AI is making it easier than ever to find potential security vulnerabilities in open source software. But finding something that looks like a vulnerability isn’t quite the same as finding a genuine security flaw. As such, maintainers are being inundated with AI-generated reports that are inaccurate, duplicative, or lack the information needed to deploy fixes.

It’s a problem that Akrites, an initiative announced by the Linux Foundation back in June, is striving to solve. As The New Stack reported at the time, Akrites was established to provide a shared security incident response team (SIRT) that consolidates vulnerability reports, validates findings, and coordinates fixes with upstream maintainers.

Some three months on, and The New Stack was at Open Source Summit Europe in Prague, where we sat down with Christopher Robinson, CTO of Akrites and chief security architect at the Open Source Security Foundation (OpenSSF); and Laura Guazzelli, the Linux Foundation’s security architect for AI and agentic systems. We discussed the mounting pressure on maintainers, why better AI models aren’t necessarily making their lives easier, and how Akrites is attempting to address the problem.

Part of the overarching challenge is that AI has massively lowered the barrier to entry for vulnerability hunting, allowing almost anyone to start probing open source codebases, regardless of their security credentials.

“Everybody with a $20 account is now a researcher,” Robinson tells The New Stack.

Robinson had, in fact, appeared in a separate talk the previous day at the very same conference, appearing alongside OpenSSF chief of staff Adrianne Marcum , who had half-jokingly floated the term “ vibe researching ” to describe the growing number of people using AI tools to hunt for vulnerabilities.

Source link