Dmitrijs Trizna

— On the schedule —

500 CVEs Later: Lessons from Securing Open Source with AI

Finding vulnerabilities is getting cheap for everyone, attackers included: after Anthropic announced Mythos in April, we gave the showcased bugs to small open-weight models, and most of them spotted the same flaws, some for cents per million tokens. At AISLE we have spent the last year on the defensive side, building a system that finds vulnerabilities, checks which ones are real and worth fixing, and proposes a patch; in open source this work has led to nearly 500 CVEs, including 15 in the OpenSSL Library (all 12 issues in its January 2026 security release). We will show how this works on real projects, with live demos of fixed bugs, and talk about what failed and how we try to keep the reporting load fair for maintainers. We will also show how cheap models read every new commit in key libraries to flag silent security fixes, at about $0.001 per commit, and why letting an agent read untrusted commits is a supply chain risk in itself. Finally, we show how per-step benchmarks built from past fixes tell us when a new model or prompt actually helps.