Open-source security in the AI exploit era: Patch without changing a thing
Here’s how a vulnerability in a popular open-source library plays out in 2026: A maintainer merges a fix and publishes The post Open-source security in the AI exploit era: Patch without changing a thing appeared first on The New Stack .
In 2026, an open-source library suffers a vulnerability, and within hours, a model can generate a functioning exploit using the difference between the old and new versions. By the following morning, a vulnerability scanner flags the Common Vulnerabilities and Exposures (CVE), and the patch is scheduled for the next week's change window.
However, this practice is now considered outdated, as models like Anthropic's Mythos and OpenAI's GPT-5.5 can discover new high- and critical-severity zero-days at a scale no human research team can match. Within the first month alone, Anthropic and its Project Glasswing partners found over 10,000 such vulnerabilities. The time from disclosure to the first exploitation has decreased from a year in 2021 to just one day in 2026, and it's projected to be just one minute by 2027.
Open source is the first to bear the brunt of this pressure, as it is the foundation of modern software development and is open for anyone to access. The people responsible for absorbing this flood of AI-driven vulnerabilities are mostly volunteers, and only 75 out of 530 high- and critical-severity findings reported by Anthropic to open source maintainers had been patched by May 2026.
To address this issue, organizations need to shift their security strategies and focus on patching speed rather than just accuracy. Professional open source, backed by a vendor or a foundation with staffed security response, funded maintainers, and an SLA, is one solution to ensure that vulnerabilities are promptly addressed.
Written by urgent.news from The New Stack's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
