AI Firms Pay for Package‑Repo Security

Python's security lead reports CVEs tripled and PyPI malware rose 60% in a year, and Anthropic funded a new security developer to expand vulnerability remediation and automated quarantine on PyPI. This shows large AI companies are now directly financing day‑to‑day operational security work on critical open‑source infrastructure. — If AI firms assume the cost of open‑source security, it reshapes incentives for vulnerability disclosure, attribution, and who controls remediation priorities across the software supply chain.