The Impact of AI on Open Source Software

Two people looking at source code on a laptop, one pointing at a line while the other holds the keyboard
Source: Christina Morillo on Pexels.

On October 16, Trail of Bits updated the public scoreboard for Patch the Planet, the program it runs with OpenAI. Across 68 open-source codebases the count stood at 1,995 potential bugs reported. Of those, 466 had a fix merged upstream. Another 213 had a patch open and waiting on a merge. The remaining 1,316 were still awaiting a patch, a bucket the dashboard labels “reported + confirmed.” The chart notes that the tally includes reports closed during triage. Read as arithmetic, the program had attached an outcome to every filing, and for most filings the outcome was that upstream had not taken a fix.

Five days later one of those codebases was the news. PHP shipped emergency releases for two critical holes, CVE-2026-109618 and CVE-2026-109619, and CISA told operators to patch. On the scoreboard PHP is a line of 72 reports. It sits ninth, behind scapy, crypto-bigint, vllm, keycloak, samba, zeek, ansible, and cryptlib. The headline was a runtime that a large share of the web depends on. The books of the program that has been pointing models at open source since June describe a queue.

Finding moved

In June, a week into the work, Trail of Bits wrote down what the models had already changed. Dozens of its engineers, paired with maintainers and with a frontier model it called GPT-5.5-Cyber, covered 19 projects: cURL, NATS, the Go project, Python and python.org, PyPI, urllib3, aiohttp, freenginx, Sigstore, Valkey, RustCrypto, and others. The public tally was 64 pull requests and 51 issues, and they said private channels such as HackerOne and security advisories held more that was not ready to count. One model, given a narrow goal and no procedure, stood up a fuzzing lab in under a day, work they estimated at two or three weeks for one of their own fuzzing experts. Another pipeline took old vulnerabilities and went looking for variants. The sentence at the bottom of that post is the sentence the October dashboard measures. Finding the bugs had become the easy part. The cost had moved to confirming a finding, getting the severity right, writing a patch a maintainer will accept, hardening the code around it, and coordinating the disclosure.

They were trying to pay that cost in-house. The June post makes a point of arriving with patches rather than with issues alone, and of work that is ordinary engineering: a scanner wired into python.org’s release process, correctness repairs in a big-integer library other cryptography sits on, supply-chain files for Python’s Windows builds. The maintainers of aiohttp, faced with a private cluster of client and server issues, wrote and merged all eight fixes within hours, seven of them inside a single five-hour window. That is what it looks like when the people who own the code can still absorb a delivery.

By October 16 the merged column had grown to 466. Of those merged fixes, 73 were rated high, 233 medium, and 87 low. Eighty CVEs had been assigned, among them issues in aiohttp, containerd, the Python cryptography library, curl, Firefox, and keycloak. A staffed lab can turn a model’s output into something a project will merge. The scoreboard also records the conversion. Four hundred sixty-six merged, out of 1,995 filed, inside a program whose design is to bring the patch along with the report.

What a structural bug still costs

The PHP releases are the expensive part in its stark form: an old flaw, under shared infrastructure, with no repair that is free. In 2024 a funded audit saw an out-of-memory problem in the engine and could not prove a path an attacker could walk. The repairs on offer each spent something the project could not casually spend. One broke existing programs. One opened a new way to knock a worker over. One asked an ecosystem of third-party extensions to move together. The security team decides by consensus, and the number of people who know the engine well enough to choose was small. The choice stalled for months. The Foundation, publishing alongside the October releases, calls that delay a structural failure of process and of headcount.

In August the missing proof arrived three times. Calif, OpenAI, and Wiz, working separately, showed the bug could be driven to remote code execution. Ryan Austin at Calif writes that the initial discovery used no special harness and no model the public was barred from using. He also writes that the model had to be aimed. Its default habit is to walk from the newest famous bug toward the neighboring code. An obscure primitive from twenty years ago has to be named by the person holding the prompt. Wiz, using Wiz Atlas, Google’s Gemini 4 Argon, and GPT-5.6 Sol, says one researcher finished in a week a chain that would previously have taken a strong team months, because the slow work was adapting the chain to each version, each configuration, and each memory layout. OpenAI calls the gap before attackers a defender’s window, and says the same capabilities help attackers build exploits once they have them.

Set side by side, the window has a measurable width. It is the time between a model that can finish an adaptation and a person who knows which decade of the code to point at. Austin’s account puts that model in general availability already. A lead measured in exclusive access expires when the lab widens access. A lead measured in knowing where to look expires as that knowledge spreads, which is what a public write-up does.

