Over half of AI open source projects contain vulnerabilities

New research shows 52 percent of the top 100 AI open source projects on GitHub reference known vulnerable open source software packages.

The report from Endor Labs explores emerging trends that software organizations need to consider as part of their security strategy, and risks associated with the use of existing open source software (OSS) in application development.

"The fact that there's been such a rapid expansion of new technologies related to Artificial Intelligence, and that these capabilities are being integrated into so many other applications, is truly remarkable -- but it's equally important to monitor the risks they bring with them," says Henrik Plate, lead security researcher at Endor Labs' Station9 research team. "These advances can cause considerable harm if the packages selected introduce malware and other risks to the software supply chain. This report offers an early look into this critical function, just as early adopters of matching security protocols will benefit most from these capabilities."

Among the findings are that existing large language model (LLM) technologies still can't be used to reliably assist in malware detection and risk assessment -- in fact, they accurately classify malware risk in barely five percent of all cases.

Organizations routinely underestimate risk when they don't analyze their use of APIs through open source dependencies. The report shows 45 percent of applications have no calls to security-sensitive APIs in their code base, but that number drops to five percent when dependencies are included.

Even though 71 percent of typical Java application code is from open source components, applications use only 12 percent of imported code. Vulnerabilities in unused code are rarely exploitable, so 60 percent of the time developers spend fixing open source vulnerabilities is wasted because it's focused on fixing flaws that can't even be exploited in their applications.

You can get the full report from the Endor Labs site.

Image Credit: isak55 / Shutterstock