Open-source security faces an AI-driven surge in vulnerability reports

Open-source security teams are facing a rising volume of vulnerability reports, with artificial intelligence contributing to the problem and potentially helping to manage it, according to a TechRadar report.

Speaking at the Linux Foundation Open Source Summit, Jamie Thomas, IBM’s Chief Client Innovation Officer for Enterprise Security, said about 66,000 unique vulnerability entries are expected in 2026. She described that as a fourfold increase from seven years earlier. Thomas also cited publicly available data indicating that the time needed to exploit a vulnerability has fallen from days to as little as 29 minutes.

Some reports are inaccurate, duplicated or not actionable. The article says curl developers ended the project’s HackerOne bug bounty program earlier this year after poorly researched and sometimes fake submissions, including AI-generated ones, became unmanageable. Google also temporarily suspended its Open Source Software Vulnerability Rewards Program. It stopped accepting new submissions on October 1, 2026, and plans to reassess the program in early 2027.

Linux creator Linus Torvalds has also criticized duplicated reports on the Linux security mailing list, according to the report.

Thomas argued that the security community should use AI to help maintainers filter duplicate and bogus reports, assess severity and prioritize urgent issues. AI tools could also help developers understand vulnerable code and suggest fixes. The article notes that some earlier reports found most AI-generated remediation suggestions caused more problems than they solved.