Headline

AI Is Drowning Software Maintainers in Junk Security Reports

Key Facts

• AI-assisted vulnerability research has produced a flood of low-quality, duplicated security reports.
• Linus Torvalds says the Linux kernel security mailing list is “almost entirely unmanageable” because different people are finding the same issues with the same tools.
• GitHub now requires submitters to validate AI-assisted findings and include a working proof of concept showing exploitation potential and concrete security impact.
• Security researcher Shubham Shah says review delays are killing the feedback loop that keeps experienced bug bounty hunters engaged.
• Open-source projects are especially exposed because they rely on limited volunteer maintainers.
• cURL eliminated monetary rewards for security reports, then returned to HackerOne without bounties; the project says the slop problem eased and confirmed vulnerabilities surpassed pre-AI levels.
• The Open Source Security Foundation’s Vulnerability Disclosures Working Group is seeking community feedback on guidance, best practices, and policy templates for AI-assisted submissions.

The industrialization of vulnerability discovery has arrived, and it is not arriving quietly. Large language models, autonomous agents, and AI-assisted code analysis tools have made it dramatically easier for anyone to generate a plausible-sounding security report. The result is a growing torrent of submissions that look like research but often lack the one thing that matters: evidence of a real, exploitable flaw. For software maintainers already stretched thin, the flood is turning security triage into a full-time exercise in noise filtering.

Linux Kernel Maintainers Call the Flood Unmanageable

Linus Torvalds, the creator of the Linux kernel, has described the situation in unusually blunt terms. He says the project’s security mailing list has become “almost entirely unmanageable, with enormous duplication due to different people finding the same things with the same tools.” The dynamic is simple: if one person uses an AI tool to find a bug, the odds are high that somebody else has used the same tool to find the same bug. Instead of adding new information, many reports add another layer of administrative burden.

Torvalds also offered a direct message to researchers who want their work to matter. “If you actually want to add value, read the documentation, create a patch too, and add some real value on top of what the AI did,” he wrote. “Don’t be the drive-by ‘send a random report with no real understanding’ kind of person.” The advice captures the core tension: AI can help generate a lead, but a lead is not a vulnerability report. It becomes useful only after a human has verified reachability, impact, and exploitability.

GitHub Tightens Submission Rules

Jarom Brown, a senior product security engineer at GitHub, acknowledged that AI has lowered the barrier to entry for security research. That development could be positive in principle. In practice, however, his team is being inundated by submissions that fail to demonstrate any real security impact. These include reports without a proof of concept, theoretical attack scenarios that do not hold up under scrutiny,

Source: Help Net Security News