AI is making it easier to uncover hidden flaws in software, raising a new question for companies: Who will fix them all?
In October, IBM and Red Hat announced that their Lightwell initiative, which uses AI and human engineers to find and fix security flaws in open-source software, had repaired more than 400 previously unknown vulnerabilities in widely used Java software libraries. The companies also expanded access to Lightwell Clearinghouse, which lets businesses request priority fixes for vulnerable open-source software. The effort comes as AI-powered tools uncover security weaknesses at a pace that threatens to overwhelm traditional repair processes, according to IBM researchers.
“The unknown is way worse than we thought,” Ben Breard, Senior Principal Product Manager at Red Hat, told IBM Think in an interview. He said recent advances in AI modelsrevealed how many flaws remain undiscovered in software that businesses use every day.
The trend could reshape how companies maintain their technology. An October analysis by IBM X-Force found that publicly disclosed vulnerabilities across Microsoft, Oracle, Google Chrome and Apache rose 578% in the first nine months of 2026 compared with the same period in 2025. The researchers said AI-assisted discovery could help explain the rapid increase, although they could not determine precisely how much it contributed.
Lightwell aims to address the growing workload by helping businesses validate vulnerabilities, develop repairs and distribute fixes for software already in use. According to Breard, AI-powered scanners can identify security flaws faster than companies can fix them. Developing and testing patches takes time, particularly for older software that businesses still rely on. Lightwell aims to close that gap by combining AI-assisted fixes with human engineering and allowing companies to report vulnerabilities privately before disclosing them publicly.
When a customer reports a suspected vulnerability, Red Hat removes identifying information before engineers evaluate it, Breard said. This measure helps protect the organization while allowing the team to investigate the problem.
The first challenge is determining whether the finding is valid. Automated security tools can produce incomplete or inaccurate reports, resulting in false positives, so engineers must review the evidence before attempting a repair.
“We have to do an upfront quality check to validate that these are real,” Breard said. Once engineers confirm a flaw, Lightwell helps generate a patch—a software modification that corrects the weakness. Human reviewers then check the proposed fix and consult specialists when necessary.
The team must also consider customers that depend on older software versions. Rather than requiring a major upgrade, Lightwell can adapt repairs to the version a company already uses, a process known as backporting.
Breard described a recent incident in which engineers had to repeat part of their work after researchers disclosed additional vulnerabilities while the team was preparing a package of fixes.
“New CVEs were coming out for it, [so] we had to stop the process, go back, do it again,” he said. Common Vulnerabilities and Exposures (CVEs) are standardized identifiers for publicly documented security flaws. Breard said the growing volume of reports had complicated the work of producing reliable fixes.
Before distributing repaired software, Red Hat also tests whether the changes preserve the connections that other applications rely on. The company aims to fix vulnerabilities without introducing issues that could disrupt business operations.
According to Breard, participating customers receive 14 days of advance access to fixes before Red Hat coordinates broader disclosure and collaborates with open-source maintainers to make the applicable repairs publicly available.
IBM’s security researchers have documented growing pressure on organizations to identify and address weaknesses before attackers exploit them. In its 2026 X-Force Threat Intelligence Index, IBM reported a 44% year-over-year increase in attacks that exploited public-facing applications and systems. The findings show how attackers continue to take advantage of weaknesses in software accessible through the internet.
The company’s October vulnerability analysis found that 55.2% of 223 AI-discovered vulnerabilities received high or critical severity ratings. Researchers also classified 91% as remotely accessible, meaning attackers could potentially reach the affected software over a network.
The analysis did not establish that attackers had exploited those vulnerabilities. It did, however, suggest that AI-assisted research was uncovering flaws serious enough to warrant careful attention from security teams.
Lightwell’s own findings included significant weaknesses. As of October 14, Red Hat had classified eight vulnerabilities as critical, 26 as high severity and 49 as medium severity, Breard said. Those numbers covered only findings with severity scores, not all the vulnerabilities the initiative repaired.
The effort initially focused on financial institutions, according to Breard, but the software involved reaches far beyond banking. Many industries depend on the same open-source libraries, making repairs potentially useful to a much wider range of organizations.
Breard cautioned that a vulnerability does not mean every application using the affected library faces the same risk. The consequences depend on how developers use the software and whether attackers can reach the vulnerable code.
Red Hat plans to expand Lightwell beyond its initial work in Java and Python software, with JavaScript among the next targets, Breard said. The company also intends to admit more customers to its clearinghouse as it increases capacity.
The expansion could bring the initiative into more of the software systems businesses use to build websites, process information and run everyday operations.
Yet Breard said the work had already exposed a larger problem. While remediating vulnerabilities reported by customers, Lightwell engineers discovered additional previously unknown weaknesses. The findings suggest that advances in AI could keep producing new security work even as the technology helps engineers complete repairs more efficiently.
Breard said he expected automated scanning and remediation to make software more secure over time. In the near term, however, companies face the prospect of revisiting years of older code as AI reveals weaknesses that previous security reviews missed.
“We have to now look back over 10, 15, 20 years of software and go fix it,” Breard said. “So that’s the big challenge.”
