A major open-source encryption tool is getting buried in AI requests

Driving the news: OpenSSL received an average of 71 security reports and inquiries per month between May and July, up from just nine during the same period last year, OpenSSL Foundation executive director Matt Caswell said during the project's annual conference in Prague last week.

• That figure climbed to 108 inquiries in August, Caswell said.
• OpenSSL has received roughly 500 vulnerability reports over the past year. Just 63 resulted in disclosed vulnerabilities.

Threat level: The stakes are particularly high for OpenSSL, whose software helps secure communications across the internet.

• In 2014, the Heartbleed vulnerability in OpenSSL allowed attackers to extract sensitive information from vulnerable servers, potentially including passwords and encryption keys.

• The incident demonstrated how a flaw in a single widely used open-source library can put countless websites and services at risk.

Yes, but: Many of the reports are duplicates, minor software bugs or issues that don't warrant a security advisory, but each still requires human review, Caswell said.

• Most of the vulnerabilities uncovered by AI tools have been low-severity issues, rather than major security flaws.

The big picture: AI is making it easier to identify and fix vulnerabilities in widely used, volunteer-maintained open-source software, but the flood of discoveries is also exposing a shortage of experienced engineers who can determine which flaws pose real security threats.

• Maintainers for other popular encryption libraries, including Bouncy Castle and cryptlib, said at the conference that they're also dealing with an increased number of reports they need to review.
• Even OpenSSL, which has more financial resources than many other open-source projects, is struggling to keep pace with the influx of reports.

Between the lines: Even when AI tools propose a fix, humans are still needed to determine whether it works and approve changes to the code, creating a bottleneck.

• OpenSSL has roughly doubled its new contributors in the past year, but training engineers to become experienced reviewers takes much longer, Caswell said.
• The number of engineers authorized to approve code changes has grown from 18 in July 2024 to 30 as of this month, with most of that growth coming from engineering positions that OpenSSL has found funding to support.
• OpenSSL is reviewing and merging more code than ever before, but new submissions are arriving even faster, Caswell added.

What they're saying: "Those people are skilled individuals, and you can't create them overnight," Caswell told Axios about finding new engineers to review requests. "They don't grow on trees."

Zoom in: Caswell told Axios that AI tools are finding problems buried in obscure corners of OpenSSL's code that human researchers have historically overlooked.

• But it can take six to eight weeks to investigate a vulnerability, develop a patch and publish a security advisory, he added.

The intrigue: OpenSSL is deploying AI tools of its own to help review new code, investigate reported vulnerabilities and write software tests, Tomáš Mráz, chief technology officer at the OpenSSL Foundation, told Axios.

• Caswell said during a panel presentation that he now runs an AI code reviewer alongside his own manual reviews to catch problems he might otherwise miss.
• However, OpenSSL's maintainers still require human approval before accepting code changes.

What to watch: OpenSSL is urging more developers to help review code, rather than simply submit new contributions.

• Caswell said the project needs to train more experienced reviewers and secure additional funding to keep pace with the growing workload.
• "Critical open source is infrastructure, and we should be funding it as infrastructure," Caswell said during his presentation.

Go deeper: AI agents spam the volunteers securing open-source software