PatchWarden: Maintainer-Side AI Security Triage

Problem. Open-source maintainers are buried. Around 48,000 vulnerabilities are reported every year, and a fast-growing share are AI-generated "slop": confident, well-formatted bug reports for vulnerabilities that do not actually exist. Every one still has to be read, verified, and answered — usually by volunteers working unpaid in their evenings. Existing tools (Dependabot, Snyk, scanners) are all built for the reporter: they produce MORE alerts and leave verification and the fix to the human. Solution. PatchWarden is built for the person who has to answer all of it — the maintainer. For every inbound report, IBM Bob runs the loop a careful maintainer would, only faster and with receipts: 1) Parse the report as untrusted input (it never obeys instructions hidden inside a report — prompt injection is treated as data, not commands). 2) Verify every claim against the real library code. 3) Reproduce the genuine ones with a failing test in a disposable, offline sandbox (two local servers, synthetic credentials, no internet). 4) Patch — a minimal fix plus a regression test and a pull-request draft the human reviews in minutes. PatchWarden proposes; it never merges. The human decides. Proof. We demonstrate it on three reports against the Python "requests" library: one real CVE (CVE-2023-32681 — proxy credentials leaking on a cross-host HTTPS redirect), which Bob confirmed, reproduced offline, and patched; and two fabricated reports — a fake "critical RCE" and a prompt-injection attempt — which Bob rejected with cited evidence, wasting zero maintainer time. Target users & interaction. Maintainers and security teams open a local dashboard, pick an inbound report (or paste their own), and click "Run triage." Bob returns a verdict with confidence, cited file:line evidence, the reproduction result, and — for real issues — a patch and regression test. Run history and SHA-256 evidence manifests persist locally. Why it's different. It is the only side of the problem no one builds for: it rules on each report with evidence, reproduces the real ones, and hands over a fix — turning a flood of unverified alerts into a short, trustworthy queue. It runs fully offline, uses only synthetic credentials, and every reproduction is tamper-evident.