AI-generated bug reports overwhelm open source security, IBM says AI can help fix it
Speaking at the Linux Foundation's Open Source Summit, IBM chief client innovation officer for enterprise security Jamie Thomas warned of a "tsunami in vulnerability disclosures," with roughly 66,000 unique entries expected in 2026 — about a fourfold increase over seven years ago — while time-to-exploit has shrunk from days to as little as 29 minutes. At the same time, AI-generated reports that are duplicated, low-quality or outright fake are swamping maintainers: curl shut down its HackerOne bug bounty, Google suspended its open source vulnerability rewards program, and Linus Torvalds called the Linux security mailing list "almost entirely unmanageable." Thomas argued the community should keep AI-powered vulnerability discovery but use AI to filter duplicates and bogus reports, assess severity and assist remediation, with efforts such as OpenSSF reducing the burden on maintainers.
Open source components underpin vast numbers of downstream applications, so if maintainers are buried in AI-generated noise, AI-driven bug discovery could end up weakening supply chain security rather than strengthening it.