this is a big issue for cybersecurity

Quick Overview

The rise of AI-generated, low-quality bug reports, termed "AI slop," significantly burdens open-source project maintainers like Daniel Stenberg of curl, wasting substantial time and human resources. While AI can assist in finding genuine vulnerabilities, its current misuse by some researchers to generate numerous invalid reports creates a critical "denial of service" on human review capacity, necessitating changes in bug bounty program submission policies.

Key Points: Approximately 20% of all bug bounty submissions to curl in 2025 are AI-generated "slop," lacking genuine vulnerabilities. AI slop reports waste significant human resources, with curl's small seven-member security team spending 30 minutes to 3 hours per invalid report. Examples of AI slop include hallucinated code paths and non-existent API calls, leading to false vulnerability claims. While AI can find real bugs, as demonstrated by Sean Heelan's discovery of a Linux kernel zero-day, successful application requires extensive human validation and filtering. Heelan's AI model (o3) produced 98 false positives for every 2 genuine vulnerabilities found, highlighting the poor signal-to-noise ratio of raw AI output. HackerOne is considering measures like requiring AI disclosure in reports and implementing submission fees to combat the influx of low-quality submissions. The current trend poses a "denial of service" threat to human maintainers, diverting their efforts from critical security work.

Context: Daniel Stenberg, the lead maintainer of the widely used open-source project curl, has observed a concerning trend in bug bounty submissions on platforms like HackerOne. This trend, which he terms "AI slop," involves a significant increase in low-quality or entirely fabricated vulnerability reports generated by artificial intelligence. These reports, despite being invalid, demand substantial time and effort from the small team of human maintainers responsible for validating and addressing genuine security issues.