Last month the Bytecode Alliance published security advisories for Wasmtime: the largest set of advisories the project has ever published at once, triple the total number issued in all of 2025. The accompanying patch releases (Wasmtime versions 43.0.1, 42.0.2, 36.0.7, and 24.0.7) address 12 vulnerabilities surfaced with the help of a frontier AI model.
Wasmtime is one of the most rigorously engineered runtimes in open source: written in Rust, continuously fuzz-tested, backed by multiple organizations who treat it as security-critical infrastructure. What this release demonstrates is that surfacing vulnerabilities in even the most hardened codebases is no longer the hard part. Finding them quickly and at scale is now within reach of any well-resourced team with access to a capable model.
The hard part is what happens next. Teams have to review each finding, triage severity and blast radius, and patch across active versions, while coordinating disclosure with production embedders before vulnerabilities become public. That work still requires deep expertise, sustained investment, and the kind of trust that only comes from years of doing it right. It shouldn't come as a surprise that, according to a technical blog from Anthropic Red Team, over 99% of vulnerabilities uncovered through similar research have not yet been patched.
At Cosmonic, we're privileged to be part of the Bytecode Alliance, and proud to be part of a community with the commitment to swift releases and advisories like the ones we saw in April.