The repair stayed with the maintainers. From the day the proof was in hand, a small group paid by the PHP Foundation treated the fix as its first priority and carried it through every supported branch. The public advisory describes the change as a design decision in the center of the engine: stop abandoning a request while its state is only half built. A lab can show that the old behavior is reachable. Shipping the new behavior means knowing which extensions will break, and signing that compatibility cost in public. Branches older than the supported line are outside the project’s own updates, so anyone still on them waits on a distributor or moves.

The same desk shows the cheap side of the tool. Since July 1 the PHP security team had published 15 CVEs and closed 106 reports that were not vulnerabilities, or were duplicates, or failed to reproduce. Alexandre Daubois, writing on October 14, said a raw model transcript costs as much time to refute as a real bug costs to confirm. Reports written with a model are welcome when the sender has reproduced them and understands them. Trail of Bits had already named the mechanism. Without a project’s own rules in front of it, a model defaults to rating everything critical. The mitigation they recommend is a document the project writes for the model: a threat model, a severity scale, an instruction file that says which pages to read before a report is filed. In their experience, PyCA’s security documentation cut the false candidates sharply. Open source security work now includes teaching other people’s models what this project refuses to call a vulnerability.

The new seat at the table

Someone has to employ the people who do the expensive part. Patch the Planet is one arrangement. A security firm and a model company clear engineers’ calendars, point frontier models at codebases the maintainers have agreed to open, and try to hand back a triaged patch. OpenAI’s October 21 post turns the PHP months into a five-stage pattern it wants reused. Validate and fix upstream, and use the models to look for ways around the patch. Decide who needs to hear before the public does. Bring government agencies in. Widen the circle to distributors, hosts, and operators. Publish the guidance, and stay while the update lands. The offer beside the pattern is concrete: a billion dollars in subsidized model access for frontline defenders, Codex subscriptions for maintainers, sponsorship of efforts such as the Rust Foundation, and hands-on help for projects that apply. The post also says findings of this kind should increase sharply in the coming months.

The offer is usable, and it moves the gate. A serious report used to arrive on a list the maintainer controlled, at a rate a maintainer could still read overnight. The October dashboard records a peak of 224 reports filed on a single day in June, a count that includes whatever triage later closed. Reading 224 of these, refusing the ones that only sound severe, and merging the one that is real, is a staffed job. The programs that can field it hire a room of people to sit between the model and the project. aiohttp remains the case where the maintainers did the merge themselves, in an afternoon. A project with that kind of spare capacity absorbs a cluster. Across 68 codebases, spare capacity is the exception. The ordinary project inherits the lab’s calendar, the lab’s severity language, and the lab’s theory of who should know early.

The PHP disclosure is that theory meeting a Tuesday. Coordination held until two days before the planned release. On October 20 the two identifiers leaked with a wrong release time and a score of 10.0, against the 9.2 on the advisories. Technical detail had stayed inside the group that already knew. PHP moved the release forward by a day, because distributors were still packaging and a same-night publication would have left operators without a package. A proof-of-concept video went up by mistake and kept moving after it was taken down. At 07:41 UTC on October 21, more than six hours before the agreed hour, Chainguard published container images that already contained the fix. The repair could be studied in binary form while every other installation waited. Early notice works for as long as the list of people who hear early behaves like a list. At the volume these programs are built for, that list is part of the security problem the disclosure is trying to manage.

What the price change leaves in place

The dependence was already lopsided. A few people maintain components that a large number of companies run, and the companies’ contributions have long been optional. AI changed the price of acting on that dependence. A theorized flaw in an old component can be turned into a working demonstration by a person with a generally available model and a reason to look in a particular decade of the tree. The same models, pointed without that reason, fill a queue with confident noise. Both streams land on one desk.

The desk has three ways to answer. The maintainer can still read, refuse, and merge, which is the aiohttp afternoon, and which stops being available at 224 filings a day. A foundation or a public funder can hire the people who know the code well enough to choose a painful repair, which is how a stalled 2024 note became four PHP release branches, paid for by the Foundation and, earlier, by a government audit. Or the lab that operates the model can arrive with its own staff, its own triage, and a published plan for the next emergency. The October numbers are that third arrangement on an ordinary day. Hundreds of fixes have merged, most of them medium. A larger pile is still waiting, and it is waiting on the lab’s list.

On October 26 the question of use was no longer theoretical. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog, updating the alert that had told operators to patch. Calif’s account places the earliest affected path at PHP 5.4.0. The fixes that exist start at 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The research finished a path in an interpreter version the project no longer ships, and the catalog now records that the path is being walked.

Open source security used to be limited by how many specialists would spend a month inside one codebase. It is now limited by how many people can sit downstream of a model and still be believed when they call a report wrong, or call a patch too expensive to ship. Those people can work for the project. They can work for the company that runs the model. The week’s emergency showed what is at stake when the component is shared infrastructure. The scoreboard shows the emergency is the exception. After this change in price, the ordinary condition is a queue that moves faster than the merge.

References