For decades, the security community has operated under a consistent assumption: open source software benefits from superior security review through community scrutiny. Linus's Law, the principle that "given enough eyeballs, all bugs are shallow," became foundational to arguments favoring open source in security-critical contexts.

The widespread availability of AI-assisted code analysis tools has altered this calculus in ways the industry has not fully acknowledged.

The Traditional Model

The historical argument for open source security centered on transparency and community review. Open source projects benefit from:

  • Public code review by independent security researchers
  • Community-driven vulnerability discovery
  • Distributed expertise examining the codebase
  • Rapid community response to disclosed vulnerabilities

Closed source software, by contrast, relied on:

  • Internal security teams with limited bandwidth
  • Vendor-controlled disclosure timelines
  • Security through obscurity (widely criticized as insufficient)
  • Slower patch cycles due to organizational overhead

This model made intuitive sense when code review was primarily a manual, human-driven process. More reviewers meant better coverage.

The AI-Assisted Discovery Environment

Modern AI-powered static analysis tools have changed the discovery landscape. Research on GPT-4 demonstrated an 87% success rate in generating functional exploits when provided with CVE descriptions (IBM Research, 2024). By September 2025, LLM vulnerability detection accuracy had improved from approximately 50% to 75-80% for known vulnerabilities across GPT-4.1, GPT-5, and Claude Opus 4.1.

The critical change: vulnerability discovery is no longer meaningfully constrained by reviewer bandwidth. A single operator with AI tooling can analyze code at a scale that would have required hundreds of manual reviewers a decade ago. AI-powered smart contract scanners now achieve over 90% accuracy on source code analysis, demonstrating the maturity of these tools in production environments.

The Asymmetry Reversal

The most striking evidence of this shift appears in time-to-exploit statistics. The median time-to-exploit dropped from 63 days in 2018 to just 5 days in 2023 (Mandiant M-Trends reports, Google Threat Intelligence Group). By 2024-2025, this metric had turned negative, with exploitation occurring on average 1 to 7 days before patches were available. Currently, 28.96% of vulnerabilities are exploited on or before disclosure date, representing zero-day scenarios, while 56% are weaponized within the first month (VulnCheck, Flashpoint, Rapid7).

Open source code hosted on public repositories presents a particular challenge in this environment:

Attacker advantage:

  • Immediate access to source code with zero reconnaissance cost
  • Automated scanning can run continuously against public repositories
  • Vulnerability discovery happens in parallel with defensive scanning
  • Time-to-exploit can be measured in hours after code publication

Defender challenge:

  • Maintainers often operate with limited resources
  • Patch development and deployment takes time
  • No control over downstream adoption of patches
  • Public disclosure creates immediate exploitation risk

Closed source software, particularly from vendors with dedicated security teams, operates under different constraints:

Defender advantage:

  • Internal security teams can scan code before public release
  • AI-assisted analysis runs in a controlled environment
  • Patches can be developed and tested before vulnerability disclosure
  • Reverse engineering imposes significant cost on attackers

Attacker constraint:

  • Binary reverse engineering remains substantially more difficult than source code analysis
  • AI-assisted decompilation is less effective than source code scanning
  • Time investment required before vulnerability discovery can begin
  • Attack cost increases by orders of magnitude

The Reverse Engineering Barrier

The common rebuttal that "reverse engineering is possible" conflates theoretical capability with operational reality. Decompilers achieve approximately 55% semantic accuracy even on well-studied codebases, with roughly 80% similarity under optimization (ACM research on decompiler evaluation, 2024). Binary analysis consistently produces higher false positive rates than source analysis, and decompilers generate "plausible" code rather than ground-truth, requiring extensive manual verification (Binarly type inference analysis).

The cost differential matters:

Source code analysis:

  • Clone repository
  • Run automated scanners
  • Review results
  • Develop exploit

Total time: hours to days

Binary analysis:

  • Acquire binary
  • Set up reverse engineering environment
  • Decompile and analyze (often incomplete)
  • Understand control flow and data structures
  • Identify vulnerability candidates
  • Validate findings
  • Develop exploit

Total time: weeks to months

Research estimates Windows codebase analysis at 35-350 person-years even with source access (Morrison et al., Springer publication). Binary analysis is described as "more complex and resource-intensive" requiring "specialized tools and expertise" across multiple industry sources (Finite State, Apriorit RE cost analysis).

This cost differential directly affects attacker target selection. Opportunistic attackers and automated exploitation campaigns will exhaust open source targets before investing in reverse engineering efforts.

