AI finds bugs faster than humans can handle

Tools powered by artificial intelligence are identifying software bugs at a faster rate than human experts can review them, according to the OpenSSL Foundation. This organization is responsible for maintaining OpenSSL, an encryption library that secures a significant portion of HTTPS connections on the internet.

OpenSSL struggles with growing bug reports

The foundation's maintainers are finding it difficult to keep up with the increasing number of bug reports. The problem affects Mac users as well, since macOS uses LibreSSL, but OpenSSL is still a common component in tools installed via Homebrew and many servers.

Bug reports have surged in recent months

According to Axios, OpenSSL received an average of 71 reports per month from May to July, compared to just 9 a year earlier. The number rose to 108 in August. Over the past year, the foundation received around 500 vulnerability reports, but only 63 of them resulted in confirmed flaws. Many reports are duplicates or involve minor bugs, and each still needs a human to review them.

More engineers, but not enough time

The number of engineers authorized to review code has increased from 18 to 30 in two years, but the volume of contributions is growing faster than the reviewers can process. It currently takes six to eight weeks between the investigation of a report and the publication of a security advisory. The foundation uses AI to help review code and write tests, but human validation is still required.

AI tools may be over-reporting flaws

The foundation does not assign CVSS scores to the flaws it discovers. A technical director told Cyber Magazine that in one case, a "critical" score of 9.1 was given to a flaw that only applies to an extremely unlikely configuration. This suggests that AI tools may be identifying issues that are not as severe in practice.

Calls for better funding of critical software

Matt Caswell, the foundation's chief executive, is urging a change in how critical open source software is supported. He argues that these projects are essential infrastructure and should be funded accordingly. OpenSSL is not alone in facing these challenges, as the PHP Foundation also announced a dedicated security team in May, partly due to the increased number of vulnerability reports generated by AI.

PHP updates address critical flaws

PHP, a widely used programming language, released several updated versions in August to fix flaws that could allow remote code execution. While not all of these flaws were identified by AI tools, it is still important to ensure that servers are running the latest versions, especially after recent critical vulnerabilities were discovered.

AI lowers the cost of finding bugs, but not of fixing them

AI has made the process of finding software bugs almost free, but the cost of triaging and fixing them remains high. This burden often falls on volunteer-driven projects, which may lack the resources to handle the growing volume of reports efficiently.