The messy middle of AI-powered bug disclosure

AI is making vulnerabilities easier to find, but who’s going to fix them? On this episode, Greg Otto talks with Josh Bressers, VulnCheck’s director of coordinated vulnerability disclosure about the growing flood of AI-generated security reports.

Bressers explains why those findings are increasingly legitimate, how VulnCheck uses AI to streamline incoming reports, and why coordinating fixes still requires a human touch. They also explore the pressure on open-source maintainers, the risks of AI-generated patches, and the widening gap between the cost of discovering vulnerabilities and fixing them.

The conversation turns to a fundamental question: What would it take to fund and maintain open-source software like the essential infrastructure it is?