Release Timing of Fixes for Published Vulnerabilities in AI/ML and Matched Non-AI PyPI Packages: An Initial Plan With Documented Pre-Outcome Amendments, Whose Median Difference Did Not Survive Removing One Package Family
Year: 2026
Type: preprint
Abstract: We compare, for Python packages on PyPI, the date a security advisory was published with the upload date of the earliest release that fixes it, for AI/ML packages (PyPI classifier Topic :: Scientific/Engineering :: Artificial Intelligence) and download- and age-matched non-AI controls. In the matched sample (89 AI/ML packages, 2,669 advisories; 176 controls, 1,681 advisories) a fixed release existed before the advisory for 78.2% of AI/ML advisories and 97.6% of control advisories. The median difference in lag depends on the tensorflow package family; the share difference does not. No causal claim is made. The analysis and drafting were done with Claude (Anthropic); Codex (OpenAI) acted as a referee-style reviewer. Neither is an author. No human has yet read the full text; see the Declarations section.
Author: Watanabe, Keisuke
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225651746
Cites:
Cited by:
Related to: