Performance improvements: exposing hidden security fixes in Open Source
summary
A research system scrapes changelogs across the top 5 million projects, normalizes noisy text, and runs a dual-LLM architecture to flag likely silent security fixes, cross-checks against CVE/NVD, and routes candidates to a human for verification. Results: 550 undisclosed vulnerabilities found in 2024 (61 critical), 67% never got CVEs, and the malware detector has already flagged 11,000 malicious packages; automated pipeline reduces human triage while still requiring Human-in-the-Loop checks.
AI-written summary · about
chapters (8)
- 0:00Hidden security vulnerabilities
- 1:58Hidden dependencies risks
- 4:28Undisclosed vulnerabilities danger
- 7:14Intel and LLM detection
- 9:43Vulnerabilities in major tools
- 11:51Public disclosure results
- 12:12Malware detection with LLMs
- 15:47Summary of findings
related talks
36mUsing AI to Discover Silently Patched Vulnerabilities in Open...
30mHidden Vulnerabilities in Open Source
43mThe Importance of Developer Tooling to Make Open Source More Secure by Default
46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once and For All
19mFlipping the script on application security
49mImproving FOSS Security
27mThe Cry Wolf Vulnerability Paradox
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation