joe curlee

The New Security Tax: How AI Is Reshaping Cybersecurity and Shifting Its Costs onto Open Source November 9, 2026

Four days. That is how long one AI-discovered flaw in BeyondTrust software survived between disclosure and exploitation in the wild in 2026. A second wave followed within a week. Google's Threat Intelligence Group documented the case not as an anomaly but as a pattern: the time between finding a weakness and weaponising it has collapsed, while the time required to fix software properly has not.1

Vulnerability discovery used to be slow and artisanal: weeks of reading code for a single credible finding. It is becoming industrial — parallel, automated and cheap at the margin. Repair remains artisanal. Someone must reproduce each report, judge whether it describes a vulnerability at all, patch without breaking dependents, test for regressions, coordinate disclosure and ship the fix. Machines accelerated the first half of that work. People still perform the second.

That asymmetry is the subject of this essay. AI companies now sell, give away and withhold cybersecurity capabilities of genuine power. The benefits are real: flaws found by defenders need not be found first by attackers. But the costs of the new volume — triage, validation, patching, distribution and legal risk — fall disproportionately on the open-source maintainers whose unpaid or underfunded work underpins the commercial stack. The firms profiting from acceleration do not currently pay in proportion to the burden acceleration creates. They should.

The Acceleration of Vulnerability Discovery

Google's September 2026 study is the strongest public evidence because it tries, explicitly, to separate three events that commentary routinely merges: disclosure, exploitation and attack. Across January 2025 to August 2026, Google reports monthly disclosures roughly doubling within 2026 alone, from 5,045 in January to 10,740 in August. Vulnerabilities rated High-Risk under Google's own methodology — a Google rating, not CVSS — rose from 131 to 350 per month over the same period. Observed exploitation rose too, but from a far smaller base: an average of 18 vulnerabilities exploited per month in early 2026, against 10.5 per month in 2025.1

Two qualifications sharpen the point. Only 0.23 percent of 2026 disclosures — about one in 431 — were ever observed exploited. This is not a flood of successful attacks; it is a flood of work that must be assessed because no one knows in advance which fraction attackers will choose. Raw counts are also inflated by automated CVE assignment (some 5,000 Linux-kernel-mentioning records in eight months, none observed as exploited zero-days), and AI attribution is heuristic: CVE records carry no standard field for how a flaw was found.1

The longer baseline agrees: published CVEs rose from roughly 29,000 in 2023 to 40,000 in 2024 and 48,000 in 2025, successive records before 2026.2 AI-attributed findings also skew worse: remote-code-execution consequences in 50 percent of AI-discovered flaws versus 26 percent ecosystem-wide, a skew Google attributes partly to aiming agents at critical infrastructure and privilege boundaries. Exploitation has scaled in tandem with disclosure since May 2026, not ahead of it — and this essay claims no more than the data shows. Discovery now scales with compute. Remediation scales with maintainers.

The Commercialisation of Offence and Defence

In November 2026 OpenAI announced GPT-6 Cyber, a model purpose-built for vulnerability research, exploit validation and penetration testing, rated “Critical” for cybersecurity under the company's own Preparedness Framework. OpenAI reports 48.5 percent success on its ExploitGym benchmark, near-total adherence to researcher-set scope in its honeypot evaluation, and 81 previously unknown Firefox bugs that Mozilla rated high severity. Access is not general. The model is offered only to vetted customers in the company's Daybreak Red programme, through its API and coding tools.3 Those figures are OpenAI's, produced on OpenAI's evaluations with an unreleased model, and should be read as vendor claims. Even discounted, the commercial structure deserves attention on its own terms.

The companion study is more concrete. In one controlled October 2026 run, OpenAI reports, its pipeline moved from 2,308 candidate kernel findings to 1,724 reproduced vulnerabilities to 948 distinct working local-privilege-escalation exploits — programs turning an ordinary local account into root — for about $1.21 million in compute, roughly $1,280 each. Four months earlier the programme produced 24.4 The limits matter: local escalation requiring an existing account, not remote break-in; a controlled, unreplicated result; and, at writing, only 304 critical findings disclosed with patches and no complete account for all 948 — leaving distribution through Linux vendors, where the real delay lives, still ahead.

