# this is a big issue for cybersecurity Source: https://www.youtube.com/watch?v=8w6r4MKSe4I Recap page: https://rapidrecap.app/video/8w6r4MKSe4I Generated: 2025-07-18T16:32:41.194+00:00 --- ## Quick Overview The rise of AI-generated, low-quality bug reports, termed "AI slop," significantly burdens open-source project maintainers like Daniel Stenberg of curl, wasting substantial time and human resources. While AI can assist in finding genuine vulnerabilities, its current misuse by some researchers to generate numerous invalid reports creates a critical "denial of service" on human review capacity, necessitating changes in bug bounty program submission policies. **Key Points:** - Approximately 20% of all bug bounty submissions to curl in 2025 are AI-generated "slop," lacking genuine vulnerabilities. - AI slop reports waste significant human resources, with curl's small seven-member security team spending 30 minutes to 3 hours per invalid report. - Examples of AI slop include hallucinated code paths and non-existent API calls, leading to false vulnerability claims. - While AI can find real bugs, as demonstrated by Sean Heelan's discovery of a Linux kernel zero-day, successful application requires extensive human validation and filtering. - Heelan's AI model (o3) produced 98 false positives for every 2 genuine vulnerabilities found, highlighting the poor signal-to-noise ratio of raw AI output. - HackerOne is considering measures like requiring AI disclosure in reports and implementing submission fees to combat the influx of low-quality submissions. - The current trend poses a "denial of service" threat to human maintainers, diverting their efforts from critical security work. ![Screenshot at 0:06: Daniel Stenberg's blog post titled "Death by a Thousand Slops" discussing AI slop in vulnerability reports.](https://ss.rapidrecap.app/screens/8w6r4MKSe4I/00-00-06.png) **Context:** Daniel Stenberg, the lead maintainer of the widely used open-source project curl, has observed a concerning trend in bug bounty submissions on platforms like HackerOne. This trend, which he terms "AI slop," involves a significant increase in low-quality or entirely fabricated vulnerability reports generated by artificial intelligence. These reports, despite being invalid, demand substantial time and effort from the small team of human maintainers responsible for validating and addressing genuine security issues. ## Detailed Analysis The cybersecurity landscape faces a growing challenge from "AI slop," a phenomenon where artificial intelligence generates a high volume of low-quality or entirely fake vulnerability reports. Daniel Stenberg, the lead maintainer of the widely used curl project, highlights this issue in his blog post "Death by a Thousand Slops," revealing that approximately 20% of all bug bounty submissions to curl in 2025 are AI-generated and invalid. These reports, often hallucinating non-existent code paths or vulnerabilities like a "Use-After-Free" in libcurl where the relevant function is never called, force the small curl security team (seven members) to spend significant time (30 minutes to 3 hours per report) triaging and validating them. This effectively creates a denial-of-service attack on human resources. In contrast, the video presents an example of Sean Heelan, a security researcher who successfully used OpenAI's o3 model to discover a genuine remote zero-day vulnerability (CVE-2025-37899) in the Linux kernel's SMB implementation. The key difference lies in Heelan's manual validation and careful filtering, as his AI model still produced 98 false positives out of 100 runs. To combat AI slop, HackerOne is considering measures such as requiring disclosure of AI assistance in reports and potentially implementing a fee for submissions, which would be refunded upon validation, to disincentivize low-quality submissions and protect maintainers' valuable time. ### The Problem of AI Slop - Daniel Stenberg, curl's lead maintainer, reports that 20% of bug bounty submissions in 2025 are AI-generated "slop" - These reports often describe non-existent vulnerabilities or hallucinated code paths, wasting significant human resources - The curl security team, consisting of only seven members, spends 30 minutes to 3 hours triaging each report, regardless of validity. ### Examples of Invalid AI Reports - One AI-generated report claimed a "Disk Space Exhaustion leading to a Denial of Service (DoS)" vulnerability in curl, but the described code path was not actually exploitable - Another report alleged a "Use-After-Free (UAF) vulnerability in OpenSSL Keylog Callback via SSL_get_ex_data() in libcurl," but the function SSL_get_ex_data() is not used anywhere in libcurl's code. ### Successful AI-Assisted Vulnerability Discovery - Security researcher Sean Heelan successfully used OpenAI's o3 model to find a remote zero-day vulnerability (CVE-2025-37899) in the Linux kernel's SMB implementation - Heelan's method involved careful manual auditing and testing, as his AI model still produced 98 false positives for every 2 genuine findings. ### Impact on Maintainers and Signal-to-Noise Ratio - The influx of AI slop creates a "denial of service" on human resources, as maintainers are overwhelmed with invalid reports - The signal-to-noise ratio for bug bounty submissions has drastically worsened, making it harder to identify and address real threats. ### Possible Solutions and Future Outlook - HackerOne is considering requiring researchers to disclose if AI was used in their reports to help filter submissions - They are also exploring implementing a submission fee for bug reports, which would be refunded if the vulnerability is validated, to disincentivize low-quality submissions - The effective use of AI in vulnerability research still requires highly seasoned and knowledgeable researchers to validate findings and filter out hallucinations. ![Screenshot at 0:06: Daniel Stenberg's blog post titled "Death by a Thousand Slops" discussing AI slop in vulnerability reports.](https://ss.rapidrecap.app/screens/8w6r4MKSe4I/00-00-06.png) ![Screenshot at 0:15: Daniel Stenberg's HackerOne profile, showing him as a curl developer and core maintainer.](https://ss.rapidrecap.app/screens/8w6r4MKSe4I/00-00-15.png) ![Screenshot at 0:47: Flare.io dashboard displaying "Collection Overview" with over 11 million events collected, highlighting its threat exposure management capabilities.](https://ss.rapidrecap.app/screens/8w6r4MKSe4I/00-00-47.png) ![Screenshot at 1:06: Flare.io's "Events Global Search" interface, showing a search for "0-day" and a chat offering a zero-day sale for QTalks.](https://ss.rapidrecap.app/screens/8w6r4MKSe4I/00-01-06.png) ![Screenshot at 2:18: Daniel Stenberg's blog post text highlighting that "about 20% of all submissions" in 2025 are AI slop.](https://ss.rapidrecap.app/screens/8w6r4MKSe4I/00-02-18.png) ![Screenshot at 2:26: A HackerOne report titled "Disk Space Exhaustion leading to a Denial of Service (DoS)" submitted to curl, which is later identified as an AI-generated false positive.](https://ss.rapidrecap.app/screens/8w6r4MKSe4I/00-02-26.png) ![Screenshot at 3:50: A HackerOne report titled "Use-After-Free in OpenSSL Keylog Callback via SSL_get_ex_data() in libcurl," which Daniel Stenberg explains is a hallucinated vulnerability.](https://ss.rapidrecap.app/screens/8w6r4MKSe4I/00-03-50.png) ![Screenshot at 5:30: Daniel Stenberg's blog post text stating that the curl security team consists of seven members and each report engages 3-4 persons for 30 minutes to 3 hours.](https://ss.rapidrecap.app/screens/8w6r4MKSe4I/00-05-30.png) ![Screenshot at 6:27: Sean Heelan's blog post titled "How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel's SMB implementation," showcasing successful AI-assisted bug hunting.](https://ss.rapidrecap.app/screens/8w6r4MKSe4I/00-06-27.png) ![Screenshot at 10:05: A list from Daniel Stenberg's blog post showing various vulnerability reports submitted to curl, many of which are AI-generated nonsense.](https://ss.rapidrecap.app/screens/8w6r4MKSe4I/00-10-05.png)