Python's CVEs Triple. Anthropic Funds a New Security Developer

In the past year, the number of Common Vulnerabilities and Exposures (CVEs) for Python and its package manager Pip has tripled, according to Python's security developer in residence Seth Larson. Additionally, the amount of malware published and subsequently removed from the Python Package Index (PyPI) has increased by 60%. Larson explains that securing Python's ecosystem has become more complex, particularly due to the evolving role of artificial intelligence in both security risks and response efforts.

To address this growing challenge, Python has decided to hire a new Security Developer. This individual, Brett Smith, will provide timely security response services and innovate to prevent future threats. Smith's responsibilities will include vulnerability remediation, serving as a CVE Numbering Authority, removing malware from PyPI, and providing bandwidth for new projects.

These initiatives include scaling PyPI's autonomous quarantine program to lessen manual effort on malware remediation and streamlining processes for the PSRT (Python Security Response Team) to handle the increasing volume of vulnerability reports. This hiring move is made possible by an ecosystem security grant from Anthropic. Python's security developer in residence emphasizes that the new Security Developer will not only bolster capacity for existing security work but also enable new, proactive security measures.