/
← Voltar ao feed
low technology

Hacktron offers free AI-driven PR security review to qualifying open source projects amid faster exploitation

1 fonte(s) · 1 atualização(ões) · publicado 07/05/2026 21:00 · coletado há 2 dias

Hacktron has opened Hacktron Review for Open Source, giving qualifying open source projects its commercial pull-request security reviewer at no cost. The announcement argues that attackers use AI agents to hunt vulnerabilities at scale and to push malicious dependencies into open source. It cites CISA and VulnCheck data that median time-to-exploit has fallen from about 1.5 years to roughly -18 hours, meaning exploitation on average precedes disclosure. This is a product and business announcement with no specific incident, vulnerability or threat actor.

Detalhes técnicos

  • Installs as a GitHub App and reviews every PR opened by project maintainers.
  • Posts inline PR comments on the offending lines with reproduction context.
  • Learns from maintainer triage comments to reduce false positives over time.
  • Auto-resolves findings when a fix lands.
  • Supports project-specific rules via a .hacktron/rules.md file in the repo.
  • Hacktron says it replayed the PRs behind 0-days it found in popular open source projects to test whether the bugs would have been caught before merge.

Remediação

Maintainers who are owners or admins able to install GitHub Apps can apply at hacktron.ai/open-source. Hacktron is prioritizing actively maintained projects with meaningful downstream usage.

Linha do tempo

  1. hacktron.ai ↗ · pub. 07/05/2026 21:00 · coletado 19/10 18:03 primeiro registro

    Hacktron offers free AI-driven PR security review to qualifying open source projects amid faster exploitation

    ler a análise desta fonte

    Hacktron has opened Hacktron Review for Open Source, giving qualifying open source projects its commercial pull-request security reviewer at no cost. The announcement argues that attackers use AI agents to hunt vulnerabilities at scale and to push malicious dependencies into open source. It cites CISA and VulnCheck data that median time-to-exploit has fallen from about 1.5 years to roughly -18 hours, meaning exploitation on average precedes disclosure. This is a product and business announcement with no specific incident, vulnerability or threat actor.

    Technical Details

    • Installs as a GitHub App and reviews every PR opened by project maintainers.
    • Posts inline PR comments on the offending lines with reproduction context.
    • Learns from maintainer triage comments to reduce false positives over time.
    • Auto-resolves findings when a fix lands.
    • Supports project-specific rules via a .hacktron/rules.md file in the repo.
    • Hacktron says it replayed the PRs behind 0-days it found in popular open source projects to test whether the bugs would have been caught before merge.

    Remediation

    Maintainers who are owners or admins able to install GitHub Apps can apply at hacktron.ai/open-source. Hacktron is prioritizing actively maintained projects with meaningful downstream usage.