Open source has always depended on maintainers. They are the people who review patches, prepare releases, and answer security reports long after the initial excitement of a contribution has faded. However, critical open source infrastructure is maintained by a shrinking pool of underfunded volunteers, and modern AI tooling makes it trivial to generate plausible-looking vulnerability reports at scale. True or false, every report still needs a human expert to evaluate it, overloading the same underfunded maintainers even more!

OP-TEE — the reference Trusted Execution Environment for Arm, underpinning DRM and key storage on hundreds of millions of devices — is a live example. Its maintainers recently announced they can no longer sustain the project at the capacity they used to and postponed the July release. The same week, Arm’s PSIRT (Product Security Incident Response Team) raised concerns about unanswered security reports of their bug bounty program.

This was not a surprise. Those companies that had been able to fund the maintenance had warned the community . They approached industry stakeholders about funding continued maintenance and security response well before the situation escalated. Many companies thought this was vital but nobody was willing to commit funds.

The TL;DR

The Threat: AI tools have drastically reduced the cost of generating vulnerability reports, flooding critical open-source projects and overwhelming the thinly funded human experts needed to triage them.

The Impact: Foundational infrastructure like OP-TEE—critical for secure boot and DRM across millions of devices—is already dropping release cycles due to this unsustainable burden, elevating both security and regulatory risks for downstream commercial products.

The Solution: To ensure upstream sustainability, companies must move beyond traditional bug bounties (which only fund discovery) and proactively fund maintenance, triage and remediation using existing mechanisms like Arm’s CoreCollective.

The early warning

Open source security triage has always run on a thin margin of volunteer and lightly-funded maintainer time. That margin is now being squeezed from two directions at once: fewer companies are willing to fund ongoing maintenance, while AI tooling makes it dramatically cheaper to generate vulnerability reports that still require a human expert to evaluate.

OP-TEE — sitting beneath hardware-backed key storage, DRM, Secure Boot, FirmwareTPM, biometrics, mobile payments (and more)  on a huge installed base of devices — illustrates both problems well.

Linaro’s open collaboration model was historically used to fund maintenance, triage bugs, provide security fixes and responsibly disclose vulnerabilities by dedicating substantial engineering time to it. Linaro remains committed to funding open source maintainers internally, but with the company’s shift towards professional engineering services, the time available for it is not what it used to be.

Due to our open source pedigree and deep understanding of open source we proactively approached industry stakeholders about funding continued maintenance and addressing security vulnerabilities, making it explicit that the problem would soon escalate. None of the stakeholders was willing to commit funds. In June 2026, OP-TEE’s core maintainers announced that none of them works for Linaro anymore and they have limited time for patch review, releases, or security incident response. The July scheduled release was dropped as a direct result.

Not just an OP-TEE problem

The pattern seems familiar — it’s the same one behind Heartbleed and the xz backdoor: broad commercial dependence on infrastructure nobody is paying to maintain, until something breaks in public. The difference this time is that the warning came first, in writing, and went unanswered.

The structural risk remains, though. LLM-assisted tools can now generate plausible security reports against any codebase for a fraction of the previous cost. Some findings will be genuine, valid and valuable; The majority, though, are either false positives or of overstated severity. Either way, every report still requires a human who understands the code to triage it — and that step doesn’t scale anymore. Well-resourced projects might be able to absorb the increase. The ones that depend on a handful of skilled maintainers though — and there are far more of the latter across the infrastructure stack — do not.

Bug bounty programs are useful but in the LLM era they widen this gap. They pay for discovery, not for triage, fixing, testing, backporting, or disclosure coordination — the actual work of maintainers who are becoming increasingly scarce. 

None of this is unique to OP-TEE, and that’s the point of using it as an example rather than the whole story. Apply the same test to any project that’s commercially critical but maintained by a handful of people or a single sponsoring company: reduce that funding, and it becomes structurally unable to keep pace with a rising volume of reports, patch reviews and releases. This is only going to become worse with regulatory obligations starting to take effect this year (e.g, the EU Cyber Resilience Act).

The fix has to be proactive funding, not reactive donations after a crisis becomes public — and the mechanisms already exist. CoreCollective, the Arm-led consortium, lets member companies sponsor funded initiatives within its working groups to support exactly this kind of engineering work. Extend that model to more of the maintainer-led projects the industry depends on. Do it before the next OP-TEE moment.

We can still fix it

If your product depends on open source infrastructure, act on this now:

• Companies: Fund maintenance directly and proactively — not just bug bounties, and not only after a crisis goes public – the mechanisms already exist. Arm’s CoreCollective lets member companies sponsor funded maintenance initiatives within its working groups.
• Foundations and consortia: Publish clear, funded triage processes for security reports before the next embargoed one lands, and extend funding models like CoreCollective’s Initiatives to more of the projects you steward.
• Bounty platforms: Build funding models that pay for remediation, not just discovery.

Learn how your organisation can join Arm’s CoreCollective

About the author

Ilias is a computer engineer with more than two decades of experience spanning telecom, optical, wireless and automotive. His work has consistently focused on Linux, covering embedded systems, kernels, drivers, bootloaders, software architecture, compilers, and build systems.

He is a Director at Linaro responsible for open-source firmware, security and virtualization. He currently serves as a U-Boot maintainer responsible for the EFI & TPM subsystems, the core Arm architecture and co-maintains the page pool memory allocator in the Linux kernel’s networking stack. He has contributed to the Trusted Firmware-A, and OP-TEE. His day-to-day involves patch review, releases, and security response for infrastructure that hundreds of millions of devices quietly depend on.