AI-assisted bug hunting is set to flood open source with new vulnerability reports

Security teams may be heading into a difficult summer as advanced AI systems uncover a growing number of previously unnoticed flaws in widely used open source software, according to Chainguard CEO Dan Lorenc.

Lorenc said new frontier models are finding vulnerabilities at a pace that is changing the disclosure and remediation workflow for the industry. His comments came as Chainguard helped launch Athena, a coalition of roughly two dozen companies focused on using AI to identify and fix open source security issues more quickly.

Founding members of Athena include firms such as BNY, Cisco, Cloudflare, Docker, JPMorganChase, Kyndryl and PwC. Several members also participate in Anthropic’s Project Glasswing and OpenAI’s Daybreak, which provide access to advanced bug-finding models. According to Lorenc, Athena accepts findings from any frontier model and has already processed more than 20,000 reports while generating more than 2,000 patches across 500 projects.

Large-scale reporting creates new coordination problems

Lorenc said the challenge is no longer only finding bugs, but handling the sheer volume of discoveries. Many organizations can patch their own code when AI turns up defects in proprietary software. The harder problem comes when the same tools identify issues in third-party libraries that teams do not control directly.

He noted that modern applications often rely heavily on open source components, which means one scan can surface thousands of issues across many projects. That can leave security teams with large queues of reports, unclear ownership, and uncertainty about which maintainers are still active.

• AI tools are finding more issues in both proprietary and open source code.
• Open source disclosures can overwhelm maintainers when reports arrive in large batches.
• The time between public disclosure and real-world exploitation continues to shrink.

To manage that flow, Athena acts as a clearinghouse: it deduplicates reports, groups related findings, and works on broader fixes for vulnerable codebases. Affected projects are rebuilt as hardened private versions for members before public disclosure, with upstream notifications following later. In cases where maintainers cannot respond, the coalition says it can serve as a backup fixer of last resort.

The Linux Foundation has also joined the effort with Akrites, a separate coalition that will coordinate vulnerability response through a shared incident response team and a standardized disclosure process. Supporters say the goal is to reduce fragmentation and help maintainers handle AI-driven findings before attackers can take advantage of them.