Loading story…
GNOME is changing its security-report handling process after volunteer maintainers were flooded with AI-assisted vulnerability submissions. For issues reported on or after August 1, 2026, the project will reduce its disclosure deadline from 90 days to 30 days, with security lead Michael Catanzaro saying the shorter window better reflects GNOME’s workflow because valid issues are typically fixed within one to three weeks, while others often remain unresolved.
GNOME said it will apply the same rules to AI-assisted and human-written reports, but projects that prohibit AI-generated content will no longer receive forwarded reports when submissions contain AI- or LLM-generated findings; those issues will instead be closed in the tracker, though maintainers may still be notified. Catanzaro, who has overseen GNOME security issue tracking since 2020 with Red Hat support, also said he will stop tracking newly reported issues in November 2026 and fully step away by December 1 unless an experienced community successor is found.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Help Net Security reported that Catanzaro plans to finish the role by 2026-12-01 unless a successor is found.
Catanzaro said he will stop tracking newly reported GNOME security issues on 2026-11-01 and is seeking experienced community members to take over the role.
GNOME said it will shorten its vulnerability disclosure deadline from 90 days to 30 days for issues reported on or after 2026-08-01. The change was described as better matching GNOME's workflow because valid issues are usually fixed within weeks.
GNOME announced changes to its security-report process in response to a steady flow of AI- or LLM-generated vulnerability submissions. The project said it will apply the same rules to AI-assisted and human-written reports, while changing how AI-generated findings are forwarded to projects that prohibit such content.
Michael Catanzaro said he has managed GNOME's security issue tracking since November 2020, with support from Red Hat.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcelinuxsecurity.com
Open sourcehelpnetsecurity.com
Open sourcephoronix.com
Open sourceblogs.gnome.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GNOME's security team changed its vulnerability-handling process by cutting the default disclosure deadline for new reports from 90 days to 30 days and by declining to forward reports to projects that prohibit AI-generated submissions. The policy shift, discussed widely on the `oss-sec` mailing list, reflects the view that most embargoed fixes are completed within the first month and that AI-assisted reporting has become common enough that many submissions now contain at least some machine-generated material. Participants also noted that some projects, including the Linux kernel, have moved away from embargoes for AI-generated reports because such findings can be easily reproduced and redistributed. The change triggered a broader dispute over open-source security governance, with maintainers arguing that low-quality, verbose, or impractical AI-assisted reports are consuming scarce triage capacity and pushing burnout onto already overstretched teams. Mailing-list contributors said many externally submitted bugs are real defects but not necessarily exploitable vulnerabilities, while others warned that rejecting accurate reports could still increase user risk. The debate expanded to the Linux Foundation's **Akrites** initiative, described by critics as an attempt to coordinate AI-era vulnerability response and potentially serve as a "maintainer of last resort" for abandoned critical packages, though others stressed that such a role would not override project ownership or maintainer authority.
Aug 6, 2026
Security teams are struggling to keep pace as AI accelerates vulnerability discovery, bug bounty submissions, and pentest findings faster than organizations can validate and remediate them. Microsoft said it paid more than **$20 million** to **562 researchers** for **2,531** eligible reports across 15 bug bounty programs, attributing a surge in submissions in part to AI-assisted research, while Cloudflare said it now uses Anthropic’s Claude Sonnet to triage bug bounty reports, filtering duplicates and routing only higher-value submissions for human review. Survey data from Pentest-Tools.com similarly found that AI-generated findings are creating large validation backlogs, with practitioners citing false positives, duplicate reports, unexploitable issues, and even fabricated CVEs as persistent problems. The operational gap is widening as attackers move faster than defenders can patch. Dataminr reported a median patch time of **43 days** versus an average attacker breakout time of **29 minutes**, and ZDNET described an ecosystem-wide surge in flaws across major vendors and open source projects, including high-volume bug discovery in Chrome, Apple platforms, and the Linux kernel. Open-source maintainers are also tightening disclosure processes under strain: GNOME reduced its disclosure deadline from **90 days** to **30 days** for new reports and said it would stop forwarding reports to projects that ban AI-generated content. Across the industry, the trend is pushing CISOs toward exploitability-based prioritization, stronger triage workflows, and selective automation rather than relying on raw finding volume alone.
Aug 5, 2026
AI-assisted vulnerability discovery is driving a sharp rise in open source security findings, straining the systems used to validate, disclose, and remediate flaws. Chainguard said its Athena coalition has already processed more than **20,000** AI-generated findings and helped produce over **2,000 patches** across **500 projects**, while Anthropic previously estimated its tooling uncovered **6,202** high- or critical-severity issues in more than 1,000 open source projects. The Linux Foundation has also launched **Akrites**, a coalition with a shared incident response capability and standardized coordinated disclosure process to help the ecosystem manage AI-enabled vulnerability discovery. GitHub said the resulting volume has pushed its Advisory Database to record levels, with **1,560** reviewed advisories published in May 2026 and more than **6,000** advisory decisions processed per month from March through May, yet incoming private reports, repository advisories, and CVE requests still outpaced review capacity. The company said reviewed advisories remain human-validated and Dependabot alerts continue to function normally, but publication timelines for many new advisories have stretched from roughly a week to several weeks as analysts handle package disambiguation, version-range reconstruction, multi-ecosystem verification, and conflicting upstream data; GitHub is responding with improved triage, expanded backend capacity, automation, AI-assisted research tools, and guidance for researchers to submit more complete reports and request CVEs only when publication is intended.
Jul 12, 2026