Discovering gaps faster than fixing them: AI confuses security programmers

The OpenSSL Foundation faces growing challenges as the number of bug reports and code contributions supported by artificial intelligence rises, while maintenance teams struggle to review, verify, and fix discovered issues, according to a report by Axios.

The OpenSSL Foundation, responsible for developing the widely used encryption libraries that secure online communications, faces growing challenges as the number of bug reports and code contributions supported by artificial intelligence rises, while maintenance teams struggle to review, verify, and fix discovered issues. According to a report published by Axios, AI tools have accelerated the discovery of potential vulnerabilities within open-source software, but have conversely increased pressure on developers responsible for validating reports and preparing necessary fixes. A review conducted by the foundation showed that the number of new issues exceeded the number of files that developers were able to close during most of the recent months covered by the review, despite an increase in the volume of work completed. The OpenSSL library plays a crucial role in protecting data and digital communications, providing encryption tools that can be integrated into various applications and services, for both commercial and non-commercial use, under its licensing terms. Treating any potential flaw in the library requires identifying affected versions and configurations, verifying the nature and severity of the issue, before developing, testing, and making fixes available to users. The project's official security policy states that the security response team receives and investigates reports, and may consult external experts or organizations.