AI-Driven Vulnerability Surge Overwhelms Open Source Disclosure Pipelines

AI-assisted vulnerability discovery is driving a sharp rise in open source security findings, straining the systems used to validate, disclose, and remediate flaws. Chainguard said its Athena coalition has already processed more than 20,000 AI-generated findings and helped produce over 2,000 patches across 500 projects, while Anthropic previously estimated its tooling uncovered 6,202 high- or critical-severity issues in more than 1,000 open source projects. The Linux Foundation has also launched Akrites, a coalition with a shared incident response capability and standardized coordinated disclosure process to help the ecosystem manage AI-enabled vulnerability discovery.

GitHub said the resulting volume has pushed its Advisory Database to record levels, with 1,560 reviewed advisories published in May 2026 and more than 6,000 advisory decisions processed per month from March through May, yet incoming private reports, repository advisories, and CVE requests still outpaced review capacity. The company said reviewed advisories remain human-validated and Dependabot alerts continue to function normally, but publication timelines for many new advisories have stretched from roughly a week to several weeks as analysts handle package disambiguation, version-range reconstruction, multi-ecosystem verification, and conflicting upstream data; GitHub is responding with improved triage, expanded backend capacity, automation, AI-assisted research tools, and guidance for researchers to submit more complete reports and request CVEs only when publication is intended.