“Everybody with a $20 account is now a researcher”: How Akrites is tackling the flood of AI bug reports
AI is making it easier than ever to find potential security vulnerabilities in open source software. But finding something that The post “Everybody with a $20 account is now a researcher”: How Akrites is tackling the flood of AI bug reports appeared first on The New Stack .
The increase in AI-generated reports about potential security vulnerabilities in open source software is overwhelming maintainers. An initiative called Akrites, launched by the Linux Foundation in June, aims to tackle this issue. Akrites plans to provide a shared security incident response team to validate findings and coordinate fixes with upstream maintainers.
Christopher Robinson, CTO of Akrites and chief security architect at the Open Source Security Foundation, and Laura Guazzelli, the Linux Foundation's security architect for AI and agentic systems, discuss the challenges faced by maintainers and the role of AI in vulnerability hunting.
Robinson emphasizes that AI has lowered the barrier to entry for vulnerability hunting, allowing almost anyone to probe open source codebases. He jokingly describes this as "vibe researching," referring to the surge of AI-generated security reports that require human expertise to separate genuine threats from noise. Reviewing a single security pull request can take an engineer up to eight hours, which could otherwise be spent on other tasks.
Guazzelli points out that AI models may identify suspicious code without understanding the broader security architecture of a project, which could render reported vulnerabilities harmless. They may also flag code as vulnerable without acknowledging existing security measures that prevent exploitation. Furthermore, many AI models find similar bugs, leading to a large number of duplicative reports.
Despite improvements in AI-generated vulnerability reports this year, the benefits are not always reaching open source maintainers. Expensive paid models produce better reports, but these companies may not always share findings with upstream projects. Akrites, with significant backing from industry giants like Anthropic, OpenAI, Google, Microsoft, AWS, NVIDIA, Cisco, IBM, Red Hat, Citi, and JPMorganChase, aims to address these challenges.
Members contribute not only financial resources but also engineering expertise, bringing valuable contributions to help maintainers separate genuine threats from noise.
Written by urgent.news from The New Stack's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
