Every secure connection made from an Erlang, Elixir, or Gleam application runs through code she wrote. Most developers have never heard her name.
Ingela Andin has spent more than two decades on the OTP team at Ericsson, maintaining the TLS stack — the piece of infrastructure underneath HTTPS, LDAP, SMTP, and every other secure protocol in the BEAM ecosystem. She is the first point of contact when an AI-generated vulnerability report lands in the OTP inbox. And this year, that inbox changed entirely.
At the start of 2026, maintainers were still laughing at AI bug reports. Daniel Stenberg, creator of Curl, shut down his bug bounty because the reports were hallucinating junk. Then in the space of weeks, the table turned. The reports became real and they kept coming. Linus Torvalds called the kernel security list almost entirely unmanageable. The BEAM did not escape.
Topics include:
* what separates a vulnerability from a bug — and what separates a bug from someone doing something dumb
* what Ingela's inbox looked like at the start of 2026 and what it looks like now
* what a hallucinated AI vulnerability report actually looks like — the asymmetry example that sounded serious and wasn't
* why the domain knowledge of the person running the scanner matters more than the scanner itself
* how the OTP team triages reports: domain knowledge first, then AI agents to help narrow it down, then human verification
* the full fix pipeline: from GitHub advisory to coordinated patch release across three maintained OTP versions to CNA publication
* what happens when a bug fix has a bug — and why that's more embarrassing than a partial fix
* property-based testing as the tool the team uses to stop bugs from coming back
* the one thing Ingela wishes every developer understood before filing a report: write the reproduction case in Erlang, include the full crash report, and don't leave details out
* what companies depending on OTP can actually do to help — starting with the "Help Wanted" label on GitHub
Companion episodes: BEAM Security Wake-Up Call with Jonathan Machen and Peter Ullrich; Bruce Tate on AI, juniors, and coding agents.
Recorded October 1, 2026.
