--- title: Robot eyeballs make open source more valuable | daily.dev description: AI-powered bug hunting doesn't mean software security is a solved problem, Matt Asay argues against Eric Raymond's optimistic take that finite code means... canonical: https://daily.dev/posts/robot-eyeballs-make-open-source-more-valuable-3zkj61rvo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Robot eyeballs make open source more valuable | daily.dev og:description: AI-powered bug hunting doesn't mean software security is a solved problem, Matt Asay argues against Eric Raymond's optimistic take that finite code means... og:url: https://daily.dev/posts/robot-eyeballs-make-open-source-more-valuable-3zkj61rvo og:image: https://api.daily.dev/og/posts/3ZkJ61rVo.png og:image:alt: Robot eyeballs make open source more valuable og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Robot eyeballs make open source more valuable **[InfoWorld](https://daily.dev/sources/infoworld)** · 7 min read · 0 upvotes · 0 comments ## Summary AI-powered bug hunting doesn't mean software security is a solved problem, Matt Asay argues against Eric Raymond's optimistic take that finite code means finite, findable bugs. Google found 26 vulnerabilities using AI-generated fuzz targets in already heavily-fuzzed projects in November 2024. Mozilla's work with Anthropic uncovered 22 Firefox vulnerabilities in March, 14 rated high severity, all fixed by publication. PHP's October 21 security release shows the real work: a 2024-identified issue needed AI research to demonstrate full impact, but people still had to coordinate fixes and accept compatibility trade-offs. Asay argues open source's value is a shared codebase where fixes reach everyone, instead of each company re-discovering and re-patching the same bugs privately. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many vulnerabilities did Mozilla find in Firefox using Anthropic's AI red team work? Mozilla's collaboration with Anthropic uncovered 22 security vulnerabilities in Firefox, with 14 rated high severity. All 22 were fixed by the time the findings were published, aided by reports that included small, reproducible test cases demonstrating each issue. _Developers tracking browser security hardening can follow these AI-assisted findings on daily.dev._ ### How many vulnerabilities did Google find using AI-generated fuzz targets? Google reported finding 26 vulnerabilities using AI-generated fuzz targets, discovered in projects that had already undergone hundreds of thousands of hours of conventional fuzzing. This showed AI tools could scrutinize already well-tested code more deeply than prior fuzzing efforts had managed. _Teams weighing AI fuzzing tools against existing test coverage can follow results like these on daily.dev._ ### Can AI-assisted reverse engineering of binaries replace the need for open source licensing? No, because a decompiler does not hand you the original project's tests, design discussions, build environment, or history, and it does not grant you an open source license. Research found some LLM-decompiled functions pass supplied tests but behave differently on other legitimate inputs, so reconstructed code may not faithfully match the original program. _Engineers weighing source access versus reverse engineering can track this debate on daily.dev._ ## Similar posts on daily.dev - [Security in the age of AI](https://daily.dev/posts/security-in-the-age-of-ai-x8h2ntqmh) · Flavio Copes · 0 upvotes · 0 comments - [Did AI Just Break Software Security For Ever?](https://daily.dev/posts/did-ai-just-break-software-security-for-ever--6pxwdikky) · Foojay.io · 0 upvotes · 0 comments - [AI gets good at finding bugs, not as good at fixing them](https://daily.dev/posts/ai-gets-good-at-finding-bugs-not-as-good-at-fixing-them-sptd5ofrp) · The Register · 0 upvotes · 0 comments - [AI Model Discovers 22 Firefox Vulnerabilities in Two Weeks](https://daily.dev/posts/ai-model-discovers-22-firefox-vulnerabilities-in-two-weeks-u6vsaoo3g) · InfoQ · 0 upvotes · 0 comments --- Tags: [#open-source](https://daily.dev/tags/open-source), [#php](https://daily.dev/tags/php), [#ai-coding](https://daily.dev/tags/ai-coding), [#vulnerability](https://daily.dev/tags/vulnerability), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/robot-eyeballs-make-open-source-more-valuable-3zkj61rvo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Robot eyeballs make open source more valuable","url":"https://daily.dev/posts/robot-eyeballs-make-open-source-more-valuable-3zkj61rvo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/robot-eyeballs-make-open-source-more-valuable-3zkj61rvo"},"datePublished":"2026-10-27T09:06:05.776Z","dateModified":"2026-10-27T10:35:06.442Z","description":"AI-powered bug hunting doesn't mean software security is a solved problem, Matt Asay argues against Eric Raymond's optimistic take that finite code means...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2ec5f1e2ae67a2f23396c9a37e15d99d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2ec5f1e2ae67a2f23396c9a37e15d99d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoWorld","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoWorld","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/bf6d68a999064029b0bb09aa6268f1f3","url":"https://daily.dev/sources/infoworld"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/robot-eyeballs-make-open-source-more-valuable-3zkj61rvo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"open-source,php,ai-coding,vulnerability,appsec","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoWorld","item":"https://daily.dev/sources/infoworld"},{"@type":"ListItem","position":3,"name":"Robot eyeballs make open source more valuable"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/robot-eyeballs-make-open-source-more-valuable-3zkj61rvo#faq","mainEntity":[{"@type":"Question","name":"How many vulnerabilities did Mozilla find in Firefox using Anthropic's AI red team work?","acceptedAnswer":{"@type":"Answer","text":"Mozilla's collaboration with Anthropic uncovered 22 security vulnerabilities in Firefox, with 14 rated high severity. All 22 were fixed by the time the findings were published, aided by reports that included small, reproducible test cases demonstrating each issue. Developers tracking browser security hardening can follow these AI-assisted findings on daily.dev."}},{"@type":"Question","name":"How many vulnerabilities did Google find using AI-generated fuzz targets?","acceptedAnswer":{"@type":"Answer","text":"Google reported finding 26 vulnerabilities using AI-generated fuzz targets, discovered in projects that had already undergone hundreds of thousands of hours of conventional fuzzing. This showed AI tools could scrutinize already well-tested code more deeply than prior fuzzing efforts had managed. Teams weighing AI fuzzing tools against existing test coverage can follow results like these on daily.dev."}},{"@type":"Question","name":"Can AI-assisted reverse engineering of binaries replace the need for open source licensing?","acceptedAnswer":{"@type":"Answer","text":"No, because a decompiler does not hand you the original project's tests, design discussions, build environment, or history, and it does not grant you an open source license. Research found some LLM-decompiled functions pass supplied tests but behave differently on other legitimate inputs, so reconstructed code may not faithfully match the original program. Engineers weighing source access versus reverse engineering can track this debate on daily.dev."}}]} ```