OpenAI is not alone. Anthropic offers free recurring open-source scanning whose reports, it states, are entirely model-generated with no human review before reaching maintainers; Google markets its CodeMender patching agent to enterprises and reserves its specialised cyber model for governments and trusted partners.78 Each firm thus sells both sides of the market: models that increase the supply of findings, and paid tiers that help customers cope with findings. That alleges no manufacture of vulnerabilities. It observes an incentive: when discovery is a product, volume is a feature — and its cost can be sold back to everyone except the maintainers expected to absorb it free.

Open Source Bears the Operational Burden

Daniel Stenberg maintains curl, a library embedded in cars, phones, televisions and operating systems worldwide. His October 2026 account should retire the comforting story that the maintainer problem is merely fraudulent “AI slop.” The fake reports, he writes, have largely disappeared since spring 2026. What arrives now typically identifies real, sometimes serious vulnerabilities. It also arrives at industrial length — hundreds of lines, repetitive, confident — with weak judgement about severity and about the difference between a bug and a vulnerability, even when the attached reproducer is good. His conclusion is directed at recipients, not reporters: do not simply ignore AI-assisted reports.12

“Do not ignore” is expensive advice to follow. Each credible report demands reproduction, root-cause analysis, an exploitability judgement, a patch that must not break a library the world depends on, regression testing and coordinated disclosure — under reputational and, for paying support customers, contractual expectations, while the licence itself, as Stenberg notes, typically guarantees nothing.12 A perfect report still costs hours. A thousand of them cost a working life. Better report quality reduces waste; it does not repeal arithmetic.

The fragility predates AI: the 2024 xz Utils backdoor (CVE-2024-3094) exploited years of pressure on an overextended maintainer.20 AI needs no malice to stress the same joint — only volume. Investment is growing (an OpenSSF coalition committed $12.5 million in March 2026 expressly over the influx of automated findings13) but remains trivial against the value extracted and the workload now generated.

Repository Platforms and Commercial Security Services

Where code lives shapes who can charge for securing it, and the four major forges are not interchangeable. GitHub, owned by Microsoft, is proprietary software as a service. GitLab is a public company built on an open-core model, its Community Edition under the MIT licence and its advanced features proprietary. Gitea, stewarded commercially by Gitea Ltd, is MIT-licensed and primarily self-hosted. Forgejo, Gitea's community fork, moved to the GNU General Public License (GPL-3.0-or-later) and is governed by the non-profit Codeberg e.V.; it sells nothing.11 Only the first two sell AI security products in any meaningful sense, and any account implying that a Forgejo maintainer can simply buy the equivalent of GitHub's offering is false.

GitHub's documentation draws the line precisely. On public repositories, scanning and dependency alerts are free, and single-suggestion Copilot Autofix costs no AI credits — but privately it requires a paid Code Security licence. The newer agentic autofix consumes metered credits and minutes, validates only by re-running GitHub's own queries, and “must always be reviewed and tested” by a human.5 Advanced security runs $19 per active committer monthly for secret protection plus $30 for code security, before metered usage;9 GitLab reserves its full suite and Duo resolver for paid tiers likewise.10 Charging enterprises for defence is legitimate business. The inequity is positional: the platform monetises alert and remedy for those who can pay, while the unaffiliated maintainer receives the alert as obligation and the remedy as unpaid work. The tax is not that security costs money. It is that the bill defaults to the party least able to refuse it.

Who Bears Responsibility in Law?

