Introduction

Artificial intelligence is transforming software security by discovering vulnerabilities at scale, but the human verification bottleneck means the cost of catching real flaws is shifting downstream. As AI-powered scanning becomes ubiquitous, the gap between discovery and validation grows wider, affecting how open-source projects and companies handle security intake.

What Happened

In October, the maintainer of curl announced that low and medium severity vulnerability reports would no longer go directly to the security team but instead enter a public GitHub issue queue, citing an avalanche of submissions where over 90% could be quickly dismissed as low risk. Around the same time, Anthropic released a free open-source vulnerability scanner that flagged nearly 29,000 candidates, only to admit it could manually review just 6,000. Google also paused new product vulnerability reports to its open-source reward program, pointing to a rise in automated submissions. Each decision reflects the same pressure: AI is producing more findings than human teams can process.

Why This Matters

The verification gap creates a ripple effect across the software supply chain. When maintainers offload unvalidated reports to public queues, the burden shifts to the community. When scanners admit they expect a true-positive rate above 90% without human review, trust becomes the real currency. A Harvard study of 718 firms found that while AI coding assistants increased output metrics: 30% more lines of code, 20% more commits, and 23% more pull requests, they did not increase delivered work. Code review times lengthened by nearly 50% as senior engineers absorbed the extra load, and the share of pull requests with requested changes doubled. The economic reality of AI-assisted development is shifting labor, not eliminating it.

Key Takeaways

  • AI tools are discovering vulnerabilities faster than humans can verify them.
  • Policy changes in major projects like curl are redirecting unverified reports to public spaces.
  • Anthropic and Google have adjusted their intake processes under the weight of automated submissions.
  • Productivity gains from AI coding assistants have not translated into faster delivery, as review bottlenecks multiply.
  • The economic reality of AI-assisted development is shifting labor, not eliminating it.

Conclusion

If you run systems that consume AI output, the critical question is no longer what the tools can generate, but who verifies the output, whether they agreed to, and what happens when they stop. The generation side of the stack is fast and instrumented, but the checking side remains human, slow, and increasingly overloaded. Until verification becomes a funded priority, the cost will keep moving from one desk to the next.