AI Clearinghouses for OSS Risk

IBM and Red Hat’s Lightwell Clearinghouse (now generally available) used AI to discover and help remediate more than 400 previously unknown vulnerabilities in widely used Java libraries, and offers enterprises a path to submit open‑source dependencies for prioritized review and patching. The announcement frames the service as a practical industry response to the risk that autonomous AI agents could chain multiple low‑severity bugs into serious attacks. — If vendors and large customers adopt AI‑driven clearinghouses, software‑supply‑chain governance and liability will shift — creating new commercial services, regulatory questions, and attack/defense dynamics for critical infrastructure.