Open-Source Security in the AI Era: Finding Is Easy, Fixing at Scale Is the Real Challenge

AI has made open-source vulnerability discovery fast and cheap, shifting the bottleneck to remediation. This session explains why finding more bugs does not automatically make systems safer, and what a coordinated approach to validating, backporting, and upstreaming fixes looks like in practice.

■ The Open-Source Landscape
- Why critical infrastructure depends on volunteer-maintained code
- How flaws ripple across downstream applications
■ AI-Accelerated Discovery
- The shift from weeks of research to minutes of analysis
- The gap between discovery speed and remediation capacity
■ What Fixing Actually Involves
- Version impact, dependency mapping, and business risk
- Regression testing, compatibility checks, and production deployment
- Why tailored backports often replace textbook upgrades
■ Coordinated Remediation Efforts
- Lightwell: discovery, AI-assisted analysis, validated fixes, trusted repositories, and upstream contribution
- Accretes: intake, deduplication, validation, remediation, and synchronized disclosure
■ The Takeaway
- Why safe, responsible, at-scale remediation defines the future of open-source security

Security engineers, platform teams, and open-source maintainers will come away with a clear map of the remediation pipeline and the coordination models being built to keep pace with AI-driven discovery, plus pointers to learn more in the description.