Ai's impact on openssl's security maintenance

AI is playing a dual role in the maintenance of OpenSSL, a widely used open-source encryption library. On one hand, it is aiding in the identification and resolution of security vulnerabilities, while on the other, it is overwhelming the team responsible for managing the software. Between May and July 2026, OpenSSL received an average of 71 security reports per month, a significant increase from nine reports during the same period in 2025. Matt Caswell, executive director of the OpenSSL Foundation, highlighted this surge during the project's annual conference in Prague. Despite the rise in reports, many are duplicates or minor issues that do not require a security advisory. Caswell emphasized the need for experienced engineers to assess the severity of reported flaws. AI tools are uncovering vulnerabilities in obscure parts of OpenSSL's code that human researchers have historically missed. The OpenSSL Foundation is also deploying its own AI tools to review code, investigate vulnerabilities, and write tests. Caswell stressed the difficulty of finding skilled engineers to review these requests, noting they cannot be created overnight. The foundation is urging more developers to assist in code reviews rather than just submitting contributions.