OpenSSL grapples with surge in AI-driven security reports

Traders Union
All News
Business & Wealth
Companies
OpenSSL faces AI security surge

Highlights

OpenSSL received an average of 71 security reports per month from May to July 2024, compared to nine a year earlier, with 108 inquiries in August.
Despite doubling its authorized code reviewers from 18 in July 2024 to 30, OpenSSL's review capacity remains outpaced by soaring AI-generated vulnerability reports.
Related encryption libraries like Bouncy Castle and cryptlib face similar strains, as AI tools unearth more low-severity issues requiring human verification, delaying patch publication by up to eight weeks.

Report volumes outpace review capacity

As first reported by Axios, OpenSSL received an average of 71 security reports and inquiries per month between May and July, up from nine during the same period a year earlier, according to OpenSSL Foundation executive director Matt Caswell. That figure rises to 108 inquiries in August, and the project receives roughly 500 vulnerability reports over the past year, with only 63 resulting in disclosed vulnerabilities.

Caswell says many submissions are duplicates, minor software bugs or issues that do not justify a security advisory, but each still requires human review. He adds that most vulnerabilities identified by AI tools are low-severity issues rather than major flaws, yet they still consume scarce engineering time.

OpenSSL has roughly doubled its new contributors over the past year, but Caswell says training engineers to become experienced reviewers takes much longer. The number of engineers authorized to approve code changes has grown from 18 in July 2024 to 30 this month, largely through funded engineering roles, but new submissions are still arriving faster than the project can process them.

Broader strain across critical open-source security

OpenSSL's position makes the backlog especially significant because its software secures communications across the internet. The 2014 Heartbleed vulnerability shows how a flaw in a widely used open-source library can expose sensitive data, including passwords and encryption keys, across large numbers of services.

Maintainers of other encryption libraries, including Bouncy Castle and cryptlib, say they are also handling more reports for review, suggesting the pressure extends beyond a single project. Even when AI tools propose fixes, human reviewers are still needed to verify the changes, approve patches and decide whether an issue represents a real security threat.

Caswell tells Axios that AI is uncovering problems in obscure parts of OpenSSL's code that human researchers have often missed, but investigating a vulnerability, preparing a patch and publishing a security advisory can still take six to eight weeks. Tomáš Mráz, chief technology officer at the OpenSSL Foundation, says the project is also deploying its own AI tools to review code, investigate reported issues and write software tests, while keeping human approval as a requirement for code changes.

OpenSSL is urging more developers to help with code review rather than only submit new contributions. Caswell says the project needs more trained reviewers and additional funding to keep pace, arguing that critical open-source software should be financed as essential infrastructure.

In our earlier article on Cohere’s planned acquisition of AI cybersecurity startup AISLE, we covered how the deal would add AI-based software vulnerability detection to Cohere’s broader enterprise push alongside its tie-up with Aleph Alpha. We also noted that AISLE’s tools reported finding more than 500 bugs in widely used software in its first year, including a dozen OpenSSL vulnerabilities that were subsequently fixed—highlighting how AI-driven discovery is increasing the flow of security findings into critical open-source projects.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.