OpenSSL Overwhelmed by AI-Generated Bug Reports as Monthly Submissions Jump from 9 to 71

OpenSSL Faces Unprecedented Surge in AI-Generated Vulnerability Reports

OpenSSL, the critical open-source security library that helps secure communications across the internet, is grappling with an overwhelming influx of AI-generated bug reports. The OpenSSL Foundation received an average of 71 security reports and vulnerability inquiries per month between May and July 2025, a dramatic increase from just 9 during the same period in 2024, executive director Matt Caswell revealed at the project's annual conference in Prague1

1

. By August, that figure had climbed to 108 inquiries1

1

. Over the past year, OpenSSL has received roughly 500 vulnerability reports, yet only 63 resulted in disclosed vulnerabilities1

1

. This AI cybersecurity barrage exposes a critical challenge: while AI tools are accelerating vulnerability detection, they're also straining the human infrastructure required to maintain critical open-source infrastructure.

The Reality Behind the Numbers: Low-Severity Issues Dominate

Most of the vulnerabilities uncovered by AI tools have been low-severity issues rather than major security flaws1

1

2

2

. Many reports are duplicates, minor software bugs, or issues that don't warrant a security advisory, but each still requires human review1

1

. This surge of low-severity vulnerability reports creates a significant bottleneck for the OpenSSL Foundation's team. Caswell explained that AI tools are finding problems buried in obscure corners of OpenSSL's code that human researchers have historically overlooked1

1

. However, investigating a vulnerability, developing a patch, and publishing a security advisory can take six to eight weeks1

1

2

2

. The stakes remain high for OpenSSL—the 2014 Heartbleed vulnerability demonstrated how a single flaw in this widely used encryption library could put countless websites and services at risk by allowing attackers to extract sensitive information including passwords and encryption keys1

1

2

2

.

Human Reviewers Become the Bottleneck in AI-Driven Cybersecurity

Even when AI tools propose a fix, human reviewers are still needed to determine whether it works and approve changes to the code, creating a significant bottleneck1

1

. OpenSSL has roughly doubled its new contributors in the past year, but training engineers to become experienced reviewers takes much longer, Caswell noted1

1

2

2

. The number of engineers authorized to approve code changes has grown from 18 in July 2024 to 30 as of October 2025, with most growth coming from engineering positions that OpenSSL has found funding to support1

1

2

2

. Despite this expansion, OpenSSL is reviewing and merging more code than ever before, but new submissions are arriving even faster1

1

. "Those people are skilled individuals, and you can't create them overnight. They don't grow on trees," Caswell told Axios1

1

2

2

.

AI Tools Overwhelming OpenSSL Aren't an Isolated Problem

The challenges facing OpenSSL, one of the better-funded open-source software projects, offer a glimpse into how AI is straining the maintainers of software that businesses rely on every day1

1

2

2

. Maintainers for other popular encryption libraries, including Bouncy Castle and cryptlib, said at the conference that they're also dealing with an increased number of reports they need to review1

1

2

2

. Even OpenSSL, which has more financial resources than many other open-source projects, is struggling to keep pace with the influx of reports1

1

. This exposes a visible shortage of experienced engineers who can determine which security flaws pose real threats and which can be deprioritized2

2

.

OpenSSL Deploys AI for Code Review While Seeking Human Talent

In response to the crisis, OpenSSL is deploying AI tools of its own to help review new code, investigate reported vulnerabilities, and write software tests, according to Tomáš Mráz, chief technology officer at the OpenSSL Foundation1

1

. Caswell said during a panel presentation that he now runs an AI code reviewer alongside his own manual reviews to catch problems he might otherwise miss1

1

. However, OpenSSL's maintainers still require human approval before accepting code changes1

1

. OpenSSL is urging more developers to help review code rather than simply submit new contributions1

1

. Caswell said the project needs to train more experienced reviewers and secure additional funding to keep pace with the growing workload1

1

. "Critical open source is infrastructure, and we should be funding it as infrastructure," Caswell emphasized during his presentation1

1

. The situation raises questions about the sustainability of open-source software that underpins internet security when AI accelerates both discovery and workload without proportional increases in qualified human oversight.