Market Evidence: Bug Bounty Pricing

Bug bounty markets provide empirical evidence of the reverse engineering cost barrier. Google's Vulnerability Reward Program paid $17.1 million to 747 researchers in 2025, a 45% increase from the previous year. The top Chrome bounty reached $250,000 for a sandbox escape. Meta paid $2.3 million in 2024, while GitLab paid $1 million the same year.

Critically, closed-source targets consistently command higher payouts. Google's $250,000 ceiling for Chrome vulnerabilities contrasts with Zerodium's gray market offering of $500,000 for comparable exploits in closed-source systems. This pricing differential implicitly confirms the reverse engineering cost barrier. If binary analysis were trivial, market prices would equalize.

The Economics of Target Selection

Attackers, including sophisticated threat actors, operate under resource constraints:

  • Limited personnel and time
  • Competing operational priorities
  • Cost-benefit analysis for target selection
  • Risk of detection and attribution

Even nation-state actors must allocate resources strategically. The Stuxnet operation, while technically sophisticated, required years of development and burned multiple zero-day vulnerabilities. Such operations represent substantial investment decisions.

When presented with multiple potential targets, rational attackers optimize for:

  • Lower reconnaissance cost
  • Faster time-to-exploit
  • Higher probability of successful exploitation
  • Reduced operational risk

Open source targets with publicly available code satisfy all four criteria. Closed source targets fail on at least the first two, often substantially.

The "Many Eyes" Inversion

Linus's Law assumed that eyes examining code were primarily cooperative: security researchers and developers working to identify and fix issues. The law holds when:

  • Most reviewers have defensive intent
  • Discovery and disclosure follow coordinated processes
  • Patch adoption happens relatively quickly

The law breaks down when:

  • Adversarial reviewers have equal access to code
  • Automated tools democratize vulnerability discovery
  • Exploitation can occur faster than patch deployment

In the AI-assisted environment, "many eyes" increasingly means "many adversaries with automated scanning capabilities." The transparency that enabled community review simultaneously enables adversarial analysis at scale.

Vendor Security Teams and AI Tooling

Well-resourced closed source vendors can now achieve security review comparable to open source community review through:

  • Dedicated security teams running AI-assisted analysis
  • Integration of scanning tools into development pipelines
  • Pre-release vulnerability identification and remediation
  • Controlled disclosure and patch deployment

The key distinction: vendors get temporal advantage. Internal scanning discovers vulnerabilities before public release, allowing patches to ship before attackers have access to the code.

This assumes vendors actually:

  • Employ competent security teams
  • Run regular automated scanning
  • Prioritize vulnerability remediation
  • Deploy patches promptly

Many vendors fail these requirements. However, vendors with mature security programs now have structural advantages they lacked in the manual review era.

False Positive Challenges

Traditional vulnerability scanners generate 50-70% duplicate or false positive reports. Binary analysis produces documented higher false positive rates than source code analysis. Research from Maze vulnerability management platform indicates that 90% of findings are false positives when investigated in context.

These false positive rates affect both attack and defense operations. Attackers analyzing binaries must validate findings manually, adding time and cost. Defenders scanning source code can more efficiently triage results, but the sheer volume of findings from AI-assisted tools creates operational challenges.

The false positive problem favors defenders in closed source environments, where internal teams can validate findings before attackers gain access to the code.

Supply Chain Considerations

The analysis becomes more complex when considering software supply chains. Closed source applications often incorporate open source dependencies:

  • Operating system components
  • Cryptographic libraries
  • Networking stacks
  • Development frameworks

A vulnerability in an open source dependency affects both open and closed source software. The obscurity advantage applies only to proprietary code layers, not to shared dependencies.

Organizations must account for:

  • Transitive dependency vulnerabilities
  • Upstream patch lag
  • Dependency version management
  • Software composition analysis

The deepest risk often exists in widely-used but under-maintained open source libraries. These components sit in dependency trees across thousands of applications while receiving minimal security investment.

Resource Asymmetry

The fundamental security question is not whether code is open or closed, but rather: what resources support security review and rapid patching?

Well-resourced open source:

  • Corporate-backed projects (Chromium, Linux kernel)
  • Active security teams
  • Rapid patch cycles
  • Public scrutiny as additional layer

Under-resourced open source:

  • Solo maintainer projects
  • Volunteer security review
  • Slow or absent patch cycles
  • Public exposure without adequate defense

Well-resourced closed source:

  • Dedicated security teams
  • AI-assisted internal scanning
  • Controlled disclosure
  • Reverse engineering barrier

Under-resourced closed source:

  • No security review
  • Unpatched vulnerabilities
  • Obscurity without validation
  • Unknown security posture

The resource level matters more than the license model. However, given equivalent resources, closed source software with active security teams now has advantages it lacked in previous eras.

