AI vulnerability discovery matches closed-source software speeds, forcing organisations to treat autonomous agents as first-class workloads with strict identity management, policy controls, observability, and rollback options. Open-source software provides a key defense through collective inspection, supply-chain audits, and field-tested patches. Professionals must set clear instrumentation, boundaries, and coordinated defense.