Welcome to the Strip Mining Era of OSS Security

Open source maintainers are experiencing a dramatic surge in security vulnerability reports—averaging 10 per week compared to 10 per month previously—driven by LLM-powered automated code scanning tools that are becoming increasingly sophisticated at identifying legitimate flaws. This "strip mining" of publicly available source code is expected to intensify throughout 2026 as coding agents improve, uncovering progressively deeper layers of vulnerabilities, while researchers have created a thriving ecosystem of SaaS offerings around bulk vulnerability scanning with mixed ethical implications.