Open source maintainers are being swamped by AI-generated vulnerability reports that are verbose, inaccurate and duplicative. At Open Source Summit Europe in Prague, The New Stack interviewed Christopher Robinson, CTO of Akrites and chief security architect at the Open Source Security Foundation, and Laura Guazzelli, the Linux Foundation’s security architect for AI and agentic systems, about the Linux Foundation initiative announced in June to create a shared security incident response team. Robinson said ‘everybody with a $20 account is now a researcher’, estimating that reviewing a single security pull request can consume up to eight hours of engineer time, and that similar models surface the same bugs repeatedly. Guazzelli noted models lack project context and cannot judge false positives. Akrites’ founding members include Anthropic, OpenAI, Google, Microsoft, AWS, NVIDIA, Cisco, IBM, Red Hat, Citi and JPMorganChase, with members contributing up to 10 engineers each; Robinson says he has ‘a fleet of about 200 seconded engineers’ validating findings before fixes are coordinated with upstream projects.
"Everybody with a $20 account is now a researcher": How Akrites is tackling the flood of AI bug reports
Open source maintainers are being swamped by AI-generated vulnerability reports that are verbose, inaccurate and duplicative. At Open Source Summit Europe in Prague, The New Stack interviewed Christopher Robinson, CTO of Akrites and chief security architect at the Open Source Security Foundation, and Laura Guazzelli, the Linux Foundation's security architect for AI and agentic systems, about the Linux Foundation initiative announced in June to create a shared security incident response team. Robinson said 'everybody with a $20 account is now a researcher', estimating that reviewing a single security pull request can consume up to eight hours of engineer time, and that similar models surface the same bugs repeatedly. Guazzelli noted models lack project context and cannot judge false positives. Akrites' founding members include Anthropic, OpenAI, Google, Microsoft, AWS, NVIDIA, Cisco, IBM, Red Hat, Citi and JPMorganChase, with members contributing up to 10 engineers each; Robinson says he has 'a fleet of about 200 seconded engineers' validating findings before fixes are coordinated with upstream projects.
Source: The New Stack