I think the industry is optimizing for the wrong thing. Generating thousands of AI-written bug reports is easy, at least with Mythos (preview 1) or GPT-5.5. Getting bugs fixed is the hard part.
A few months ago I started working on a system that finds critical security issues and opens PRs instead of just filing reports. The acceptance rate is sitting at roughly 94% so far. Most of the failures were due to project-specific kill switches or other internal mechanisms that weren’t documented, not because the vulnerability itself was misidentified.
Developers generally seem to prefer this approach. A bug report creates work. A good PR removes work. That sounds obvious, but a lot of security products still stop at the report and call it a day.
> I think the industry is optimizing for the wrong thing.
Indeed: The industry optimizes for speed, time to market, and features, and applies the ostrich model to everything that doesn't bring short-time revenue (security considerations, accessibility, vendor lock-in, interoperability, …)
This has been going on for as long as the industry exists, and now we start to have the proper tools to assess the damage and understand the brittleness of it all.
I think I'm missing something here. Apple software has no open source code, how are you suggesting fixes?
What?
https://github.com/apple
Also, check https://opensource.apple.com/projects/
I genuinely didn't know about their OSS efforts, thanks!
I wouldn't go so far as efforts, so much as legally required publication of 3rd party code they use, or open wrappers to their proprietary libraries
Or .. their operating system and kernels