AI speeds open-source vulnerability detection, but patching remains a major hurdle

IBM and Red Hat’s latest Open Source Security Signals report reveals that AI tools are improving the discovery of vulnerabilities in popular open-source components, including Netty, Spring Framework, and the Android Open Source Project. Despite faster detection, the report stresses that remediation is hampered by scarce maintainer capacity, with many contributors unpaid and under-appreciated, leading to average fix times of 54.81 days for critical issues.

Real-world incidents such as the 2024 Ultralytics supply-chain breach illustrate how attackers can compromise build pipelines, while a May 2026 Netty update required extensive testing across dependent applications. A modeled Java vulnerability affecting JAXB could demand 5.7 million engineering hours and cost $712.5 million to resolve. The analysis urges firms to maintain accurate software inventories, establish clear patch-management processes, and consider supporting open-source maintainers financially or through contributions.