The AI-focused executive order signed by President Donald Trump last month gave the Treasury Department, the National Security Agency, and the Cybersecurity and Infrastructure Security Agency (CISA) 30 days to establish a new “AI cybersecurity clearinghouse.” The deadline passed last week, and the clearinghouse is meant to coordinate the scanning, discovery, and validation of software vulnerabilities in critical infrastructure, and then prioritize how those vulnerabilities get patched and distributed.
The Challenge of Vulnerability Patching
While AI-assisted vulnerability discovery is advancing rapidly, the hard part is no longer just finding bugs. The real bottleneck is everything that comes after discovery, including deciding which findings are real, assessing severity in context, writing and testing a fix, and getting a patch accepted and deployed by the people responsible for maintaining the affected code.
Experienced human reviewers frequently disagree with AI-assigned severity ratings, because a model cannot see a project’s threat model or operational context. Software providers, especially the many volunteer open-source maintainers that so much of today’s digital infrastructure rely upon, face a relentless queue: verify the claim, assess the importance, write the patch, coordinate disclosure.
Lessons from Patch the Planet Initiative
HackerOne, as a launch partner in OpenAI‘s initiative to use AI to find and fix vulnerabilities in critical open-source software at internet scale, has seen firsthand the challenges of vulnerability patching. The lesson underpinning that work is consistent: AI tools can surface vulnerabilities faster than anyone can act on them.
Better bug-finding tools mean you find more bugs, but the improvements that really matter are the ones that help defenders push patches out and get them deployed faster. That lesson should sit at the center of how the clearinghouse is designed.
Laying a Foundation for Success
The administration can get this right, but it requires building the correct infrastructure now, not layering it on later. The clearinghouse needs to do more than coordinate scanning; it needs to actually triage the results. Its core job should be filtering reports to identify which findings are truly credible, exploitable, and consequential for critical infrastructure.
Using shared validation standards and risk-based prioritization, it can determine what warrants a national response. Otherwise, it’s just automating bigger backlogs.
Guidelines for Open-Source Maintainers
The clearinghouse should work with the National Institute of Standards and Technology (NIST) to develop guidelines for open-source maintainers on structuring repositories and workflows to speed up patch review and deployment. These guidelines should include how to use AI-assisted patching and clarify what downstream consumers of open-source code should do to help maintainers address vulnerabilities.
Federal policy should create incentives for downstream users to share responsibility for remediation through funding, engineering support, AI-assisted patch development, and procurement requirements that reward participation in coordinated vulnerability response.
Measuring Success
The clearinghouse should measure success based on what is fixed, not based on what is discovered. Agencies need to publish data on validation rates, time-to-patch, adoption of fixes, and recurring classes of vulnerabilities. These metrics help AI systems, software vendors, and policymakers to continuously improve how vulnerabilities are addressed.
Most importantly, the agencies standing up this clearinghouse should resist the temptation to build its operational model from scratch. The private sector and the open-source security community have years of experience running exactly the kind of vulnerability intake, triage, and coordinated disclosure workflows the clearinghouse needs.
The executive order wisely calls for voluntary collaboration with industry. That collaboration should be structural, not advisory, embedded in how the clearinghouse operates from the start, not bolted on after the architecture is already set.
The clearinghouse can work, but the challenge is no longer finding vulnerabilities; it is building a system that can turn discoveries into action. That is how its success should be measured.
Source: CyberScoop