American law regulates the researcher far more clearly than it allocates research's costs. The Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(2), criminalises intentionally accessing a computer without authorisation or exceeding authorised access to obtain information; § 1030(a)(4) adds knowing access with intent to defraud. Van Buren v. United States, 593 U.S. 374, 396 (2021), confined “exceeds authorised access” to obtaining information from areas off-limits to that user — a gates-up-or-down test, not misuse of lawfully accessed information — reserving (at 396 n.8) whether gates may be contractual as well as technical. hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022), extended that logic to public ungated data, preliminarily and regionally. Neither case licenses probing third parties without permission: owner authorisation remains decisive, at AI scale as at human scale.14

Two protections are real but narrow. Justice Manual § 9-48.000 directs prosecutors to decline where evidence shows good-faith research — sole security purpose, harm-avoiding method, security-promoting use — and treats terms-of-service violations alone as insufficient. It is internal guidance: no enforceable right, no statutory defence, no constraint on civil plaintiffs under § 1030(g) or on states.6 Similarly, 17 U.S.C. § 1201(j) shelters good-faith testing from the DMCA's anti-circumvention ban only if the work complies with other law, CFAA included, and the current exemption, 37 C.F.R. § 201.40(b)(18) (89 Fed. Reg. 85446 (2024)), says expressly that qualifying research may still incur CFAA liability.15 Good intentions rescue no agent run beyond its authorised scope.

On who must pay for maintenance, federal law is essentially silent. No statute imposes a general duty on AI vendors to fund remediation, or on maintainers to patch at all. Licences entrench the maintainer's side contractually — MIT/BSD terms, Apache License § 7 and GPLv3 §§ 15–16 disclaim warranties “AS IS” between the parties, without extinguishing third-party or statutory claims — while CISA Secure by Design and NIST SP 800-218 bind only through procurement, and FTC Act § 5 “reasonableness” (FTC v. Wyndham, 799 F.3d 236 (3d Cir. 2015)) proceeds case by case. Europe's Cyber Resilience Act, Regulation (EU) 2024/2847, phases in manufacturer duties across 2026–2027 with a lighter “open-source software steward” category.1416 Doctrine polices authorised testing; it does not price the externality. Vendor-liability proposals since the 2023 National Cybersecurity Strategy remain proposals. The duty argued for here must be built — by contract, procurement and funding — because law does not yet supply it.

National Security and the Military Dimension

Capability is also concentrating where commercial AI meets state power. OpenAI announced on February 28, 2026 that it would deploy models on classified Department of War networks under three stated red lines — no mass domestic surveillance, no directing autonomous weapons, no high-stakes automated decisions — adding on March 2, 2026 that the tools “shall not be intentionally used for domestic surveillance” of U.S. persons, including via commercially acquired data, and that intelligence agencies would not use them.17 That is OpenAI's characterisation of a non-public contract; the full text cannot be inspected, and the qualifier “intentionally” has drawn attributed criticism. The documented trajectory — removal of the explicit “military and warfare” ban in January 2024, a $200 million defence prototype award in June 2025 — is that frontier cyber capability is now procured capability governed by contract language the public cannot read.

Where reporting is gravest, precision matters most. The Associated Press (February 18, 2025) found Israeli military use of U.S. firms' models via Microsoft Azure grew sharply during the Gaza war, applied in target-related work; OpenAI denied any direct relationship with the Israeli military, and none is alleged here.18 The documented path runs through a cloud intermediary. Accountability needs no collusion to be wanting: commercial capabilities, vendor-gated and state-deployed under unpublished terms, outrun public oversight on their own. (Tad Friend's 2016 New Yorker profile records Sam Altman's personal survival stockpile, including Israeli Defense Force gas masks.19 A decade-old private purchase evidences a shopping list, not institutional collaboration, and is given no weight here beyond that correction.)

Who Should Pay?

The remedies follow the diagnosis. Discovery has been industrialised; its beneficiaries should fund the human work it generates. Fund maintainers as infrastructure, scaled to dependence, through vehicles that exist — OpenSSF Alpha-Omega, Germany's Sovereign Tech Fund — as the March 2026 coalition began to do.13 Pay for triage: whoever's system files the report funds its validation, by bounty pools covering maintainer time or human review before delivery — a standard unreviewed scanner mail-outs do not meet.7 Gate volume on quality: reproducer, severity rationale, AI-use disclosure and deduplication as prerequisites for automated submission, not courtesies. Keep baseline defence accessible to dependency-critical projects as infrastructure, not upsell.5 Use procurement: require ISO/IEC 29147-consistent coordinated disclosure, an RFC 9116 security contact, and demonstrable upstream funding as conditions of public contracts. None of this punishes discovery. It prices discovery honestly.

