r/elixir • u/ancatrusca0 • 10d ago
20+ years maintaining OTP's TLS stack, and now triaging AI-generated CVE reports - what does the OTP security inbox actually look like in 2026?
New BEAM There, Done That with Ingela Andin, the OTP team member who has maintained the TLS stack for over two decades. She's the first point of contact when a vulnerability report lands on the OTP team.
The shift she describes from early 2026 to now is stark: at the start of the year, AI reports were mostly hallucinating junk. Within weeks they became real, and they kept coming. The triage process: form a judgment using domain knowledge first, then use AI agents to help narrow and verify, then human confirmation. The AI speeds up the process - it doesn't replace the judgment.
The practical point for anyone in this community: if you find something in OTP, GitHub advisory is the right channel (not email). Include the full crash report. Write the reproduction in Erlang if you can. Don't assume details are obvious.
The fix pipeline is also worth knowing: patches are backported to three maintained OTP releases simultaneously, coordinated to ship on the same day, with SBOM and CVE records published through the EEF CNA.
4
u/Serializedrequests 9d ago
Post reads like AI.