A single security pull request can consume up to eight hours of engineer time to review, according to Christopher Robinson, CTO of Akrites, a Linux Foundation initiative launched in June to tackle the mounting wave of AI-generated vulnerability reports flooding open source projects. Speaking at Open Source Summit Europe in Prague last week, Robinson and Laura Guazzelli, the Linux Foundation's security architect for AI and agentic systems, described how artificial intelligence has drastically lowered the threshold for vulnerability hunting, enabling almost anyone with a modest subscription to probe open source code regardless of their security expertise. "Everybody with a $20 account is now a researcher," Robinson told The New Stack.
The problem isn't just volume—it's quality and duplication. Robinson characterizes AI-generated reports as "very verbose," "highly inaccurate," and prone to overestimating severity while failing to provide the technical details engineers need to write patches or assess the actual threat. Because similar AI models examine the same codebases, maintainers receive multiple reports about identical issues. "We're getting a ton of duplicative reports," Robinson said. Meanwhile, AI models flag suspicious code without grasping the broader security architecture—protections implemented elsewhere that might neutralize a purported flaw. "The robots don't have the context," Guazzelli explained, noting that models can't recognize false positives when additional controls exist in other parts of the system. Robinson says Akrites currently faces a backlog of hundreds of thousands of reports awaiting review and upstream distribution.
Akrites has assembled roughly 200 seconded engineers from founding members including Anthropic, OpenAI, Google, Microsoft, AWS, NVIDIA, Cisco, IBM, Red Hat, Citi, and JPMorganChase. Unlike typical Linux Foundation projects, members contribute both financial support and engineering resources—up to 10 full-time engineers each, though some organizations substitute additional funding when internal policies prevent upstream contributions. Many of these engineers already maintain or contribute to upstream projects, bringing language-specific expertise and established community relationships. Akrites deploys AI to assess incoming reports and spot duplicates, while human engineers review findings before forwarding them to upstream maintainers. "It's my job to take those reports, make them more concise, understandable, and give the additional artifacts like test cases, proof of concept, and then patches," Robinson said. The organization also operates alongside OSS-CRS, a related Linux Foundation effort developing AI-powered tools that open source projects can use directly to investigate vulnerabilities and generate fixes.
The challenge reflects a broader tension: the same technology creating noise is also uncovering genuine security weaknesses, including chains of minor flaws that together enable serious exploits. "They'll take a series of low problems and be able to escalate that into a bigger exploit," Robinson noted, describing work that previously required months or a year but now takes hours. While the quality of AI-generated reports has improved considerably this year, Robinson says the better output comes from expensive paid models used by enterprises—organizations that are "better prepared, but they also are not necessarily taking those findings and reporting them to the upstream project." Robinson emphasizes that the costs of managing AI-generated security problems shouldn't fall on open source maintainers themselves. "A lot of that goes towards our infrastructure and our tokens because it is highly powered and enabled by LLMs," he said. "It is not an inexpensive proposition." His priority is ensuring security improvements reach the open source projects that need them rather than remaining siloed within commercial organizations. "The commercial orgs are welcome to take those patches, but I don't want to have things kind of isolated in this little jailed environment," Robinson said. The initiative underscores a fundamental shift: organizations profiting from open source infrastructure are now obligated to absorb the overhead their own automation creates, or risk exhausting the volunteer maintainers on whom that infrastructure depends.