Increased AI-Generated Security Reports Overwhelm Open Source Maintainers

• •Open-source maintainers face increased workloads due to a rise in credible AI-generated security reports.
• •The Internet Bug Bounty program has paused monetary awards for vulnerabilities to reassess their structure.
• •Many AI-generated reports are valid but do not necessarily indicate serious security flaws.

Open-source projects are experiencing a surge in AI-generated security reports, leading to increased workloads for maintainers. Daniel Stenberg, founder of the curl project, noted a significant decline in low-quality AI-generated reports, replaced by a higher volume of credible submissions. This influx is straining resources, as maintainers must evaluate more reports, many of which do not represent serious threats. The Linux kernel team is similarly affected, with maintainer Greg Kroah-Hartman acknowledging the challenges posed by the increased volume of valid concerns. In response to the changing landscape, the Internet Bug Bounty program has halted monetary awards for vulnerabilities, citing the need to reassess their approach to discovery and remediation. The situation reflects a broader shift in vulnerability discovery practices across the open-source ecosystem.