What happened
OpenSSL Foundation executive director Matt Caswell reported at the project's annual conference in Prague that the library received an average of 71 security reports per month between May and July 2026, a significant increase from nine per month during the same period in 2025. The volume peaked at 108 inquiries in August. While AI tools are identifying vulnerabilities in obscure code areas, roughly 500 reports over the past year resulted in only 63 disclosed vulnerabilities, with most AI-found issues being low-severity. Maintainers are struggling to keep pace, having grown authorized code approvers from 18 to 30, but Caswell noted that training experienced reviewers takes time and that human approval remains mandatory for all code changes.
At the OpenSSL annual conference in Prague, executive director Matt Caswell disclosed that the project received an average of 71 security reports and inquiries per month from May to July 2026. This represents a substantial increase from the nine reports received monthly during the same period in 2025. The volume reached a peak of 108 inquiries in August 2026.
Over the past year, OpenSSL received approximately 500 vulnerability reports, but only 63 resulted in disclosed vulnerabilities. Caswell noted that many of the incoming reports are duplicates, minor bugs, or issues that do not warrant a security advisory. However, each report still requires human review to determine its validity and severity.
AI tools are increasingly used to find vulnerabilities in obscure parts of the codebase that human researchers might overlook. While these tools are effective at discovery, the majority of issues they identify are low-severity. Investigating a vulnerability, developing a patch, and publishing a security advisory can take six to eight weeks, creating a significant bottleneck.
To address the workload, OpenSSL has grown the number of engineers authorized to approve code changes from 18 in July 2024 to 30 as of October 2026. Most of this growth came from funded engineering positions. Despite this, Caswell stated that the project is reviewing and merging more code than ever before, but new submissions are arriving even faster. The foundation is also deploying its own AI tools to help review code and write tests, but human approval remains a mandatory step before any changes are accepted.
Why it matters
This development highlights a critical bottleneck in internet security infrastructure. OpenSSL secures a vast portion of global web traffic, and the influx of AI-generated reports is straining the limited pool of experienced engineers required to validate these findings. If maintainers cannot efficiently triage this volume, genuine high-severity vulnerabilities may be delayed or missed, potentially exposing users to risks similar to the 2014 Heartbleed incident. The situation underscores that while AI accelerates vulnerability discovery, it does not eliminate the need for skilled human oversight, creating a resource gap that even well-funded open-source projects are struggling to fill.
OpenSSL is a foundational component of internet security, securing communications for countless websites and services. A flaw in such a widely used library can have massive consequences, as demonstrated by the 2014 Heartbleed vulnerability, which allowed attackers to extract sensitive information like passwords and encryption keys.
The current surge in AI-generated reports is exposing a shortage of experienced engineers capable of determining which flaws pose real security threats. Even though OpenSSL is one of the better-funded open-source projects, it is struggling to keep pace with the influx of reports. Maintainers of other encryption libraries, including Bouncy Castle and cryptlib, reported similar increases in workload at the same conference.
The reliance on human review for AI-generated findings creates a critical dependency on skilled labor that cannot be quickly scaled. Caswell emphasized that skilled individuals 'don't grow on trees,' highlighting the difficulty of training new engineers to become experienced reviewers in the short term. This gap between AI discovery speed and human validation capacity poses a risk to the timely patching of genuine vulnerabilities.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
Why can ethical evaluation not be reduced to one model score?
What to watch next
Monitor whether OpenSSL secures additional funding to hire more experienced reviewers and how long it takes to process the current backlog of reports. Watch for similar strain on other major encryption libraries like Bouncy Castle and cryptlib, whose maintainers reported increased workloads at the same conference. Observe if the OpenSSL Foundation implements new automated triage methods to filter low-severity AI reports before they reach human reviewers.
OpenSSL is urging more developers to help review code rather than just submit new contributions. The project needs to train more experienced reviewers and secure additional funding to manage the growing workload. Caswell has called for critical open source to be funded as infrastructure.
Watch for updates on whether OpenSSL can reduce the time it takes to investigate and patch vulnerabilities, which currently ranges from six to eight weeks. Any improvements in triage efficiency could help mitigate the risk of delayed security advisories.
Monitor the adoption of AI tools by other open-source security projects. If similar strains are observed across the ecosystem, it may lead to broader industry discussions about funding models and automated triage standards for critical infrastructure.