Burglar Alarm by O.B.McClintock Co. in Scandia, Minnesota — by Flickr user Lorie Shaull.

So the intertubes are all abuzz about reports of newfound vulnerabilities in open-source software.

For instance, consider this breathless headline: WordPress Tightens Bug Bounty Scope After Monthly Security Reports Nearly Double to 773

Sounds awful.  But to see why I’m less concerned, see what I think is the key paragraph in that post

“Last month I mentioned we had a record 450 security reports to the WordPress HackerOne program. August ended at 773,” WordPress Security Team rep John Blackbourn wrote in Post Status Slack on Tuesday. “Unmanageable numbers of low severity reports means that today we’ve had to make changes to the scope of the program.”
— Source: TheRepository (emphasis mine)

I’m just going to keep saying that AI now lets almost anybody (and everybody) pour through open-source code and find and report vulnerabilities. That’s a HUGE improvement over the old status quo where only black hats and “state-sponsored entities” had the incentive to do that level of manual code review. Because black hats and “state actors” could directly exploit or sell them on the dark web.

So the big, big questions I’ve got would be

1) What percent of those 773 reports were duplicates?
2) What percent of the non-duplicates found score higher than low priority in terms of real-world exploitability?
3) What percent have NOT already been patched in recent updates?
4) How many versions back has the vulnerability existed?

Those are all important questions. Because I’m… pretty sure if I threw any random batch of open-source code at Claude or Codex, it would come up with some kind of vulnerability somewhere either in the code or in one of the libraries or dependencies it calls. It probably wouldn’t take that many tokens and very likely would work with the free version.

And since, unlike previous manual grinds by bounty hunters or black hats, it would be cheap and easy enough to report the problem, I’d probably do that instead of looking for a way to capitalize on it on the dark web or as a “state actor.”

But also, since it now really is cheap or even free, chances are that if everyone else is looking, then I’m not even going to be the first person to find and report it.

So, again, the raw number of 773 reports isn’t the issue; it’s how many are unique and how many are critical.  (Answer: not that many.)

Even if I wasn’t feeling generous to WordPress, or to any random developer, I still wouldn’t be surprised if they updated their bounty program to weed out what may eventually boil down to “spam” vulnerability reports.

Could I be wrong? Absolutely. Maybe John Blackbourn just doesn’t want to admit that every single one of those reports is really a high-priority, critical vulnerability. If so, then, sure, yikes!  They’ll need to get on that.

But even then, it still doesn’t change my overall point!  Odds are extremely low that another 773 critical vulnerabilities will be found and reported. Because that’s how low-hanging fruit works. There will almost certainly be some more.  But critical vulnerabilities are a finite resource.  And so there are going to be diminishing returns.

And it still doesn’t imply that each of those initial vulnerabilities will be that hard to patch. Many or most are easily fixed once identified.

And the next vulnerabilities will take even longer to find, while likely still being easy to patch.

AND it’ll become just as cheap, and just as easy, for developers to start running the same AI prompts on their own code before it’s released.

That’s why I’m both concerned about the risk of vulnerabilities in the short term (next 1-3 months) but optimistic about the future (2027 and beyond) Not because no one will ever code another bug or that no one will ever find another. But because finding and reporting them (or finding them in our own code) will be easy enough that the window for exploitation and the incentives to do so are about to become quite a bit smaller.