Open source maintainers are bracing for a surge of vulnerability reports this summer. Metabase, which previously saw about ten trivial submissions per month, now receives ten reports each week, many of which are genuine findings generated by large‑language‑model scanners. The shift reflects a broader trend: LLM‑powered tools can bulk‑scan any public repo and surface flaws that were previously hidden today.

The explosion isn’t tied to a single vendor. Early speculation pointed to Claude Security, launched in February, but OpenAI’s Codex‑style models have also entered the market, amplifying the “strip mining” effect. Researchers package these models into SaaS services, scan commercial OSS repositories, and ship reports that double as advertisements for their scanning platform to potential clients across the industry today.

For maintainers, the practical upshot is immediate triage. Any flaw disclosed now is effectively public, so waiting for a weekend patch cycle is risky; fixes must be deployed instantly. While the flood of low‑effort findings will strain resources, it also forces projects to adopt frequent patching and consider moving security scans into CI pipelines, tightening overall resilience for open‑source teams.