--- title: Open-source security in the AI exploit era: Patch... description: AI now turns a patch diff into a working exploit within hours, making delayed patching the bigger business risk. Citing J.P. Morgan's 'Patchmageddon' report,... canonical: https://daily.dev/posts/open-source-security-in-the-ai-exploit-era-patch-without-changing-a-thing-weq92qixp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Open-source security in the AI exploit era: Patch without changing a thing | daily.dev og:description: AI now turns a patch diff into a working exploit within hours, making delayed patching the bigger business risk. Citing J.P. Morgan's 'Patchmageddon' report,... og:url: https://daily.dev/posts/open-source-security-in-the-ai-exploit-era-patch-without-changing-a-thing-weq92qixp og:image: https://api.daily.dev/og/posts/wEQ92QixP.png og:image:alt: Open-source security in the AI exploit era: Patch without changing a thing og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Open-source security in the AI exploit era: Patch without changing a thing **[The New Stack](https://daily.dev/sources/newstack)** · 9 min read · 0 upvotes · 0 comments ## Summary AI now turns a patch diff into a working exploit within hours, making delayed patching the bigger business risk. Citing J.P. Morgan's 'Patchmageddon' report, the median time from disclosure to exploitation fell from about a year in 2021 to one day in 2026, projected to reach one minute by 2027. Anthropic and partners found over 10,000 new high- and critical-severity zero-days in a single month, but only 75 of 530 reported flaws had been patched by open source maintainers by May 2026. The authors recommend paying for professionally maintained open source and routing dependencies through an artifact proxy, like pointing it at Broadcom's TrueSource, so patched versions ship automatically without changing developer workflows. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How fast is the gap between vulnerability disclosure and exploitation shrinking according to recent industry reports? The median time from disclosure to first exploitation dropped from roughly a year in 2021 to about one day in 2026, and is projected to fall to one minute by 2027. Almost 80% of exploitations now land on or before the public disclosure date, according to J.P. Morgan Asset Management's 'Patchmageddon' report by Michael Cembalest. _Teams racing that shrinking patch window can track dependency and CVE news on daily.dev to stay ahead of it._ ### How many open source maintainers found high-severity vulnerabilities by Anthropic actually got patched? Only 75 of 530 high- and critical-severity findings that Anthropic reported to open source maintainers had been patched by May 2026. Anthropic and its Project Glasswing partners found over 10,000 new high- and critical-severity zero-days in just the first month of searching, overwhelming largely volunteer maintainer teams. _Developers weighing how much to trust unpaid maintainers for timely fixes can follow this story on daily.dev._ ### How concentrated is maintainership in major open source projects, and why does it matter for enterprise risk? In a Linux Foundation and Harvard study of the top 50 open source projects, 23% had a single developer responsible for more than 80% of lines added, and 94% had fewer than ten developers writing over 90% of the code. Anchore also counted more than 18 million npm packages with a single listed maintainer, raising single-point-of-failure risk for dependency fixes. _Teams auditing dependency risk can track maintainer concentration research like this on daily.dev._ ## Similar posts on daily.dev - [Did AI Just Break Software Security For Ever?](https://daily.dev/posts/did-ai-just-break-software-security-for-ever--6pxwdikky) · Foojay.io · 0 upvotes · 0 comments - [When the patch tsunami meets the maintenance window](https://daily.dev/posts/when-the-patch-tsunami-meets-the-maintenance-window-lin3vzsv3) · CSO Online · 0 upvotes · 0 comments - [Security patches need patches now that attackers have AI](https://daily.dev/posts/security-patches-need-patches-now-that-attackers-have-ai-jxjf652el) · The Register · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source) [View this post on daily.dev](https://daily.dev/posts/open-source-security-in-the-ai-exploit-era-patch-without-changing-a-thing-weq92qixp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Open-source security in the AI exploit era: Patch without changing a thing","url":"https://daily.dev/posts/open-source-security-in-the-ai-exploit-era-patch-without-changing-a-thing-weq92qixp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/open-source-security-in-the-ai-exploit-era-patch-without-changing-a-thing-weq92qixp"},"datePublished":"2026-11-01T16:03:17.535Z","dateModified":"2026-11-01T16:03:49.174Z","description":"AI now turns a patch diff into a working exploit within hours, making delayed patching the bigger business risk. Citing J.P. Morgan's 'Patchmageddon' report,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e17f01eb5b6f3b74743c0c430aafcca6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e17f01eb5b6f3b74743c0c430aafcca6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/open-source-security-in-the-ai-exploit-era-patch-without-changing-a-thing-weq92qixp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"Open-source security in the AI exploit era: Patch without changing a thing"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/open-source-security-in-the-ai-exploit-era-patch-without-changing-a-thing-weq92qixp#faq","mainEntity":[{"@type":"Question","name":"How fast is the gap between vulnerability disclosure and exploitation shrinking according to recent industry reports?","acceptedAnswer":{"@type":"Answer","text":"The median time from disclosure to first exploitation dropped from roughly a year in 2021 to about one day in 2026, and is projected to fall to one minute by 2027. Almost 80% of exploitations now land on or before the public disclosure date, according to J.P. Morgan Asset Management's 'Patchmageddon' report by Michael Cembalest. Teams racing that shrinking patch window can track dependency and CVE news on daily.dev to stay ahead of it."}},{"@type":"Question","name":"How many open source maintainers found high-severity vulnerabilities by Anthropic actually got patched?","acceptedAnswer":{"@type":"Answer","text":"Only 75 of 530 high- and critical-severity findings that Anthropic reported to open source maintainers had been patched by May 2026. Anthropic and its Project Glasswing partners found over 10,000 new high- and critical-severity zero-days in just the first month of searching, overwhelming largely volunteer maintainer teams. Developers weighing how much to trust unpaid maintainers for timely fixes can follow this story on daily.dev."}},{"@type":"Question","name":"How concentrated is maintainership in major open source projects, and why does it matter for enterprise risk?","acceptedAnswer":{"@type":"Answer","text":"In a Linux Foundation and Harvard study of the top 50 open source projects, 23% had a single developer responsible for more than 80% of lines added, and 94% had fewer than ten developers writing over 90% of the code. Anchore also counted more than 18 million npm packages with a single listed maintainer, raising single-point-of-failure risk for dependency fixes. Teams auditing dependency risk can track maintainer concentration research like this on daily.dev."}}]} ```