LLM-powered scanners are hitting OSS projects like Metabase at 10x historical volume, forcing immediate reactive patching as a new baseline.
Key Takeaways
Metabase went from ~10 security submissions/month to ~10/week starting January 2026, with higher legitimacy and markdown-formatted, LLM-style reports.
The emerging business model: wrap Claude/Codex in scanning tooling, bulk-scan commercial OSS repos, and pitch the SaaS to targets in the same email as the finding.
Any disclosed vulnerability must now be treated as already public – parallel LLM scans by other actors make coordinated disclosure windows nearly meaningless.
Cal.com going closed source is cited as a direct consequence; the OSS transparency advantage in security is eroding as agents commoditize deep code review.
OSS users should pin dependencies, practice defense-in-depth, enforce least privilege, and budget for far more frequent upgrades this year.
Hacker News Comment Review
Commenters pushed back that closed-source binaries face symmetric risk: LLMs can now reason over reverse-engineered code, so obscurity is not a stable defense.
The Turso counterpoint surfaced prominently: some maintainers are retiring bug bounty programs entirely due to AI-slop report floods, the opposite problem from Metabase’s experience.
Debate emerged over whether the new scanner SaaS model – charging $3k/month vs. collecting a $10k bounty – actually aligns incentives toward quality or just volume.
Notable Comments
@ryanackley: flags the Turso post (retiring bounties over useless AI reports) as essential context that complicates the article’s broadly positive framing.
@mtlynch: notes Metabase appears to neither pay bounties nor run these tools internally, which limits researcher incentive to do quality work rather than bulk spam.
