp rise in open source security findings, straining the systems used to validate, disclose, and remediate flaws. Chainguard said its Athena coalition has already processed more than 20,000 AI-generated findings and helped produce over 2,000 patches across 500 projects, while Anthropic previously estimated its tooling uncovered 6,202 high- or critical-severity issues in more than 1,000 open source projects. The Linux Foundation has also launched Akrites, a coalition with a shared incident response capability and standardized coordinated disclosure process to help the ecosystem manage AI-enabled vulnerability discovery.
GitHub said the resulting volume has pushed its Advisory Database to record levels, with 1,560 reviewed advisories published in May 2026 and more than 6,000 advisory decisions processed per month from March through May, yet incoming private reports, repository advisories, and CVE requests still outpaced review capacity. The company said reviewed advisories remain human-validated and Dependabot alerts continue to function normally, but publication timelines for many new advisories have stretched from roughly a week to several weeks as analysts handle package disambiguation, version-range reconstruction, multi-ecosystem verification, and conflicting upstream data; GitHub is responding with improved triage, expanded backend capacity, automation, AI-assisted research tools, and guidance for researchers to submit more complete reports and request CVEs only when publication is intended.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Help Net Security reported that Anthropic's Claude Mythos Preview analyzed more than 23,000 open-source code paths over about nine weeks and generated 1,596 verified vulnerability reports, with external reviewers confirming a 90.8% true-positive rate on the subset examined. The report also quantified a remediation gap, saying verified discoveries were occurring at roughly 25 per day while credited repairs proceeded at about 1.5 per day.
GitHub responded to the advisory backlog by improving triage, expanding backend capacity, deploying AI-assisted research tools, increasing automation, and investing in documentation and training while keeping human validation in place.
In May 2026, GitHub published 1,560 reviewed advisories, its highest monthly total ever, but incoming reports still exceeded processing capacity and publication delays stretched from about a week to multiple weeks.
From March through May 2026, GitHub processed more than 6,000 advisory decisions per month as vulnerability reporting, disclosure, and CVE requests surged across the ecosystem.
Chainguard CEO Dan Lorenc warned that AI-driven vulnerability discovery in open source software would make the coming months difficult for defenders because advanced models are uncovering large volumes of previously unknown flaws in widely used dependencies.
Chainguard's Athena coalition, comprising roughly two dozen companies, had already processed more than 20,000 AI-generated open source vulnerability findings and produced over 2,000 patches across 500 projects.
The Linux Foundation launched Akrites, an industry coalition with a shared Security Incident Response Team and a standardized coordinated vulnerability disclosure process to help defend open source software against AI-enabled threats.
The Register reported that Anthropic previously used Mythos Preview to scan more than 1,000 open source projects and estimated it found 6,202 high- or critical-severity vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcehelpnetsecurity.com
Open sourcegithub.blog
Open sourcetheregister.com
Open sourcegithub.blog
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FIRST reported that 2026 vulnerability disclosures are running far above expectations, with cumulative CVE volume tracking **46.3% above** its original forecast and adding roughly **6,420** excess entries, pushing the projected annual total to about **66,000**. The organization attributed the surge to AI-assisted discovery and broader reporting pipelines tied to tools and programs including **Anthropic Mythos**, **OpenAI GPT-5.4-Cyber**, **GitHub Security Advisories**, and **VulnCheck**. Despite the jump in raw disclosures, FIRST said practical defender risk appears more stable when filtered through exploitability signals such as **CISA KEV** inclusion or **EPSS** scores above 10%, and warned that AI-generated ephemeral software may create short-lived “micro-vulnerabilities” that never reach traditional CVE registries. Security practitioners said the growing volume is colliding with persistent limits in AI-based triage. Dark Reading reported that large language models still struggle to reliably find and prioritize vulnerabilities for application security teams, producing high false-positive rates, inconsistent results, and weak understanding of code reachability and deployment context. Pixee CTO Arshan Dabirsiaghi said organizations are being flooded by vulnerability findings and dependency update noise without enough staff to validate issues at scale, reinforcing FIRST’s view that the bottleneck has shifted from discovering bugs to human verification, coordination, patching, and detection engineering.
Jul 21, 2026
European and national cyber authorities are warning that AI is rapidly increasing the speed and scale of vulnerability discovery and exploit development, raising the prospect of a sustained remediation crisis. The European Central Bank told about 110 major banks to assess AI-enabled cyber threats and submit action plans by **October 31, 2026**, while the European Systemic Risk Board and European Supervisory Authorities issued parallel warnings on systemic risk from frontier AI models. In France, ANSSI Director General Vincent Strubel told senators that AI-assisted discovery could create a multi-year **"patch wall"**, overwhelming remediation teams even as basic controls such as network segmentation, identity and access management, and timely patching remain the most effective defenses. Industry reporting and vendor disclosures show why regulators are escalating. Mozilla said frontier AI models helped identify **271 vulnerabilities** fixed in Firefox 150 after an earlier run found 22 security-sensitive bugs, while researchers and commentators say LLM-assisted patch diffing can shrink the path from a disclosed `CVE` to a working proof of concept to days or even hours, including for flaws such as `CVE-2025-32433` in Erlang/OTP SSH. At the same time, access controls around advanced cyber-capable models are tightening unevenly: Anthropic expanded its restricted **Project Glasswing** program for Claude Mythos to critical-infrastructure organizations, but open-weight alternatives such as Zhipu AI's **GLM-5.2** are reported to deliver competitive vulnerability-finding performance at lower cost, reinforcing concerns that powerful offensive-relevant capability is spreading faster than most enterprises can patch.
Jul 10, 2026
The Linux Foundation announced a **$12.5 million** initiative to strengthen open-source security and help maintainers manage a surge of low-quality, AI-generated vulnerability reports that are overwhelming triage and review processes. Funding comes from **Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI**, and the program will be run through **Alpha-Omega** and the **Open Source Security Foundation (OpenSSF)** to improve remediation workflows, expand practical security support, and build longer-term resilience for widely used open-source software. Project leaders and maintainers said the volume of automated submissions has outpaced the capacity of many open-source teams, turning vulnerability handling into an operational burden. The effort follows complaints from groups including the **Python Software Foundation** and the **cURL** project, whose maintainer ended its bug bounty program after being flooded with poor-quality AI-generated reports; GitHub is also providing **$5.5 million** in Azure credits and support services, while Google said it plans to contribute security tools including **Big Sleep**, **CodeMender**, and research such as **Sec-Gemini**.
Jun 29, 2026