When vendor-supplied support matters: How AI is changing the open source security equation

Open source runs the internet, and everyone already knew that. What's new is who's finding the cracks in it. Ryan Morgan, who heads Spring R&D at Broadcom, describes the change bluntly: security vulnerabilities used to trickle in, one library at a time, at a pace teams could absorb. Frontier AI models turned that trickle into what he calls a tidal wave, and now the question enterprises ask isn't just whether a dependency is safe today, but whether whoever maintains it can actually keep up.

The numbers inside Broadcom's own Spring portfolio make the point. Michael Minella, director of Open Source Spring R&D, says the team historically fielded around seven security reports a month. That held steady until frontier models entered the workflow. March brought 55 community-reported issues. April brought 112. And that same month, once Broadcom got its hands on frontier models for internal scanning, those scans alone turned up 370 more. Suddenly triage isn't a monthly chore, it's a constant.

But finding flaws was never really the hard part, at least not anymore. Both Morgan and Minella say today's AI is genuinely good at spotting vulnerabilities and even spinning up proof-of-concept exploits. Writing a fix that won't quietly break something downstream is a different problem entirely, and AI still isn't reliable there. Morgan says every patch in Broadcom's most recent batch of Spring CVE fixes was handwritten by engineers. AI helped flag and validate the issues, but humans wrote the actual code, because a framework used in millions of applications can't afford a fix that trades one bug for a regression.

This is where being the actual maintainer starts to matter more than it used to. Security researchers report vulnerabilities directly to the Spring team first, Minella says, which means Broadcom builds and tests a patch privately before anyone outside the project even knows there's a problem. Third parties don't get that runway; their clock only starts once the fix is already public. In a world where some vulnerabilities get exploited within hours of disclosure, that early window isn't a nice-to-have.

The pressure is also reshaping how fixes actually ship. Coordinating updates across Spring's more than 60 interconnected projects used to take about two weeks. Minella says that timeline no longer makes sense when exploitation can happen in under a day, so the team is rebuilding its release process to push updates across the whole portfolio in a single day instead. On the customer side, Morgan says the old habit of picking through patches one by one is fading too — organizations are increasingly just updating everything at once rather than trying to evaluate each fix in isolation.

Neither Morgan nor Minella thinks AI is going to break open source. If anything, they see the current flood of discoveries pushing the ecosystem toward earlier, tighter security scanning and closer collaboration between projects. But the expectation on commercial providers is rising fast: Morgan says customers increasingly expect vendors of commercial open source to be running their own proactive scanning, not just waiting for the community to find problems for them.