Practical Implications

For organizations making security-critical software choices:

Evaluate actual security posture, not license model:

  • Does the vendor/project have security resources?
  • What is their patch response time?
  • Do they run automated security scanning?
  • What is their vulnerability disclosure process?

Account for AI-assisted threat landscape:

  • Assume adversaries can scan public code continuously
  • Plan for time-to-exploit in hours for public code
  • Consider reverse engineering cost for closed source
  • Evaluate supply chain exposure

Prioritize rapid patching capability:

  • Vendor/maintainer patch development speed
  • Deployment pipeline efficiency
  • Ability to apply patches quickly
  • Monitoring for exploitation attempts

Consider threat actor sophistication:

  • Opportunistic attacks favor open source targets
  • Targeted attacks will reverse engineer if necessary
  • Nation-state actors have different cost tolerances
  • Criminal groups optimize for easy targets

Conclusion

The security advantage of open source software rested on the assumption that community review would outpace vendor internal review. AI-assisted code analysis has eliminated this advantage by making thorough security review accessible to organizations with appropriate tooling.

Simultaneously, the public availability of open source code has become a liability in an environment where adversaries can automate vulnerability discovery. The "many eyes" that once found and fixed bugs now include adversarial scanners operating continuously.

Closed source software with active security teams and regular AI-assisted scanning can now achieve security review quality comparable to open source while maintaining the reverse engineering barrier that imposes cost on attackers. This represents a meaningful shift in the security calculus.

This does not mean all closed source software is secure or all open source software is vulnerable. It means the structural advantages have shifted in ways the industry has not fully acknowledged. Organizations making security-critical decisions should update their threat models accordingly.

The ideology surrounding open source security was built on the realities of manual code review. Those realities have changed. The analysis should change with them.

References

  1. Mandiant M-Trends 2026 Report

Time-to-exploit statistics and attack lifecycle data https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026

  1. Google Threat Intelligence Group (GTIG)

Historical time-to-exploit trends https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026

  1. VulnCheck State of Exploitation 2026

Zero-day exploitation rates (28.96% exploited on or before CVE publication) https://www.vulncheck.com/blog/state-of-exploitation-2026

  1. VulnCheck Exploit Intelligence Report 2026

Comprehensive exploitation and threat actor analysis https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report

  1. Kang, D., Fang, R., Bindu, R., & Gupta, A. (2024)

"LLM Agents can Autonomously Exploit One-day Vulnerabilities" arXiv:2404.08144 - 87% success rate on CVEs with GPT-4 https://arxiv.org/abs/2404.08144

  1. Lysne, O. (2018)

"Reverse Engineering of Code" in The Huawei and Snowden Questions Springer - Windows reverse engineering effort estimation (35-350 person-years) https://link.springer.com/chapter/10.1007/978-3-319-74950-1_6

  1. Cao, Y., Zhang, R., Liang, R., & Chen, K. (2024)

"Evaluating the Effectiveness of Decompilers" ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2024) Semantic accuracy rates (55% for Hex-Rays) https://2024.issta.org/details/issta-2024-papers/40/Evaluating-the-Effectiveness-of-Decompilers

  1. Google Vulnerability Reward Program 2025

Bug bounty payout statistics ($17.1 million to 747 researchers) https://www.securityweek.com/google-paid-out-17-million-in-bug-bounty-rewards-in-2025/

  1. Binarly Research

"Benchmarking Binary Type Inference Techniques in Decompilers" Type inference challenges and false positive rates https://sure-workshop.org/accepted-papers/2025/sure25-8.pdf

  1. DecompileBench (2025)

A Comprehensive Benchmark for Evaluating Decompilers Decompiler accuracy and limitations https://arxiv.org/html/2505.11340

  1. Flashpoint: N-Day Vulnerability Trends

Time-to-exploit collapse analysis Referenced in VulnCheck and Mandiant reports

  1. Finite State and Apriorit

Reverse engineering complexity and cost analysis Industry security analysis reports on binary analysis resource requirements

  1. Maze Vulnerability Management Platform

False positive rate research (90% in context) Referenced in smart contract bug bounty statistics

  1. Meta Engineering and GitLab Security

Bug bounty program payouts ($2.3 million and $1 million respectively in 2024) Industry-reported statistics

  1. Rapid7 and HackerOne

Bug bounty ecosystem statistics Industry security platform data

  1. IBM Research (2024)

"ChatGPT 4 can exploit 87% of one-day vulnerabilities" https://www.ibm.com/think/insights/chatgpt-4-exploits-87-percent-one-day-vulnerabilities