Security as a Public Dependency

Modern software is a public dependency maintained substantially as a private gift. AI has given that arrangement a machine that enumerates the gift's defects by the thousand at $1,280 apiece, a market selling the overwhelmed a metered remedy, and a legal order precise about where researchers may tread and silent about who maintains what they tread on. Maintainers keep answering anyway, because the alternative is infrastructure broken in public.12

Someone will pay the new security tax. At present it is collected in maintainer nights, in burnout, in patches delayed while a volunteer reproduces the nine-hundredth report, and ultimately in the breaches that arrive through the flaws nobody had time to fix. The companies best positioned to pay — those selling the discovery, the defence and the classified deployment — instead collect on all three. Reversing that flow does not require treating vulnerability research as harm or vendors as villains. It requires only that the beneficiaries of a secured commons fund its security in proportion to their benefit. The infrastructure is already shared. It is time the bill was, too.

Sources

  1. Google Threat Intelligence Group, “Vulnerability Discovery and Exploitation Trends in the AI Era,” September 30, 2026.
  2. CVE Program published-record counts (approximately 28,961 in 2023; 40,077 in 2024; 48,244 in 2025), compiled from CVE Program data.
  3. OpenAI, “Introducing GPT-6 Cyber,” November 5, 2026 (vendor-reported benchmarks; access restricted to Daybreak Red).
  4. OpenAI, “A Thousand Fewer Paths to Root,” November 4, 2026 (vendor-reported; controlled environment; see CSO Online coverage for remediation caveats).
  5. GitHub Docs, “About Autofix for Code Scanning,” accessed November 9, 2026.
  6. U.S. Department of Justice, Justice Manual § 9-48.000, Computer Fraud and Abuse Act charging policy (incorporating the May 19, 2022 policy), accessed November 9, 2026.
  7. Anthropic, Cyber Mission and OSS Scanner announcement, October 8, 2026; Anthropic OSS Scanner documentation (reports fully model-generated, no human review before delivery), accessed November 9, 2026.
  8. Google Cloud, CodeMender, accessed November 9, 2026.
  9. GitHub Docs, “About GitHub Advanced Security,” accessed November 9, 2026; GitHub Docs, GitHub Advanced Security billing ($19 Secret Protection / $30 Code Security per active committer per month), accessed November 9, 2026.
  10. GitLab Pricing (Free / Premium / Ultimate tiers and Duo), accessed November 9, 2026.
  11. Gitea Documentation, accessed November 9, 2026; Forgejo (GPL-3.0-or-later; Codeberg e.V.), accessed November 9, 2026.
  12. Daniel Stenberg, “ignore the slop,” October 22, 2026; see also Stenberg, April 22, 2026 (high-volume, high-quality reports).
  13. Linux Foundation / OpenSSF, “$12.5 Million in Grant Funding … to Advance Open Source Security,” March 17, 2026.
  14. Computer Fraud and Abuse Act, 18 U.S.C. § 1030; Van Buren v. United States, 593 U.S. 374 (2021); hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022); Federal Trade Commission Act § 5, 15 U.S.C. § 45; FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015).
  15. Digital Millennium Copyright Act § 1201, 17 U.S.C. § 1201; 37 C.F.R. § 201.40(b)(18), 89 Fed. Reg. 85446 (Oct. 28, 2024).
  16. Cyber Resilience Act, Regulation (EU) 2024/2847.
  17. OpenAI, “Our Agreement with the Department of War,” February 28, 2026, updated March 2, 2026 (company characterisation of a non-public contract).
  18. Sam Mednick, Garance Burke and Michael Biesecker (Associated Press), investigation into Israeli military use of U.S. AI via Azure, February 18, 2025.
  19. Tad Friend, “Sam Altman's Manifest Destiny,” The New Yorker, October 3, 2016 (issue of October 10, 2016).
  20. National Vulnerability Database, CVE-2024-3094 (xz Utils backdoor).

This editorial was written with the assistance of SuperIntelligence.

Latest posts

View more posts