I think all this goes to the joke/not-a-joke about "you aren't a real hacker until you have a CVE to your name". Its also a form of forced social proof.

The incentives here are really bad at the moment. Traditionally, your name on a CVE against an important project like curl have a certain cachet in the community. You might even leverage that to get a raise or a better job, so money was definitely part of this.

Now lots of people are throwing code against LLMs and then copy/pasting whatever comes out into "security" reports.

We decided for our projects that any LLM-generated security reports are simply copied to the public list. Everyone has access to LLMs so presumably if one LLM instance found it, then all users of LLMs have already or shortly will find it. We'll fix them if they're important, but the signal to noise is pretty bad.

I think this will, eventually, result in more secure services as the low hanging problems are found and fixed. But unfortunately I don't see the flood of LLM-generated nonsense ending any time soon.

Someone must have really wanted to put this on their CV.