Taking for example the one listed as https://hackerone.com/reports/2871792.

With the advantage of hindsight, the issue should have been entirely dismissed, and the account reported as invalid, right at the third message (November 30, 2024, 8:58pm UTC); the fact that curl maintainers allowed the "dialog" to continue for six more messages shows to be a mistake and a waste of effort.

I would even encourage curl maintainers to upfront reject any report that fails to mention a line number in the source code, or a specific piece input that triggers an issue.

It's unfortunate that AI is being used to worsen the signal/noise ratio [1] of such sensitive topics such as security.

[1] http://www.meatballwiki.org/wiki/SignalToNoiseRatio

I worked my way through about half the examples. What appalling behavior by several of the "submitters".

This comment [1] by icing (curl staff) sums up the risk:

> "This report and your other one seem like an attack on our resources to handle security issues."

Maintainers of widely deployed, popular software, including those whom have openly made a commitment to engineering excellence [2] and responsiveness [like the curl project AFAICT], can not afford to /not/ treat each submission with some level of preliminary attention and seriousness.

Submitting low quality, bogus reports generated by a hallucinating LLM, and then doubling down by being deliberately opaque and obtuse during the investigation and discussion, is disgraceful.

[1] https://hackerone.com/reports/3125832#activity-34389935

[2] https://curl.se/docs/bugs.html (Heading: "Who fixes the problems")

49 points, 4 hours, but only on page three.

This is a highly relevant log of the destructive nature of "AI", which consumes human time and has no clue what is going on in the code base. "AI" is like a five year old who has picked up some words and wants to sound smart.

I suppose the era of bug bounties is over.

AI slop is coming in all forms. I see people using AI for code reviews on github now and they are net negative leading people to do the wrong things.

The consequence of having an issue report system is that people submit random shit just to report something. The fact that they use AI to autogenerate reports allows them to do that at an unprecedented scale. The obvious solution to this problem is to use AI to filter out reports that aren't valuable. Have AI talk to AI.

This might sound silly but it's not. It's just an advanced version of automatic vulnerability scans.

The primary use case of LLMs is producing undetectable spam.