Security Learnings from the Open Source Front Line

Modern AI tools have lowered the barrier to entry for people looking to code and significantly accelerated how quickly contributors can write and submit code. This lower barrier to entry has led to more contributors, more contributions, and more lines of code for maintainers to review. Today, GitHub is seeing 2.9 billion commits, 130 million merged pull requests, and 24 million new repos every month. Valkey's own data supports this exponential growth. During the project's last six-month release cycle, individual commits rose 55%, and incoming code volume increased by 500%. Faster, more frequent contributions come with a cost: project maintainers now have to review a higher volume of pull requests. 

Maintainer burnout was already a real problem before AI arrived, but now the issue is magnified. When open source maintainers are overwhelmed, critical infrastructure is vulnerable. Taking a pragmatic approach to AI and baking security into daily processes can alleviate the strain on security professionals and engineers.

Evolving Alongside Improving AI Contribution

AI contributions to open source projects have improved since the era of "slop." While some reports that maintainers receive are often duplicative or highlight a bug that's not really a bug, a fair amount of contributions are finding real instances worth a maintainer's review. 

This shift is industry-wide, and projects are adapting to this reality. In January, cURL, a popular open source internet file transfer protocol, closed down its bug bounty program because its maintainers were being buried in AI submissions. However, at a conference the next month, its lead maintainer reverted his decision, saying that while AI-generated reports drained his team, the AI-powered analysis tools his team now uses "find a lot of things no other tools previously found, and in a way no other tools previously could find."  For Valkey, the same shift has occurred: PR quality has increased, and the tools available to the project have improved. 

So what's the next evolution for AI contribution to open source projects? For projects that are still open to AI reports, maintainership must adapt as contributions have. This means that teams should explore the value of AI tools for functions like backporting, first-round code review, or even codebase testing. The overall goal for maintainers and other engineering teams alike is a broader set of options rather than a deepening crisis. 

Moving From Generative Hype to Verifiable Value

AI is very good at pattern matching. This is a deterministic skill in which models are consistently successful. Security professionals who want to use AI in their projects and within their organizations will need to play to the model's strengths. 

As part of this decision, security engineers and leads should also consider the kinds of tasks they'd like to ask of AI. Does your task have a black-and-white outcome, or is there more gray area involved? Is a given task tied to overall strategy? If a model can be leveraged for a pattern-matching task – like looking for a specific term or phrase in a legal database – then the AI will be very successful at it.

Understanding which tasks produce easily verified outputs can allow project leads to offload narrow-scope tasks to AI and free up developers to focus on higher-level, judgment-based work. Surprisingly, only 18% of organizations apply AI agents to vulnerability management. For most projects, the real security value that AI can provide is its ability to execute the tedious, structured, repetitive verification work that keeps service reliable for users. These functions, while time-consuming for a maintainer, are key for project stability and security. 

A Blueprint for Agentic Security 

Automation has helped the Valkey project in several ways, all of which could apply to security professionals who face daily toil on iterative, tedious tasks. The project has seen real security value across three key domains: adversarial testing, code provenance testing, and backporting. Each of these functions takes a modicum of stress off project leadership and might be applicable for other organizations looking to automate their security processes.

Rather than waiting for external bug reports, Valkey proactively tests its codebase. One model proposes candidate bugs, and a second argues against and verifies each one. In that loop, reports only reach a human with a reproducible crash attached. So far, that automated pipeline has found 34 real bugs across the codebase, including a TLS memory-corruption issue serious enough to warrant its own CVE. By creating an auxiliary check on the codebase and providing evidence of crashable bugs, maintainers have a second set of eyes on project security and can ensure projects stay reliable. 

There's also a maintenance agent for automated backporting. Before the AI agent, the team spent hours backporting bugs and security fixes to older branches to keep the database running reliably and securely across versions. Now the agent cherry-picks security patches across support branches, resolves conflicts, and escalates only for final human sign-off. 

Another function that keeps the project secure but doesn't involve AI is code provenance. For Valkey, this works like an IP shield: a deterministic check called provenance guard automatically flags license-incompatible code in incoming PRs without human intervention. Pull requests caught by the check are then flagged for a maintainer to review, taking a review-based burden off the maintainer.

Together, these tools take three time-consuming tasks off a human reviewer's plate and free maintainers to spend their limited hours on high-priority tasks that forward project strategy. 

Keeping Infrastructure Safe 

Ultimately, the software supply chain, on which nearly all of modern software infrastructure relies, is maintained by human beings. Whether or not a key element of an organization's technology stack is available can easily become a problem if human maintainers are overwhelmed by AI reports. 

Reproducibility, stability, and automation in security practices are the real benchmark of a secure project. AI and agents can be an important part of this practice, and they work best when the output is easy for a human to verify. For organizations that might be facing burnout in their security teams, AI can help offload much of that burden by handling work a human or test can quickly confirm is correct. Agents can catch bugs before they reach production, flag license risks before they reach a human reviewer, and carry security patches across supported branches without adding to a maintainer's workload. Sustainability and security are not separate goals. Investing in the people and systems that keep projects safe is what sustains that safety over the long term.