PSF hires Brett Smith as Security Developer with Anthropic funding

The Python Software Foundation has hired Brett Smith as a Security Developer, expanding its security team amid rapidly escalating threats to the Python ecosystem. Smith will join Seth Larson, the Security Developer in Residence, and Mike Fiedler, the PyPI Safety and Security Engineer, to address what the PSF describes as an unprecedented scale of security work. The new position is funded by Anthropic, marking a significant corporate sponsorship directed specifically at Python infrastructure security.

The hiring responds to stark growth in reported security issues: the Python Security Response Team is now handling three to four times the volume of vulnerability reports and CVEs for Python and pip compared to 2025, while malware published to and removed from PyPI has increased 60% year-over-year. Smith's background spans software development, Linux administration, and nonprofit work at the W3C and Software Freedom Conservancy, as well as contributions to open source projects including Request Tracker and Arvados.

Expanded security team and emerging priorities

• Vulnerability response scaling: The PSRT is processing 3-4× the volume of reports and CVEs for Python and pip compared to the previous year, straining existing team capacity.
• PyPI malware growth: Malware published to and subsequently removed from PyPI has risen 60% year-over-year, requiring increased automated and manual intervention.
• Autonomous quarantine expansion: Smith will help scale PyPI's autonomous quarantine program, which aims to reduce manual effort in malware remediation workflows.
• CVE Numbering Authority operations: The team maintains ongoing responsibility for providing vulnerability data as a recognized CVE Numbering Authority for the Python ecosystem.
• AI-driven security evolution: The PSF explicitly notes that AI is changing both the nature of security risks and the methods available for security response in package ecosystems.

Why it matters

This expansion directly addresses a critical bottleneck in one of the world's most widely used programming language ecosystems, where PyPI serves as a central dependency hub for millions of projects. For Linux distributions, system administrators, and developers, a better-resourced PSF security team means faster vulnerability coordination, more reliable CVE metadata, and reduced window of exposure to supply-chain malware. Anthropic's targeted sponsorship also signals growing recognition among AI companies that foundational open-source infrastructure requires sustained security investment rather than passive consumption.