The promise of artificial intelligence in cybersecurity has turned into a nightmare for software maintainers. AI-assisted vulnerability research has exploded, unleashing a firehose of low-quality reports that are drowning developers in noise instead of helping them fix real problems. The result is a growing crisis: maintainers waste hours sifting through junk, duplicates pile up, and the most critical vulnerabilities are lost in the shuffle.

The flood of AI slop

Linus Torvalds, the creator of the Linux kernel, recently described the situation in stark terms. The project's security mailing list has become 'almost entirely unmanageable, with enormous duplication due to different people finding the same things with the same tools.' Torvalds wrote this in the note accompanying the latest Linux kernel release candidate. His frustration reflects a broader issue: AI tools make it trivially easy to scan code for patterns that might indicate a vulnerability, but they don't understand context. As a result, multiple researchers using the same models often submit identical or near-identical reports, each believing they have discovered something new.

Torvalds advised researchers to add real value on top of what AI provides: 'If you found a bug using AI tools, the chances are somebody else found it too. If you actually want to add value, read the documentation, create a patch too, and add some real value on top of what the AI did. Don't be the drive-by 'send a random report with no real understanding' kind of person.'

GitHub tightens the gates

The problem extends far beyond the Linux kernel. Jarom Brown, Senior Product Security Engineer at GitHub, acknowledged that while AI lowering the barrier to entry for security research is welcome in principle, his team is being inundated with submissions that fail to demonstrate any real security impact. These include reports without a proof of concept, theoretical attack scenarios that don't hold up under scrutiny, and findings already covered by GitHub's published ineligible list.

GitHub is not alone. 'Programs across the industry are grappling with the same challenge, and some have shut down entirely,' Brown said. To combat the deluge, GitHub now requires submitters to validate AI-assisted findings before sending them in. A complete submission must include a working proof of concept demonstrating exploitation potential and concrete security impact. Reports that fall into known ineligible categories are closed as Not Applicable, a move that may affect the submitter's HackerOne Signal and reputation. Brown also urged researchers to be concise, noting that bloated, AI-padded reports slow down triage and waste everyone's time.

The researcher's perspective

The collateral damage extends beyond the programs themselves. Shubham Shah, co-founder of Assetnote and a respected security researcher, says organizations are now taking far longer to review legitimate reports and act on real flaws. That delay kills the feedback loop that keeps top researchers engaged. Bug bounty platforms like HackerOne and Bugcrowd are trying to fight the onslaught with AI triage and additional controls, but Shah says 'the joy of reporting vulnerabilities to bug bounties is quickly dissipating.' He noted that it is not just his own experience: many experienced researchers are losing patience. 'Hopefully the platforms actually work this out, but until then, I can't see myself continuing to report high quality original research to certain programs where I have meaningfully contributed for a decade when they fail to understand the difference between myself and a researcher that doesn't have any credibility.' In the near term, some experienced researchers may retreat to private vulnerability research and invite-only bounties.

This trend has serious implications for the quality of security research overall. When top experts stop reporting through public channels, the ecosystem loses their expertise. The platforms risk becoming a dumping ground for low-effort submissions while real talent moves elsewhere.

Open source bears the brunt

The AI-powered 'industrialization' of vulnerability discovery is currently a much bigger problem for open source projects than for large organizations like Microsoft or Google. Big companies have dedicated security teams that can triage hundreds of reports a day. Open source projects, by contrast, rely on volunteer maintainers whose number and time are limited. Those limitations have forced some projects to make drastic changes. The cURL project, a widely used file transfer tool, stopped accepting HackerOne submissions and eliminated monetary rewards for security reports. Daniel Stenberg, cURL's lead developer, hoped the removal of bounties would remove the incentive for submitting AI slop. He believed that 'the best and our most valued security reporters still will tell us when they find security vulnerabilities.'

The project initially switched to welcoming reports via GitHub or email, but a month later reverted to using HackerOne because those two avenues proved less effective for reporting vulnerabilities. However, the project stuck with its decision not to offer bounties. 'From that day, the nature of the security report submissions have changed. The slop situation is not a problem anymore,' Stenberg noted in April. The number of reports rose, their quality was higher (even if some were compiled with the help of AI), and the rate of confirmed vulnerabilities surpassed the 2024 pre-AI level.

While that change was welcome, Stenberg believes the raised influx of 'good' vulnerability reports will present a different problem for open source projects. 'This avalanche is going to make maintainer overload even worse. Some projects will have a hard time to handle this kind of backlog expansion without any added maintainers to help,' he pointed out. In other words, even high-quality AI-assisted reporting may overwhelm limited resources.

Platforms and foundations react

In the wake of cURL's departure and return, HackerOne acknowledged the problem AI slop may represent for under-resourced organizations. Michiel Prins, Co-founder & Senior Director of Product Management at HackerOne, advised customers to refine the scope and submission guidelines to reduce noise, use AI-assisted triage tools, and pair that automation with human oversight. 'As AI makes it easier to automate submissions, preserving signal quality becomes critical so open source maintainers can stay focused on fixing real issues,' Prins said. 'Our focus is helping programs manage that shift with workflows that filter noise early, surface credible reports, and keep vulnerability management sustainable, so open source communities can maintain the transparency and resilience they're known for.'

The Open Source Security Foundation's Vulnerability Disclosures Working Group is also seeking community feedback as it works to help open source maintainers tackle AI-generated junk reports. Its goals include compiling best practices, creating policy templates, and developing guidance to help maintainers spot and handle AI-assisted submissions. The working group is still in the information-gathering phase, but early suggestions include requiring submitters to explain how they validated the finding and providing templates for maintainers to quickly reject obvious junk.

What lies ahead

The problem is not going away. As AI tools become more sophisticated and accessible, the number of automated vulnerability scans will only increase. The key challenge for the industry is figuring out how to separate signal from noise without discouraging genuine research. Some observers suggest that reputation systems and trust-based networks will become more important. Others argue that the only sustainable solution is to invest in better triage automation and to expand the pool of maintainers through funding and training.

For now, the burden falls on individual projects and platforms to adapt. The cURL experiment shows that removing financial incentives can shift behavior, but it does not eliminate the underlying pressure of volume. The Linux kernel's struggles highlight the need for structural changes in how security reports are submitted and processed. And the voices of researchers like Shubham Shah remind us that the human element matters: if the system treats everyone the same—legitimate experts and AI-powered amateurs alike—it risks losing its best contributors.

Ultimately, the flood of AI junk security reports is a symptom of a larger mismatch between the ease of generating reports and the difficulty of assessing their quality. Bridging that gap will require not just technological fixes, but also cultural changes in how the security community values and validates work. Until that happens, maintainers will continue to drown.

Source: Help Net Security News