GoKawiilAnthropic grant funds new Python Software Foundation security developer role
Python's security developer in residence Seth Larson reports that CVEs for Python and Pip have tripled over the past year, while malware found on PyPI rose 60%. The Python Software Foundation is adding a second security developer, Brett Smith, funded by an Anthropic 'ecosystem security' grant, to help manage vulnerability remediation, CVE reporting, and malware removal.
GoKawiil's interpretation of the reporting above, not reported fact.
The surge in vulnerabilities and malware suggests growing strain on open-source maintainers who secure widely used infrastructure with limited staff. Anthropic's funding of this role could signal AI companies recognizing their dependence on — and possible contribution to — security risks in the software supply chains their tools rely on. Similar CVE spikes reported in Curl suggest this may reflect a broader pattern across major open-source projects rather than an issue unique to Python.
- Python and Pip CVEs have tripled in the past year, according to PSF's Seth Larson.
- Malware identified and removed from PyPI rose 60% over the same period.
- Anthropic is funding a new PSF security developer role to handle the increased workload and scale automated malware defenses.
Source: developers.slashdot.org — Posted, 2026-11-08
Published there as: “Python's CVEs Triple. Anthropic Funds a New Security Developer”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.