Why AI is both a curse and a blessing to open-source software - according to developers

"Anthropic's Frontier Red Team found more high-severity bugs in Firefox in just two weeks than people typically report in two months. Mozilla proclaimed: 'This is clear evidence that large-scale, AI-assisted analysis is a powerful new addition in security engineers' toolbox.'"

"Daniel Stenberg, creator of cURL, noted that until early 2025, roughly one in six security reports to cURL were valid. He explained: 'in the old days, you know, someone actually invested a lot of time [in] the security report. There was a built-in friction here, but now there's no effort at all in doing this. The floodgates are open.'"

"Brian Grinstead and Christian Holler from Mozilla wrote: 'AI-assisted bug reports have a mixed track record, and skepticism is earned. Too many submissions have meant false positives and an extra burden for open-source projects.'"

AI's impact on open source software development presents a dual reality. Anthropic's Claude Opus 4.6 successfully identified high-severity Firefox bugs through AI-assisted analysis, demonstrating legitimate security benefits. However, the same technology creates significant problems when misused. cURL maintainer Daniel Stenberg reports that AI-generated security reports have flooded projects with invalid submissions, reducing valid report rates from one in six to one in twenty or thirty. The lack of friction in submitting AI-generated reports contrasts sharply with traditional manual submissions requiring substantial time investment. Mozilla engineers acknowledge this mixed track record, noting false positives burden open-source projects. Linux projects are leveraging AI for routine maintenance tasks, showing productive applications beyond security analysis.

Read at ZDNET