Open Source Security in the Age of AI Transcript, AI Summary & Key Points

00:00 90% that's roughly how much of the codebase in a modern enterprise is open-source. Banks, hospitals, power grids, telecoms, cloud platforms, even AI services you use every day. They're all built on code that a relatively small group of creators actually wrote. And a lot of it was done by volunteers, small teams creating global infrastructure. That's a formula that works really well for innovation, but doesn't always scale for time-sensitive maintenance and support.

00:30 In other words, critical infrastructure and best effort basis are two ideas that don't always go well together. For years, we've consumed open source a lot faster than we've invested back into securing it. And because everything's interconnected now, a flaw in one obscure library doesn't stay contained. It ripples out to thousands of downstream applications.

00:55 Here's what's changed recently. AI is collapsing the time it takes to find vulnerabilities. Work that used to take a skilled researcher weeks can now happen in minutes. Anthropics project Glass Wing is a good example. It found 2300 vulnerabilities across 400 open-source projects. That's big volume. In one case, a bug that they found had been in an open-source operating system sitting there in plain sight for 27 years.

01:25 It's a long time. No one saw it, but AI did. Discovery is far outpacing our traditional approaches for remediation. And really uncomfortable truth is that attackers have access to similar vulnerability discovery capabilities. So, as discovery speeds up on both sides, the real bottleneck isn't in finding the flaw anymore. It's everything that happens after you find it.

01:58 The race is on, and now it's a matter of who will get to the finish line first. The good guys with a well-applied patch or the bad guys with a devastating exploit. Thanks to the newest AI frontier models, finding a vulnerability is relatively easy. But fixing it, that's a whole other matter. And doing it safely is really hard. Once you know about a flaw, you still have to figure out things like this.

02:24 You need to know which versions are affected. You need to be able to map the dependencies that may exist among the various components. You've got to figure out what is the business impact of that. If I put this in, is it going to take the business down? uh will it affect something at the wrong time of the business cycle? Um then I need to develop an actual fix that I can later send out.

02:47 I've got to test that fix. Regression testing meaning go back and see if it broke anything. Not only did it fix the problem we have, but did it break anything in the process. Then I need to validate the uh compatibility of this particular fix. Make sure that it's going to work on all the different systems where I think it's going to go and then ultimately we get down to deploying the fix and we've got to do that into a production environment without breaking anything.

03:26 So a lot of things are moving here a million moving parts and it in a real world environment just upgrading to the latest version isn't realistic. We've got other considerations. We have to look at things like dependency conflicts. We've got to look at regulatory constraints and custom code that might be layered on top. So teams often need a tailored backport or validated alternative fix instead of what was the textbook answer.

03:54 And that takes real engineering judgment. AI can help, but it can't fully replace what a skilled software engineer can do. So finding more vulnerabilities is certainly a good thing because it helps us get a chance to fix them before they get exploited, but that's only true if we can scale up the remediation side, the fixing side, and it can keep pace.

04:18 In other words, just finding more bugs isn't automatically making anyone safer. In fact, it can actually make things worse if the ecosystem can't absorb the volume of all of these fixes. And since we can't just magically make all the bugs or the discovery tools disappear, we're going to need a new approach that can match the scale of the growing problem space.

04:34 Trust starts upstream. So we need to move to the source of open source. Open source projects carry years of architectural decisions and institutional knowledge that an AI model can't just infer directly from looking at the code. Human maintainers are essential for validating that a fix doesn't break something else to understand what the second order effects might be and keep the project stable over the long haul.

05:07 When someone contributes a remediation upstream instead of just in their own private fork, well, they're strengthening the ecosystem for literally everyone else so that they can benefit as well. Also, isolated forks create fragmentation problems for us. The opposite of what we actually need. But here's the thing. No single company, no matter how good their AI or their researchers are, can secure open-source by itself.

05:33 It's going to take a coordinated effort across AI providers, software vendors, cloud platforms, security companies, maintainers, and nonprofit foundations. A lot of people come to bear to make this work. That's the thinking behind efforts like lightwell and Akrites. Lightwell focuses on things like identifying, validating, and engineering remediations for vulnerabilities that hit the enterprise environments and contributing those fixes upstream wherever possible.

06:01 And Akrites focuses on the other half of the problem. This is where they're looking at coordinated discovery. They're looking at maintainer engagement and reducing the duplication of effort that might otherwise be. Together they represent connecting the whole pipeline. So we've got discovery going to remediation going to validation going to disclosure and ultimately deployment.

06:39 And that way we have everything working into a coordinated workflow rather than everyone working in isolation. Here's a quick look at how Lightwell actually works. First, we're doing discovery. We discover the vulnerabilities in open-source software, including software that might be buried deep inside an organization's application stack. Next, we use AI to help us analyze the vulnerability and the affected code, determining what the vulnerability actually does, how it can be exploited, and what needs to be changed.

07:16 Then, we develop a security fix. Rather than forcing a customer to upgrade to a completely new version, the fix can often be backported to the version they're already running. But a proposed patch isn't automatically trusted. AI assisted development is combined with engineering review testing to make sure that the fix addresses the vulnerability without introducing new problems.

07:44 Once validated, the remediation is made available through Lightwell's trusted software repositories, allowing the organization to incorporate it into their existing deployment and patching process. And finally, we go upstream with the fix. The fix can be contributed back to the open-source project. That means the remediation doesn't remain a private fix.

08:08 It can ultimately benefit everyone using that software. So while lightwell is a repository of trusted fixes, accretes is more of a shared security incident response team. Their website says that it gives critical infrastructure stakeholders a confidential structured place to coordinate vulnerability discovery, remediation, and disclosure across open-source projects that they depend on.

08:31 At the pace AI assistant attackers are now operating and that's the important part because the attackers are moving fast, we've got to move just as fast. Every finding follows the same path so that the upstream maintainers face one predictable partner and members get consistent embargo handling. How do they do it? Well, they start with intake, then they move to duplication and validation, then remediation, then synchronized disclosure.

09:03 Together, these provide a more expedited way for everyone to benefit from more secure open-source software. So, here's the real takeaway. The future of open- source security isn't going to be defined by who finds the most vulnerabilities. AI has already made discovery the easy part. It's going to be defined by who can actually fix the ecosystem and remediate those vulnerabilities safely, responsibly, and at scale.

09:36 Efforts like Lightwell and accretes are designed to help us deal with the volume and velocity of finding and fixing bugs in the massive open-source codebase that we all depend on. The race is on and now the good guys have a couple of ringers on their team. Yay for us. Make sure you take full advantage of these new capabilities to improve security at scale in your organization. To learn more, check out the links in the description below.