The Patch-Velocity Gap: AI Discovery Is Outpacing OSS Patching

Short summary

AI is rapidly accelerating vulnerability discovery (98% success rates, 271 Firefox patches in 2 weeks), but open-source maintainers can't patch at that speed. This widening patch-velocity gap — time between disclosure and ecosystem adoption — is where attackers operate. Today 1-in-4 popular npm/PyPI packages have high vulnerability-to-fix lag; AI acceleration will worsen this unless maintainer capacity grows.

• •AI vulnerability discovery is accelerating 10-100x faster than OSS patch capacity
• •The 'patch-velocity gap' (disclosure → fix → adoption) matters more than CVSS severity scores
• •74 of 304 top packages already have HIGH/CRITICAL fix-lag risk; projections suggest 42% increase as AI spreads

Generated with AI, which can make mistakes.