Loading story…
GNOME's security team changed its vulnerability-handling process by cutting the default disclosure deadline for new reports from 90 days to 30 days and by declining to forward reports to projects that prohibit AI-generated submissions. The policy shift, discussed widely on the oss-sec mailing list, reflects the view that most embargoed fixes are completed within the first month and that AI-assisted reporting has become common enough that many submissions now contain at least some machine-generated material. Participants also noted that some projects, including the Linux kernel, have moved away from embargoes for AI-generated reports because such findings can be easily reproduced and redistributed.
The change triggered a broader dispute over open-source security governance, with maintainers arguing that low-quality, verbose, or impractical AI-assisted reports are consuming scarce triage capacity and pushing burnout onto already overstretched teams. Mailing-list contributors said many externally submitted bugs are real defects but not necessarily exploitable vulnerabilities, while others warned that rejecting accurate reports could still increase user risk. The debate expanded to the Linux Foundation's Akrites initiative, described by critics as an attempt to coordinate AI-era vulnerability response and potentially serve as a "maintainer of last resort" for abandoned critical packages, though others stressed that such a role would not override project ownership or maintainer authority.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On August 3, 2026, Emily Shepherd referenced a Linux Foundation announcement stating that Akrites would act as a maintainer of last resort only for critical packages with no active maintainer, and that fixes should flow back on maintainers' terms. She argued this did not override project licenses, naming rights, or maintainer authority.
On August 3, 2026, Yves-Alexis Perez asked for a reference supporting claims that the Linux Foundation's Akrites initiative would coordinate security incident response and act as a 'maintainer of last resort.' His message highlighted that the thread had not yet substantiated those assertions.
GNOME stated that the new 30-day disclosure deadline would apply to new vulnerability reports starting August 1, 2026. This was presented as part of the July 20, 2026 policy change announcement.
In a July 20, 2026 blog post, GNOME announced changes to its security bug handling process. The changes included shortening its disclosure deadline for security bugs from 90 days to 30 days.
A pkgconf policy cited in the oss-sec thread asserted maintainer autonomy over disclosure schedules, embargoes, confidentiality demands, and machine-generated submissions. The policy also warned that organizations disrespecting maintainer autonomy could face an organization-wide ban.
In the oss-sec discussion, Alan Coopersmith said the GNOME security team would no longer forward vulnerability reports to projects that ban AI-generated content because most reports now contain at least some AI-generated material. Participants said Michael Catanzaro was honoring those projects' requests by not sending such reports onward.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceheronsperch.blogspot.com
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcemetr.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GNOME is changing its security-report handling process after volunteer maintainers were flooded with AI-assisted vulnerability submissions. For issues reported on or after **August 1, 2026**, the project will reduce its disclosure deadline from **90 days** to **30 days**, with security lead Michael Catanzaro saying the shorter window better reflects GNOME’s workflow because valid issues are typically fixed within one to three weeks, while others often remain unresolved. GNOME said it will apply the same rules to AI-assisted and human-written reports, but projects that prohibit AI-generated content will no longer receive forwarded reports when submissions contain AI- or LLM-generated findings; those issues will instead be closed in the tracker, though maintainers may still be notified. Catanzaro, who has overseen GNOME security issue tracking since 2020 with Red Hat support, also said he will stop tracking newly reported issues in **November 2026** and fully step away by **December 1** unless an experienced community successor is found.
Aug 2, 2026
AI-assisted vulnerability discovery is driving a sharp rise in open source security findings, straining the systems used to validate, disclose, and remediate flaws. Chainguard said its Athena coalition has already processed more than **20,000** AI-generated findings and helped produce over **2,000 patches** across **500 projects**, while Anthropic previously estimated its tooling uncovered **6,202** high- or critical-severity issues in more than 1,000 open source projects. The Linux Foundation has also launched **Akrites**, a coalition with a shared incident response capability and standardized coordinated disclosure process to help the ecosystem manage AI-enabled vulnerability discovery. GitHub said the resulting volume has pushed its Advisory Database to record levels, with **1,560** reviewed advisories published in May 2026 and more than **6,000** advisory decisions processed per month from March through May, yet incoming private reports, repository advisories, and CVE requests still outpaced review capacity. The company said reviewed advisories remain human-validated and Dependabot alerts continue to function normally, but publication timelines for many new advisories have stretched from roughly a week to several weeks as analysts handle package disambiguation, version-range reconstruction, multi-ecosystem verification, and conflicting upstream data; GitHub is responding with improved triage, expanded backend capacity, automation, AI-assisted research tools, and guidance for researchers to submit more complete reports and request CVEs only when publication is intended.
Jul 12, 2026
Security teams are struggling to keep pace as AI accelerates vulnerability discovery, bug bounty submissions, and pentest findings faster than organizations can validate and remediate them. Microsoft said it paid more than **$20 million** to **562 researchers** for **2,531** eligible reports across 15 bug bounty programs, attributing a surge in submissions in part to AI-assisted research, while Cloudflare said it now uses Anthropic’s Claude Sonnet to triage bug bounty reports, filtering duplicates and routing only higher-value submissions for human review. Survey data from Pentest-Tools.com similarly found that AI-generated findings are creating large validation backlogs, with practitioners citing false positives, duplicate reports, unexploitable issues, and even fabricated CVEs as persistent problems. The operational gap is widening as attackers move faster than defenders can patch. Dataminr reported a median patch time of **43 days** versus an average attacker breakout time of **29 minutes**, and ZDNET described an ecosystem-wide surge in flaws across major vendors and open source projects, including high-volume bug discovery in Chrome, Apple platforms, and the Linux kernel. Open-source maintainers are also tightening disclosure processes under strain: GNOME reduced its disclosure deadline from **90 days** to **30 days** for new reports and said it would stop forwarding reports to projects that ban AI-generated content. Across the industry, the trend is pushing CISOs toward exploitability-based prioritization, stronger triage workflows, and selective automation rather than relying on raw finding volume alone.
Aug 5, 2026