AI in Open-Source Cryptography: Auditor, Not Author

AI has dramatically changed most people’s daily workflows, but what are its effects in open-source cryptography?

To answer this question, some of the most prominent names in the field joined the AI in Open-Source Cryptography panel to compare notes on day three of the OpenSSL Conference 2026 in Prague, Czech Republic.

The panellists included David Hook , Co-Founder and Lead Developer of The Legion of the Bouncy Castle , Dr Peter Gutmann , Computer Scientist and Founder of cryptlib , Megan Woods , who is a maintainer of Bouncy Castle as well as the Lead Engineer behind Jostle and Neil Horman , Software Engineer at OpenSSL .

The discussion was moderated by Sam Sabin, Cybersecurity Reporter at Axios.

How are open-source maintainers using AI?

Neil’s “personal favourite” use of AI is to treat it like a “junior engineer or intern”.

“I'm still very nervous using it in any sort of automated sense to [analyse] security reports,” Neil says.

“I find it is most beneficial when I’m using it to try to understand code I haven’t looked at before.”

He stresses the importance of using it as an “assistive technology rather than an automated technology”.

Megan says she uses AI in projects where she is already familiar with the codebase, noting that she finds the technology particularly useful in “iterative test development and exploratory tasks around that”.

Peter uses AI as a “code audit tool” as he does not “trust AI to write code”, but notes it has been a very valuable tool for auditing.

Like most organisations, Bouncy Castle is receiving a lot of bug reports through email and David says AI has been “exceptionally useful in auditing those”.

“I think code review really is the most outstanding thing it,” David adds.

“The ability of some of the models to actually analyse code and find things that humans, I know for a fact, just miss.”

David says he does use AI for code generation, but makes it a point to check the output, particularly if it involves “anything with public API because they’re really not very good at generating public APIs”.

AI limitations: where does it fall short in cryptography?

The answer to this question Dr Peter thinks “changes over time”. Initially when he was using AI , it was “a little bit better than slop,” Dr Peter says.

Whenever he was trying to use it for anything interesting, he kept “running into guardrails”, but this behaviour has improved as of late, and is allowing “legitimate code audit and isn’t applying the guardrails ”.

Megan elaborates on her experience with Anthropic since buying a US$300 account and has been doing prompt engineering where she uses Fable to “build plans” while using “Opus to do the actual work”, allowing both models to communicate with each other via a Unix domain socket on macOS.

She ran into many issues where the models did not get “basic programming” right.

“It implemented code that would take raw strings off the network and map them straight to the file system with no checking,” Megan recalls.

“It would take integers off the network and pass them and put them in critical situations where you could easily try and allocate petabytes of data in memory.”

Other issues she faced included AI not checking string provenance.

These are serious issues because trusting unchecked network strings and integers can let attackers traverse or overwrite files, spoof data provenance and trigger uncontrolled memory allocations that cause denial of service (DoS) or potentially remote code execution (RCE).

Megan says she had to “spend quite a bit of money to actually go back and get the thing fixed”.

This is where it may impact non-coders who are using the tool, where “if you don’t know to turn around and literally tell it what to do, you are just going to end up in trouble”.

With all of this connected to the internet, Megan says “it's going to be infinitely exploitable”.

Is AI only as good as the programmer using it?

Dr Peter is of the opinion that: “If you’ve got mediocre programmers and they use AI, you get mediocre code.

“If you've got very good programmers and they use AI, you get very good code.”

The implication being that AI can actually “lower the productivity of good programmers”.

Dr Peter explains that when an AI gives a really good programmer “a huge blob of code”, then that programmer “sits there and spends twice as long auditing the code, trying to find problems as they would have to if they simply wrote the code directly themselves”.

But he is also quick to point out that the rules have now changed with the evolution of AI .

“With say [Opus] 4.8, it would say there is a potential problem and I’d say, well okay, here is the fix and it would say that looks right.

“Now with 5.5 you provide a fix and [it] says, okay, I’ve pulled down a copy of the code off GitHub. I’ve merged the fixer. I’ve run 10,000 test cases and all the boundary conditions are checked.

“And this is some internal low level function that you can’t call from the external API.

“So even in just six months, they've made huge leaps and bounds in improving these things,” Dr Peter notes.

The AI in Open-Source Cryptography panel at the OpenSSL Conference 2026 in Prague, Czech Republic, was moderated by Axios reporter Sam Sabin

Neil Horman, Software Engineer at OpenSSL, uses AI as an “assistive technology” similar to a junior engineer, rather than an automated tool

David Hook, Co-Founder of the Legion of the Bouncy Castle, says AI is “exceptionally useful” for auditing the reports Bouncy Castle receives

Megan Woods, Creator of JOSTLE, found AI-generated code accepted unchecked network strings and integers, risking file-system access and uncontrolled memory allocation

Dr Peter Gutmann, Founder of cryptlib, says “very good programmers” using AI produce “very good code” while mediocre programmers produce mediocre code

In short, the panellists say AI is most valuable for auditing and assisting developers, but is not yet reliable enough to write secure cryptographic code unsupervised

David Hook Co-Founder and Lead Developer

Co-Founder and Lead Developer

Dr. Peter Gutmann Founder and Maintainer

Founder and Maintainer

Megan Woods Senior Software Engineer

Senior Software Engineer

Neil Horman Software Engineer

OpenSSL: Open-Source Security and the Explosion of AI Bugs Cyber Security

Top 10: Cloud Security Companies Cloud Security

OpenSSL Conference: AI, Quantum and the Future of Encryption Cyber Security

Cryptography Legend Tim Hudson on Software Security Operational Security