FreeBSD AI-assisted Vulnerability Discovery Project launch | FreeBSD Foundation

June 15, 2026

About the project

The FreeBSD Foundation has launched its AI-assisted Vulnerability Discovery Project with the key goal of reducing the number of exploitable vulnerabilities in the FreeBSD source code.

The 6-month project is being funded by a grant from the Alpha Omega project. The funds will be used to engage FreeBSD Security Team members under fixed-term contracts to find and patch vulnerabilities. The Security Team’s access to publicly available AI models and tokens will be provided free of charge. AI will be used for vulnerability discovery and analysis only, all patches will be manually created.

Why this is important now

Open source codebases have become a key target for AI-assisted vulnerability scanning and this has reduced the effective time to exploitation to 0 days. The FreeBSD Project has already received a number of credible vulnerability reports that are attributable to AI-enabled security tools.

The implications of this include:

It is possible for malicious actors to find exploitable vulnerabilities and use them before anyone else is aware of them. This increases the risk for open source users and harms trust.

Anyone with a moderate technical skillset can find and report vulnerabilities if they use an AI-assisted security tool. This can lead to a rapid increase in report numbers and a potential decrease in report quality. Dealing with this change in dynamic can be challenging for open source projects.

These risks have been recognized by many in the software industry – the Linux Foundation security initiative that this project falls under was funded by donations from Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI. The initiative has the explicit goal of improving the security of open source software.

What the project covers

The FreeBSD Foundation has received a $250k grant to secure time from key members of the FreeBSD Security team and to cover time from other staff as needed to support their work. Accessing AI models for vulnerability analysis will be free of charge for the duration of the project.

The project’s goals are to reduce the number of vulnerabilities in the FreeBSD source code and to develop practical approaches that will improve efficiency in vulnerability management.

AI will be used to find vulnerabilities that will then be manually triaged, validated and patched. As this work is carried out, there will be opportunities to improve and automate elements of the FreeBSD Security Team’s infrastructure. Some examples include: improving fuzzing capabilities for pre-merge, stable, and release branches, and for vulnerability patches, or automatically triaging vulnerability reports. This work will also be within the project’s scope.

Initially, the FreeBSD kernel will be the focus of the project, followed by the base system userland, and the ports tree. All parts of FreeBSD may be in scope and will be addressed in priority order as time allows.

The project team will also liaise with other similar projects being funded by Alpha Omega to mutually share and improve the work being done.

“We are grateful to Alpha-Omega for supporting this important work. Their investment in our AI-Assisted Vulnerability Discovery project recognizes FreeBSD’s role as a critical component of global digital infrastructure. As the volume of vulnerability reports continues to grow, this funding will help us strengthen our ability to efficiently assess, prioritize, and respond to security issues, ensuring FreeBSD remains a secure and dependable platform for the many individuals, organizations, and products that rely on it worldwide.” – Deb Goodkin. Executive Director, FreeBSD Foundation.

"The FreeBSD Security Team has been receiving an increasing number of vulnerability reports from researchers leveraging AI tooling, and that volume continues to grow. This funding augments our volunteer Security Team, giving us the capacity to find, triage, and fix vulnerabilities rather than only responding to those reported to us." – Gordon Tetlow, Security Officer, The FreeBSD Project

Project partners

The project is possible thanks to the support of many parties. In addition to the funding already mentioned, there are other important partners who will be helping to ensure a successful and impactful project.

Netflix has agreed to help test and validate changes, particularly those involving the network stack. NetApp and Verisign will also provide input on which functional areas should be focused on for vulnerability searching, collaborate on AI-assisted scanning, and help with regression testing and validation of prospective patches.

There are also some security researchers and FreeBSD vendors that have access to Claude Mythos Preview through Project Glasswing, and they have offered to use it for supplemental discovery and analysis on our behalf where practical.

A number of other open source...