A key internet security tool is getting buried in AI-generated bug reports
Challenges at OpenSSL offer a glimpse at broader open-source risks.
TL;DR
- OpenSSL has seen a significant rise in monthly security reports and inquiries, from nine last year to an average of 71 between May and July, and 108 in August.
- While AI tools are effective at finding vulnerabilities, many reports are duplicates or low-severity bugs, still requiring human review.
- The increased reporting rate strains the limited number of experienced engineers needed to validate vulnerabilities and approve code changes.
- Other encryption libraries like Bouncy Castle and cryptlib are also experiencing a similar increase in reports.
- OpenSSL is using AI for code review and vulnerability investigation but still requires human approval for changes.
- The project is urging more developers to become reviewers and is seeking additional funding, emphasizing the need to treat critical open-source software as infrastructure.