I don’t think you took a look at the different reports :)

All are wrong, with hallucinations, and reviewers clearly loses their time with that kind of things.

AI is here to accelerate people’s job(s). Not losing their mind and time.

Please read the news before responding. An AI can do that, why don’t you do that too…?

I clicked on this report at random: https://hackerone.com/reports/2905552

This isn’t fuzzing, this is a totally garbage report that I’d have chewed out any security “researcher” reporting this to me.

Given how it was the first link I clicked I feel safe in saying the probability is the rest are just as bad.

Could you maybe focus more on fuzzing the software, and less on fuzzing maintainers? You seem to applaud people submitting unverified reports in mass, for material and reputational gain, harming maintainers' ability to react to valid reports. Why?

They are not "just tools" - they are false reports, wasting the maintainers' precious time. The hostility comes from the asymmetry. AI generates info very fast, humans verify info much slower.

Take a look at this example: https://hackerone.com/reports/2823554 . The fool reporting this can't even justify his AI generated report, not even with the further use of AI. There is no AI revolution here, just spam, and grift.

Check out the actual reports. This is not "fuzzing with AI", it's semantically invalid reports (or outright fluff text masquerading as security mansplaining) showing absence of understanding of what is being reported.

I don't think fuzzing means what you think it means.

The hostility is not geared towards AI, they are just dumb tools, but sloppy and stupid reporters. AI is enabling those stupid reporters. The linked report basically says in typical AI blathering (paraphrase) "you use strcpy(), strcpy() is known to cause buffer overflows if not bounds checked, thus you have buffer overflow bugs"

Obviously, the logic doesn't hold. Anyway, asked to provide a specific line in a specific module where strcpy() is not bounds checked, the response is "probably in curl.c near a call to strcpy()." That moved from sloppy to stupid pretty quickly, didn't it?

And there are dozens if not hundreds of these kinds of reports. Hostility towards the reporters (whether AI or not) is justified.

>By all means, use AI to learn things and to figure out potential problems, but when you just blindly assume that a silly tool is automatically right just because it sounds plausible, then you're doing us all (the curl project, the world, the open source community) a huge disservice. You should have studied the claim and verified it before you reported it.

https://hackerone.com/reports/2887487

Given the limited resources available to many open source projects and the volume of fraudulent reports, they function similar to a DDOS attack.

Hostility is towards people using AI to generate garbage report spam at scale, which require time investigate, each one individually.

"Fuzzing with AI", hilarious. Why do you think inexperienced clout chasers waited for LLMs before they started "fuzzing"? Why not use existing (real) fuzzing tools?

Because they have no idea what they're doing and for some reason they think they can use LLMs to cosplay as security researchers.

It's pretty clear that in like half of these the "researcher" is just copy pasting the followup questions back into whatever LLM they used originally. What a colossal waste of everyone's time.

I think the only saving grace right this second is that the hallucinations are obvious and text generation is just awkward enough in overly-eager phrasing to recognize. But if you're seeing it for the first time, it can be surprisingly convincing.

Honestly? Might be wiser block submissions from certain parts of the world that are known for spamming things like that

Or have an infosec captcha, but that's harder to come by