AI vulnerability chaining overwhelms open source disclosure; 6% upstreamed, forcing trusted forks.