Growing the Eclipse Foundation Security Team to Meet the AI Moment

mikael.barbero@eclipse-foundation.org (Mikaël Barbero) — Thu, 13 Aug 2026 11:30:00 +0200

For the last several years, the Eclipse Foundation Security Team has worked alongside our project communities to keep the software they produce trustworthy. We facilitate communication between security researchers and maintainers, help evaluate and assess the severity of reported issues, support coordinated disclosure, and advise on fixes and workarounds. As a CVE Numbering Authority for over ten years, we also assign CVE IDs and curate CVE records so the broader ecosystem can rely on accurate, complete vulnerability data.

That work has always demanded careful judgment. But over the past two years, the ground has shifted under all of us.

AI has changed the vulnerability landscape — in both directions

New AI-assisted security tools are accelerating the discovery of real vulnerabilities in open source software. The Eclipse Foundation has participated in Project Glasswing since day one, an initiative that puts frontier AI models in the hands of organizations maintaining critical software so that long-hidden vulnerabilities can be found and fixed before the same capabilities become accessible to bad actors. That firsthand experience has shown us both sides of the equation: these tools surface credible, actionable findings that would be difficult to uncover manually, but every one of those findings still needs expert validation, contextual prioritization, and a maintainer with the time and support to land a fix.

At the same time, maintainers across the open source world are reporting a sharp increase in the volume of vulnerability reports they receive. Many are duplicates, false positives, or low-signal submissions bearing the hallmarks of careless AI generation. Sorting genuine issues from the noise takes real expertise and real time, and it is exactly the kind of pressure that burns out maintainers.

Both trends point in the same direction: open source ecosystems need more practical, hands-on security capacity, and they need it now.

A grant from Alpha-Omega

Earlier this year, Alpha-Omega announced new grant funding aimed at strengthening the security of the open source ecosystem by investing in projects and organizations working to improve security practices, tooling, and capacity.

We’re pleased to announce that the Eclipse Foundation has been awarded sponsorship funding from Alpha-Omega to add dedicated AI security engineering capacity to the Eclipse Foundation Security Team.

This engagement, our “AI Security Engineer in Residence” effort, is designed to provide practical, trusted, and technically capable security support to Eclipse Foundation projects while contributing to a broader cross-ecosystem initiative to improve open source security practices in response to AI-enabled threats. We’re proud to be working alongside peer organizations such as the Rust Foundation, the FreeBSD Foundation and NodeJS, which have received similar grants, as part of a shared virtual team of practitioners exchanging lessons, methods, and tooling across ecosystems.

Rather than creating a single position, we structured this capacity as two complementary roles. Today, we’re delighted to introduce the two people filling them.

What the new roles will do

Together, these two roles will help the Eclipse Foundation ecosystem:

Find and fix vulnerabilities that matter. Conduct proactive, human-led and AI-assisted security reviews of selected Eclipse Foundation projects, with findings carefully validated before they ever reach a maintainer’s inbox.
Triage smarter and faster. Develop scalable workflows that separate credible findings from noise, prioritize them by severity and exploitability, and turn reports into actionable guidance, including during surges in AI-generated report volume.
Support remediation, not just reporting. Work directly with maintainers to explain findings in context, propose fixes, submit pull requests where appropriate, and support coordinated disclosure and release planning.
Provide rapid response capacity. Offer trusted technical support when urgent, high-risk security situations arise.
Serve as a point of contact for inbound reports. Handle reports arriving through Project Glasswing and related channels, with triage and coordination support for affected projects.
Leave durable improvements behind. Develop reusable playbooks, tools, prompts, and workflows that strengthen the ecosystem well beyond the term of the engagement and that we’ll share with the broader cross-ecosystem effort.

Just as importantly, here is what these roles are not: they are not an external audit or enforcement function, nor are they a replacement for maintainer ownership. Success will be measured by trust, accuracy, and practical risk reduction, never by vulnerability counts for their own sake.

Meet Alessia

Alessia Nardotto joins the team as Security Analyst, Incident Response & Vulnerability Management. Alessia will help monitor, investigate, and respond to security issues affecting Eclipse Foundation systems, services, and projects. She will triage incoming reports, validate findings, coordinate remediation across teams, and keep our incident response playbooks sharp. She’ll be a key part of how we absorb the growing volume of vulnerability reports without losing the careful documentation and follow-through that responsible handling demands.

Meet Miruna

Miruna Sandor joins the team as Application Security Engineer, AI-Assisted Vulnerability Management. Miruna will design, build, and operate the AI-assisted vulnerability management pipelines at the heart of this effort. She will integrate large language models and traditional security tooling into discovery and triage workflows, critically evaluate AI-generated findings, drive down false positives, and work with maintainers to land verified fixes. She’ll also benchmark these new approaches against established SAST, DAST, and dependency-scanning tools so that what we adopt is what actually works.

What this means for Eclipse Foundation projects

If you maintain an Eclipse Foundation project, here’s what to expect:

Nothing changes about how you report security issues — the existing vulnerability reporting process remains the front door.
Over the coming months, some projects will be invited to participate in proactive security reviews. Participation is collaborative, and findings will always be validated before they reach you.
If your project has been struggling with a flood of low-quality AI-generated reports, we want to hear about it. Helping you manage that intake is squarely within this team’s mission.
The methods, tools, and playbooks we develop will be documented and shared so every project in the ecosystem can benefit.

Please share your questions, concerns, and suggestions in the Eclipse CSI GitHub Discussions area.

We’re grateful to Alpha-Omega for their support, to our peers across the Rust, FreeBSD, NodeJS, and other open source ecosystems for the collaboration ahead, and to the Eclipse Foundation community for the trust you place in the Security Team. AI has raised the stakes for open source security, but it has also given defenders powerful new tools. With Alessia and Miruna on board, we intend to make the most of them.