Drinking from the Firehose: How Developers Are Coping with AI-Found Vulnerabilities

AI has made vulnerability discovery cheap and fast. Projects now receive a steady stream of reports, from low-severity issues to critical CVSS 9+ findings, at a volume that was rare only a year ago. In this episode Matt Farina and Robert Sirchia talk through what that looks like in practice for maintainers, distributions, and companies that ship or rely on open source.

They cover responsible disclosure and the limits of a 90-day window when the inbox never clears, the difference between a real vulnerability and a security smell, and why a high-quality report still needs a working proof of concept. They look at how the Linux kernel and downstream distributions absorb large drops of findings, why bug-bounty economics are shifting, and how threat models, minimum report quality bars, and AI-assisted triage can help teams focus on issues that can actually be exploited. They also discuss the pressure on legacy and end-of-life software, the case for more frequent security releases, and practical ways companies and foundations can support the people who keep the software running.

Key topics:

• Volume and prioritization of AI-found reports
• Responsible disclosure under high report volume
• Proof-of-concept requirements and report quality
• Impact on the kernel, distributions, and end-user software
• Threat models, metrics, and funding for sustained triage
• Why scanning is cheap but validation and shipping fixes are not