26 OCTOBER 2026 · RESEARCH

We spend a fixed share of our compute every month finding real security flaws in open source

AI coding agents are getting very good at reading code. The same capability that lets a founder ship in a week lets an attacker read a library for flaws in an afternoon. We would rather point it at defence.

So we have made a standing commitment: every month, a fixed, ring-fenced token budget goes to security research on the open-source software that AI systems are built on. Agent SDKs, protocol libraries, frameworks, the quiet dependencies maintained by a handful of people.

Not bug bounty

We do not hunt for bounties, and we do not sell findings. When we find something real, it goes privately to the people who can fix it, through their own security channel, with a working reproduction and the exact released code it affects. We give maintainers time to fix it (normally 90 days) before anything is published, and we credit their fixes when they land.

Bounty programmes have their place. But they pull attention towards whatever pays, on whichever platforms pay it. The code most of the world depends on is often maintained by volunteers with no programme at all. That is where we want the effort to go.

How we do it

AI agents do the searching, under human direction. Nothing leaves the lab without:

a reproduction that we have run ourselves and that fails on the affected release,
citations to the exact released code, not a guess about it,
an honest severity rating, and a person who has reviewed it.

Low-severity issues stay in our notes. We only raise what matters.

We also keep one firm boundary: we never hunt in the coding agents we benchmark on AgenticBench. Independence is the point of the bench, and it would not survive us looking for paid-for findings in the tools we score.

So far

On our first day of this programme, 24 October 2026, we reported six issues privately to open-source maintainers, two of them rated High. All are under coordinated disclosure, so we are not naming them yet. Each one will be published with its fix, and we will keep a public record as they land.

Why we are saying this publicly

Because commitments that are written down get kept. Every month, the budget gets spent on this work, whether or not a finding comes out of it. If you maintain an open-source project that AI agents depend on and would like a second pair of eyes, get in touch: research@agenticthinking.uk.

Collaborate with us →