AI Finds Vulnerabilities Faster Than Open Source Can Fix Them

The core claim. AI has changed the economics of finding bugs, not fixing them. Security researchers and bad actors can now run vulnerability discovery against every package in a system, continuously. Poole, a supply chain specialist who ran DevRel at Sonatype and now works for Hero Devs, argues the result will be packages that used to produce one CVE now producing four or five, and unsupported projects producing CVEs nobody fixes or reports.

The attack surface. None of the individual risks are new. Typo confusion, renamed packages, compromised maintainers, and developers piping remote scripts into a shell are familiar weak points. What changed is volume. AI-generated applications pull roughly three times more dependencies than a human-written app, according to studies Poole cites. That multiplies the attack surface without adding any understanding of vulnerability risk.

The maintainer math. The fixing side is still human. Maintainers who already burn out now face an order-of-magnitude increase in bug reports, and many will walk away. The consequence is a growing class of unmaintained but widely used packages where CVEs exist, researchers and attackers know them, and no one is obligated to publish a fix. Poole's company makes money from exactly this gap, which is worth remembering when evaluating the warning.

The regulatory turn. The Cyber Resilience Act and cyber insurers now push organizations toward reporting vulnerabilities and applying best-effort fixes in short timeframes. Staying close to the latest maintained release is the safest position, but it requires upgrade machinery most teams do not have. Poole predicts fragmentation: paid support for critical open source, free software left behind, and security patches landing in commercial forks first. That is a plausible future, not proven.

The Kubernetes signal. The Kubernetes project has already taken a visible position: no co-authorship with AI, human responsibility for AI-generated code, and skepticism about AI tool output quality. That is a concrete governance model other projects and companies can adopt. Poole also says an AI tool called Fable found real bugs he had missed and helped fix them, so the capability is improving, but non-deterministic output still has to be validated like any code.

The leadership takeaway. Teams should reduce dependency count, know which packages are unmaintained, and define a policy for AI-generated code and dependencies before an incident forces one. The urgency is high because the CRA is already in force, but the evidence is mostly anecdotal. Treat this as a risk-management conversation, not a prediction of collapse.