Welcome to the Strip-Mining Era of Open Source Security

Metabase reported that since January 2026, security vulnerability reports have surged from 10 per month to 10 per week, with most turning out to be real vulnerabilities. The reports showed characteristics consistent with markdown formatting and LLM generation.

The cause is automated code scanning powered by AI coding agents. Multiple LLM models — including Claude Code (announced in February) and OpenAI's cyber defense tools — have seen a sharp improvement in their ability to find vulnerabilities in codebases. Security researchers have packaged this into SaaS services, building a business model around mass-scanning commercial open source projects and reporting the results.

Impact on open source maintainers:

• Maintainers must assume that any vulnerability found by one researcher will soon be found by other tools as well
• Even with a private disclosure agreement in place, vulnerabilities should effectively be treated as "already public" and fixed immediately
• Closed-source software can fix issues on its own schedule, but open source must live in reactive mode
• Cal.com has already gone closed-source for this reason, and other commercial open source companies are expected to follow

Recommendations for open source users:

• Assume that a vulnerability will be disclosed this quarter for every OSS dependency
• Budget for much more frequent upgrades
• Monitor and pin all dependencies
• Apply defense-in-depth principles
• Strengthen logging and observability
• Rigorously enforce the principle of least privilege

In the long run, all software will become more secure, but in the short term, significant pain is expected across the open source ecosystem.